e2f3bfc8bf745f54a4b90be1e6c1c1fc4002e36a9c5a4f85af3a608fbe4c0c55

Analysis

max time kernel
1s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d825299ab3eb124ec124545f4c3785.html
Size

10KB
MD5

68d825299ab3eb124ec124545f4c3785
SHA1

bede5ade40563b18e2383af6e4f501b56b63462b
SHA256

e2f3bfc8bf745f54a4b90be1e6c1c1fc4002e36a9c5a4f85af3a608fbe4c0c55
SHA512

74a3520d34733dcd6b919f23862e5c9968e87362f312b8d0d869a8407a511de8ab2d32d7ba1f5a3e9b8275f0aec58e81cf50a590ee7a0fc630dda2d7c95a220c
SSDEEP

96:uzVs+ux7b0fLLY1k9o84d12ef7CSTUTGT/kbopwGBSj31962GBKFIdL5+BDlVHcD:csz7b0fAYS/yCzSj3zEKS70DPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDAA2791-AC82-11EE-B58D-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2252	2092	iexplore.exe	16
PID 2092 wrote to memory of 2252	2092	iexplore.exe	16
PID 2092 wrote to memory of 2252	2092	iexplore.exe	16
PID 2092 wrote to memory of 2252	2092	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68d825299ab3eb124ec124545f4c3785.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
962fecfc21c79bfe97a1ad5a693065cd

SHA1
9193e03c4cfcf77d71aa346120345a76d9378bdf

SHA256
951ef313eabf02b0324171bcdb717e3ea804b112f8f6368eac02f5d9862dfa78

SHA512
182d6cd854d886eefd1a22f821edbdd908db39094aa50ffec4c30edb9c2bfde9826e363dc17e843737ddc7c0b6ac17a4f47f984b6b9364f0f31b55bb9a9cd48b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34e860607f51591fa179acf5b139f979

SHA1
822bbc2bcca13a513796a3d789c78551747c7186

SHA256
edfe2610aa147985a68fda812234cbec41c3122fda3b6e918908dd0d6f84c57e

SHA512
92f213c441e084f4fa5724791b44c1a3124e1b663e5057e8d40f972f7c7153ab82769c0a1ad1bafa2a3e8dc5539ba93100abac7b13adfe8e8b99c0cf1c583dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19375b06e096dbc5fc2f62d13d5204df

SHA1
8cd22ccd913912025cbc2cbd824f8cdcc6d5109f

SHA256
f6cfe31777667c3fa5a139e7b8dab8e8e9bfc5f49c1ee0f36dddcdf45090c70b

SHA512
f3d2ab89581fc4d5fbde3a3c0074929d074790f0935119993579d02d8278dce5bb6e61843b7500c1be60146355028050f70d75a35223de2d5c740ea7f43413b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
314c033bb16db230dc895905883c05d6

SHA1
9a84339074b4a85deec19b5771717071803403d7

SHA256
400b37e753f96828b9c716da195cf58ee9561d062f415b3689c9ae05783842dc

SHA512
b9cf085aec2cd70e80d137a5e91eee1a8fc484874c87d16c789e76313f7681383d885b745e8e1d2a86f89c351169b9fd6ebbaabd265eec01089a1e68bca05b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1b35818383a1adb89bae74fa0e2b99c

SHA1
8e0aa56424b9e2448cc18f084f9ce2a4f017f00b

SHA256
b9cab70d52e63d34cfa4d11743eb9911dad15ef988ea54dd68ab53ba1598eba4

SHA512
ae0dde52bb12f2ffaf35c181c5984744acfa202f75bb58c57060b3daaf070dc5ae541b4d00a457f7b195403597e702ab0d909f09b92c03066e08c4c7329dc47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2203480bb1948a091aa7bb0eeee50e51

SHA1
e94d0b846be580ee697a2fc06efebcca903297fd

SHA256
3e65c8fffc673fb85ba43a992e695125de11be24571e174a69ac4aca1cbcd226

SHA512
894beeae89e0a74bfde6cb42d7768951efa1cf170eea43ae250de2e29ef72da95e13596f82f23c9fe45982ec1a716143fd743b40aafd672deae751b414392630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92eebb333dc6319b6745debac9d673b8

SHA1
ec3a8dfbc3f794de63dfc7ce4c423bef9ddc3d5d

SHA256
1c934abbfe934a1fc8b4d1dd4653b3a9e61cbcc17a83387588f3badd8b0e3218

SHA512
0f701277bbbf604c0736cf5a21c4d2942123ebbbf63cacc482e64a2989f3c868f4658446f9fcfe491463cf52728d1c3755bfa02c28d48e9e421fa98bce8f515d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86fbb6329248da3830338cbde86157f8

SHA1
613654d9c81ff9bcafe95e98a0bea50330510fae

SHA256
90ce9498e7c1f8c70da6d9b11d93411ac9048bac946a27922fe590df264e1c94

SHA512
815791e3cd9d13fd8affeb1c4b042dad1be2b7602d997a507ae9fd83be0b8b8766e2a3987931332fb235f0ebf8bba4b9028b6524ca0e0fc1601697b8cd04648a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8098.tmp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8156.tmp

Filesize
32KB

MD5
0cc0a4250323094bd3c2217342890baf

SHA1
0bf1d729fd8722249bd448ff5245a7ba51a4a389

SHA256
df35f8c6f01ca326ad85be33d4c9029ba1aea4d57bebae72f987524601087d8a

SHA512
333542fe9750e2162418f6f138f790d8d3c3a50edd05447017e98a6b3bd5116622ce9f550a24fe704705df72add16fc9c50231a88be71560428e8fb64f5a3e97

Download Submit