dbac1fa1d473386b923251972d9682da3dbbef96a26525c885396a770b20e201

Analysis

max time kernel
0s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78459bd6ac681a79aa1e4fede5f720ec.html
Size

107KB
MD5

78459bd6ac681a79aa1e4fede5f720ec
SHA1

1112b74ecc975d46681223ccf5f473c5d14a5ae5
SHA256

dbac1fa1d473386b923251972d9682da3dbbef96a26525c885396a770b20e201
SHA512

3ba9d3d163d91816e35cdc2acdc0543e5575dfe7e679cffebab42c76535e05b09fb9e7e36ed500098c6e69067800bb1c550a25afe002654b7a9f7db0cf2c28b8
SSDEEP

1536:IWTdTpUnO8/YNt3IIsyWfmFNDM3KeciRLZN2G9+8d66:IWTdTIfsuKeP5t9+8n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C25904F1-A52C-11EE-8221-D669B05BD432} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 860	3040	iexplore.exe	17
PID 3040 wrote to memory of 860	3040	iexplore.exe	17
PID 3040 wrote to memory of 860	3040	iexplore.exe	17
PID 3040 wrote to memory of 860	3040	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78459bd6ac681a79aa1e4fede5f720ec.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c11836fb138659478568d69ac35c1daa

SHA1
7554b24b6fbf42834b45d560db0be62aa1262ac6

SHA256
a9c80ea6ca71e728448881de59aa55e71064a78f7415182a37e26310e418de5f

SHA512
dcb6a60ead3525f035ff3840011dd4437e7ed1f87173d8064d48dd9ee9744f73e246bd9d8140f9fa8f7a95d57b0f3fb843c83626e84d92234d0a582f794fe11d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80968f67f9de275302fc3a8dcbaea8ca

SHA1
938fd8b7d465433da1803e030ab663d9da2c5823

SHA256
8b05f82b4715bbc96a71050ce034b0260a88679ca057284b806cb21498a00847

SHA512
02e522d3dab7a1e6fa8e68857671554d582b436e279e829cace68e7b48b07972180dd75197bf92d381c8e891ce42bf501da6bba012f81fa5602370be36a8937d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0ab3dcd160b73148f02852efec4b08

SHA1
d107a0ebc6a85c3ef5080cdce63b38e89db7ca02

SHA256
500572a1516bf192a426dc3e0b54e82603ccec119d920569769cb926b3b8732a

SHA512
e074cc8004589724d9a53df1ac75f542a4bc1d81bce0cfae1a75c31484f387cd6eec5086a302612815dc36192d6e97eaa3e40adc88e19a12ae8cb2a6a2a99a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23e2aa357a856c7133398f987c17afe7

SHA1
85a7097571308f340eded22b717ef7afa7e4e388

SHA256
53538c0d50a82bb6ee68c16f07d587cd153d3fb8f9803d9300c6a1409b14c5a1

SHA512
614d05c5ba46da4c013ecde82760d0fad720dffb92e9fd351764bf0dc743a260e4f1ae7f4479f32b8eaf24c2f1225c9040438c1524585bdbf5089bcc0437c8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e24d0426a1b89e53829bbf42e4e0646

SHA1
2959ba5f7c0f9085ea0f9dfd1c4a5ede4d4768c9

SHA256
b37720b33c18fdb8ff60565c9a3924a9da5edeb5042a2ccc0a12f0bfe6cf95b9

SHA512
2dabb8dd6e5a8eb6cadeb318e8ba7367276c71c314831c33e5d59d9332c741af6c49199d7606e7211dd8bfa3f1ad2ac8c9236b39bf74882d0d290d2a535d6106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4cf14c13b7b7ed1f37a834f04a2caeb

SHA1
d1482e562298fa75779c2c1fe4b7c2f087e938cb

SHA256
a354b632f42f76b76ec9e18b71ccbb8f5f55be5407d3f6a6734c086eb55beb2b

SHA512
6c192a57c0fb158d05c3f51a95641a02ea5ab46669f5384c8e3c5c24bb5e309a5e4b99920be138a6a2f384d443898e346d5c493e30f95da66c84009f3ab04b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5cd17c71934cd384ebebde9146dde75

SHA1
b0ea025853adbc0fcd7afc4277c52ca38877f4fc

SHA256
6f07ea6ed783e2eed521ad7446642d74c54b0a39d94a8495856d7091f70e7708

SHA512
d282fdd2044972049f072409cc6fd7f6da35156377032815363fc31918a1ba1e2cbe5b7bd2f7f8bf2aba0733e750d9dab27c7fcd4b02de63a063450aa1b876e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1595cfac6b8f40585afbbef60fa11184

SHA1
451b3bab1d60f26fe588d4e325c828025547472e

SHA256
89629f49b7923b2b5e2c666cbcb5e310715e419dd60971057397cc7d17224486

SHA512
6e2eda5b917312ca12ff27955aa7c304fe891f9df870bbd8715955fb2b68fde22bc7f6112efbf1894f86dc4b5aeb36c8d0201968180be6dad3185910eef4fa0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7146cc0744ee63deeac5ff521fafb5

SHA1
424b405beda69fbbd248a78ce136b7b3e48d1c69

SHA256
0ea05bfac1b631bb352e3d7bde7f7e9095e9f1718c80602256a14ea811fa2525

SHA512
bcbd2ead342822170ba2552bc2b265d77130cd40e3a7258ab3fa015770f9009a45713d1c7fe7bded6650798112832e4d197289876cda5865ab864ac109459fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55804927fe88f849c969b05877062b82

SHA1
4a94ab51fe3a01290464e3560991cd27063c9b75

SHA256
660eb8f9050df1088a23555e57d94547f6cb5c4036d18b4ac0890eb816898eaa

SHA512
e8984c2ea5b6980a1b9a8e33afba097e4e546999a1e24f64c4b014022abb7bd0f8b4d5ae2ea1a7beb27d6a6ed9dfc3a74139a49efbd64f9c84a64e41077fb5b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8c8020c8f25b1ae68e84b70d781d26b9

SHA1
a155810a8baf0c892c7c9cda67ce65d943a62084

SHA256
cf976dc8fbc42b65e03c0fe12735f34bf507a7a029af2df0f6a8cd52233bebec

SHA512
7dc2625d1b570aa1b4ab1a19590bacdfa03043f296d77e96905f10aca5b6067c47b2616b8a902d53b9165f17be9b0a88864c77f719829968e835b3a0cf73a87a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
45fc1786e4750894f08b79bc49949718

SHA1
ee253720233275bd4f299e36396d57bb5b7fbfb1

SHA256
a8203eac2a71b1369347362f86d140d4748fc418f17a5f4886fe3293b3bc4d8d

SHA512
4bf65eeef6277288c324be9dd72be6b22aa4bc4f13e7112d3894b788b116e01039b54b9afc5cfbb80f60928b4d9c849fb5d08351b5eec104c24e6434b07b03db

Download Submit