1bc543a95a83e3d587a131962689e006098af9531f10c9dfdef835c93e29a746

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d5ab4785fcec8031c673ddd0a1691a9.html
Size

430B
MD5

7d5ab4785fcec8031c673ddd0a1691a9
SHA1

305d296693d6d3fe585139d778e6e9d988f24e8b
SHA256

1bc543a95a83e3d587a131962689e006098af9531f10c9dfdef835c93e29a746
SHA512

4cddb2378a2a73c6a00f7cc65dc45665c12686db2f0ad61c3865226a343b85abe78ef69ab13a6e74b05c8a697c93805eb079aa0655998aa8add3572e5c889a76

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8F75DE1-ACD4-11EE-A2F4-62ABD1C114F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2828	2220	iexplore.exe	17
PID 2220 wrote to memory of 2828	2220	iexplore.exe	17
PID 2220 wrote to memory of 2828	2220	iexplore.exe	17
PID 2220 wrote to memory of 2828	2220	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d5ab4785fcec8031c673ddd0a1691a9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae232c77d5d3c092f1c0d42557dcd60a

SHA1
9105aebae545faf5d88a58e7ac5f97f9b0aa0781

SHA256
70131d5c0fb63e097b4c85c8e7244b5c703cd4098fd92c49751f23a2168bcd9c

SHA512
51fd49c22031a86fbb56cd7a772e2fb6da03b5fde50ce998aa1545123699ebc8e9ef28b47d59671b71b5d737b4efdf92a17ce5ea76dc947024cb83431a1ff15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c860d8e93983eb65eead1e622a9809a

SHA1
6120af63d183a565d4c0318d48c24ee1a781fdc8

SHA256
9f3783df235581275378e88749e9e483b2f014947f050b8597042788fd019da4

SHA512
d897decdc7d9f267967bdbfe62cc26de152e406b033e2259e879a3e53ae7bdbe5a680c3d774d737aa4e7fd0f9c28ba32b6caf1583163f8c7a38636c8cb0b3850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e844d7fa89bf9a1b92eaef76d00b2be

SHA1
988b7977032c940dad2701dc7f319ccf7c63a466

SHA256
2ad0d5dc66b14757f06965c54cda514d8683107a568b92184af2d1cf2128c254

SHA512
e3c687b65233fc1ffc53bc14727f9f4eb39e594dd3424411377606038d8c02291d6e72cb97a1b5d23c6663ba40992664c5658a00ec36d0c463466128a5a988fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f5c15368cbb17b30b22f326951ebb57

SHA1
a30b4968ce8b80c77efe8179096741a5a937d748

SHA256
4d228b6e9dfe93d7dead64ad13214f83d21446006aa83e8c9873b7c6b66fdda5

SHA512
21573db686ccd3ee6fbfbf92d5a47e3ba1096d36c0c334cfaa3b82e180e5635705fb3aa840556f95b4c24e92dc351e7d73b4fdecc12fca2b59ac96950bdb6466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ea433d652d64cefdae449726d326fcd

SHA1
27be220139275040649532bf2f4dba37fe1ef7a5

SHA256
f2170a17c25198d8fcf0d051500f168534094706634a982e1a697265b270a162

SHA512
8b9b8d761f001945f16523b07a90ee1e87e154d0925390520047096e14e110d46752e0ebe5d695ab17e911d849a39e6ec1c6c1b5f4313236caccc530c82a09c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05bf3c0a31faf640700de7ecd9d8f661

SHA1
0b160a906fac90d3f0ef62c9c13595c0a4925759

SHA256
da7469f8ad8d11d1720520db76b32534361f490c4d70b3385aef98dbdb23d4d8

SHA512
19d3eaec2e7edefe8d768a20f8fc80ac40c0c3693fa071ce853b3331e1317cdd27eaf271109c023d0216cecc796a4e186d627e596d436d26a8ca72ed82e511eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n7bgnbu\imagestore.dat

Filesize
1KB

MD5
7931676f93d61e165956b7d6b9da8f61

SHA1
09c1754b6fd28d6b719489889d414bb89901efcf

SHA256
1e2b0fe760fde04d351cda12b6b027739d8abca8d461a342d8ecaedc91bab216

SHA512
f5a87787477eabb711077f7c8da7b349c0325ea1c8ca856057e3722233f1979e3c61d9a8f7f612ffabb4d7fcdb7484f4ba7d521a9900bbe85ccd07f20bee6d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\POMRMI3N\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit