e5be81ca8a2f189c876e72b123245973ee2388e23e694287ebd866c7ba16f6de

Analysis

max time kernel
0s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7e7ee412668ecb4404b2042c2eb1d2a6.html
Size

15KB
MD5

7e7ee412668ecb4404b2042c2eb1d2a6
SHA1

9180b7229333becd8a2dc58faae542ac33d1b7e0
SHA256

e5be81ca8a2f189c876e72b123245973ee2388e23e694287ebd866c7ba16f6de
SHA512

d26e68ef7eee41e470b75865f9d8d981b47069bd0efd53818a38b5af5b0ac72389c01558876df3b0e8a81588e1e6a07e80657ca9711200dfb5d84dd29356a6cc
SSDEEP

384:ln8uqnGDnW0qgvWk/3eNIjNvlszvt/oSxiX63IJvVnhyeXzkXU3IWyJbTW6NZirk:ln8vGDnjUbdxu3AbzEel859Df6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E2F1BE1-A546-11EE-88E7-76B33C18F4CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2312	1732	iexplore.exe	14
PID 1732 wrote to memory of 2312	1732	iexplore.exe	14
PID 1732 wrote to memory of 2312	1732	iexplore.exe	14
PID 1732 wrote to memory of 2312	1732	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
1⤵
PID:2312

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e7ee412668ecb4404b2042c2eb1d2a6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e38955e96017e2f09ea60453974defaf

SHA1
651635fba2ee07fc9cf17754837c3ac5d7a327ac

SHA256
83ef59f40f73a80d6981a606d4f0cecefc2a47d7dccaf44b4558a5d968d0417f

SHA512
b5804d77f23cdffa8312bb1a965af2126dad784c9e2d380f01905f590480c36f9dbd4628a9b5cdb695612a1d62472e281f639e55c689cad9984f67a8438aef0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7936db5b28934c09741548182c1141e1

SHA1
556f8ead587f749bf068836dd084bb343472d957

SHA256
98879c1fb907b481fa916013031517a88716211a82ca17781cd480503a87498f

SHA512
d936fb65d77ecea3af4d3f1daf83425a6cdb4f759643e4484f8436ce25c07dcbda9b1c84fb9539d8d10e20093b972284660161599468b9af3a7cc02af1ccfac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b3d0bf690cd15060875bdc2bb794caa

SHA1
cc2102bb59ce1b8068858e6836b487688dadb848

SHA256
15cf2f4100c934ccecd6096aef1c6a29e17e314f4f435fa542cec4b81d03500a

SHA512
2f95376398b14fd678746de5c1056bfd020a091342839c6e6c81197a29521b22869bd5bbc4c42490f61e4f1da2fa7dcfbbae1994786d32113bb7357c0abc4b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5298bd7ae948de2da964778c19ca8548

SHA1
3ac295aacba6db6701763242de2712611c21f114

SHA256
d44403a018a8ebf6b41720aa8022df8c4b8e5d25b880f74176368cbe63555892

SHA512
f487f34861c919fb1ae740fbe2877b4cda2073fe1dfa8965cc00ca72209e5748de65d0f8b78c30978c8f825ca950e0f03d91ed9afc3a0a97984cfdb6a38e3b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c974a8d9cfcc8a6ac71f4c7781f19b4

SHA1
b4cf181be6e48e31d109717bce00652b797e08e3

SHA256
3f2e8aab83f2639b0e0d1ff5ea0f93a0078b44ac59601a84e926e72ae5c04b18

SHA512
d9168780cc1f5a4f6da39e9c0b28715bdbb5f85e0d9f385b55d7abd87999ca2820beb2a702da02b805ed9c86ed737e0cb224cc3280df9d36f5f041e1b6c0a469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a12979490325654bff36c2ee1cc7aba0

SHA1
ceec678fb5cb2c07d0d20fe606df83229002f25a

SHA256
b3a77ff06fb5e0a534751213ba6d6b515479120a513c9276f92fc0ef31a214c9

SHA512
28c96260bda5a8728dcecbbf1b43ad9a074d9bc3c950f676a93ee2d5bcac324a88469ba5ce19bdf0da1d82cad57843cf7836b04d15c1a0788d2b14a736f250b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b5f13132e59b5690365f121a974f762

SHA1
f53b00071381445e951e25bba634977828310e60

SHA256
3417d23b06ed74bb89b2c6131dd31d46f4b5fa6c2ece035034e1a4137b4e9e17

SHA512
93cc48d3bb4a60d3fd8f84da41004e095dd4621530479a91ab81483d01e215508a7e8ff01a0d5ee6e345e7fe2056e088dece8610a9c9789a2f2fc128028699bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2a0dc04b4209c97cf1ca94e413e3f8

SHA1
2220d98f7912b179232138bbada141bc5b264358

SHA256
e435e41e15ac1208c240dcd666cf709d54c99340726f9d3e27dc8a6f7203ecc7

SHA512
c8f7565882c1a04a54b91d02352e8256337785be765afb9aa451275d60389835580b5c24beb1b7a3fe1765827934599905104003ca4201f00035799db591d1e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47dd66d0349d8116ea8e78032675cff5

SHA1
5869f7b60bb865258b14068469277547411c79f6

SHA256
3139f03a287f28a7dd242a999035af0da7e7fec8ad2359c108202561d53ec864

SHA512
269eae1761372ca171cf8a60a4964c7c7372de997263a3af40fd6ad951bfc9789f237384321b489cf673f3a87a413db85d2235712ca28c70db85ace443924de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49B2.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit