dc02a1b2669827c5345fdebb75ebaa682af325e63725b802062bf145c54a8f0d

Analysis

max time kernel
0s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd507ba1a631e78a3162ca0acd432bf1.html
Size

53KB
MD5

fd507ba1a631e78a3162ca0acd432bf1
SHA1

ee74dcb69636e18a32544e21f98d45d369b2ea9d
SHA256

dc02a1b2669827c5345fdebb75ebaa682af325e63725b802062bf145c54a8f0d
SHA512

eb50eaee005a5725ceefc94185d018f35ed1b5e7de72d0285dfcd9edf8661d5533956fb2ca6ea6a859ca6e6178f180c96952f9b7be8381c190070b0ed66485c5
SSDEEP

1536:CkgUiIakTqGivi+PyUorunlYu63Nj+q5VyvR0w2AzTICbbror/t9M/dNwIUEDmDA:CkgUiIakTqGivi+PyUorunlYu63Nj+qm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{537B39E1-AF3B-11EE-9569-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2668	1740	iexplore.exe	16
PID 1740 wrote to memory of 2668	1740	iexplore.exe	16
PID 1740 wrote to memory of 2668	1740	iexplore.exe	16
PID 1740 wrote to memory of 2668	1740	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd507ba1a631e78a3162ca0acd432bf1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afc759bb7f1aedbff2000fabf7799642

SHA1
476e785b3c98673485a58fd5042e9db32c4dbc9b

SHA256
3b7e51686954e6c2b0b5fff2427d2744def5fcadf63b697afffd18c2d69fadfc

SHA512
90d1239b6cd3a5cd6cb73b5c0e817c3bf7138d38b07717afdbdbc0c42df17b37a4fe8299ed5119750db9523bb041225e1ef6511b2fdd20bb7447d7030a3a089f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6473d27c585647194a6ff95be4e137c

SHA1
456fbc28561b4f109723994085db0426fe805adc

SHA256
a5b829253742b6843fb227e8f62d817426f244592bcea10e2a073053489b0e43

SHA512
5c6b1547cd549be0d00a9e1230f5f968ad17b1868b0b69cbf6748c3401bc93034858a4953d25629eb8b6dc1f4ee883b1b02c949e2f9347555647ec3889bcc740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fdeb2ee2c8d4afb4cc7d81c769960bb

SHA1
98060bbb4e1b0ef47fe53a10ddaadab750c3b72c

SHA256
7994a1f0a433942582093a8a8764d1c2adaa5b18194b2eb9312c9d7f8e5bb75e

SHA512
fe8bdb88fb35bcbdbe605152afe06f61bf7e28b682136bab2a5d0d13651fc655ec586b640424424692bfc6b43c733b90e1135c42ed4218b229972e20fd043d18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f955d2b32f9f331e9005e8a28bcb13e

SHA1
a51027d83b8d51bf0f0d4ac1af64959ceb954c7b

SHA256
7f28959553d64380398d231c1eb702d5c95f3b567aa7ac6d2ad00462c9b57e18

SHA512
19bd0df6efabb8c2238120d1a3dcbccb8656c844d70819f33a3a6a3505c96b6e18dd2a9ab981b149d7297219ac980383ed5197255d33ee55d6f899de18c260b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fba99643a54b8e542e034b7d2f9b75e

SHA1
74dad4bbb240b9f83d38b4c051dfc4249744e6ec

SHA256
af9614074c54f71aee57f1a130b092bdf685a1773f4eaa90323e428d3c606846

SHA512
5b78509d6d9d11fd8f7e182acf04fd82cbacea0ff25f2b8992d23ac42a6fdb96c1220b09b1d6c4946f916ef7dd0492fb16590611a111b7f664780024310da699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ed06ec8683ea0ffeb23b8f9c0973c0b

SHA1
9336c866f85a3ec86b3137b1750f53b17376348d

SHA256
c424eefa79cf8fb7467650dd05074f27733e792de629f8db5b1a6c3fca686b93

SHA512
6f6f8f18b1148be1c30e17e72d08ccdd0eaa41fa22166e6296ce5a48943b8ebaa2d726efaffd56df58ecc8d102a4bd2938f4cdf88c9dac4f48decb2872c91d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e06d940865b06b2d92bdd95afd832f8

SHA1
fee75fc032a47b21c2de16cff2c001797edc36d2

SHA256
615ac689d6c4fed76452ca6419c70ae44933d33ffe749adc622a2f9888502670

SHA512
3556cff0db13146c2a05761f3fe202b6eec84c84710621669832037833bbb6d8d2bd45c8a76d78a013501ff37ee02cef854ac38f0b5d3703ee3dd90b8260f773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab659.tmp

Filesize
37KB

MD5
6c4b9941a060f9964d0155a2be6f28f7

SHA1
45453b154a54074c77bfd1076cfcc16744c49a8d

SHA256
101b098ba646f395a8e70b9bf68109442936e263063ec0b967ff0201bacb5e7d

SHA512
504e8db4d6d74dbf9c9a3ed336c43c7c654b12bdfb12a64b981dea8e7b920a60a9a50619140d999b2db83c496d171430cb323d40a6ef4292eedff5b2bd4a85f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar850.tmp

Filesize
1KB

MD5
fa527dcd6b5eb05e72fc51570a2a6608

SHA1
3380c5ef74408265fba2f67e790636d0ad0a51cc

SHA256
4dc7a4a6cb3be2c334a27a49df89f18f8f91749fe6aa1cf28d548e0e0c75ce3d

SHA512
05c0e217c433949cab210102a26ca7f6a765515b228b217e25c7409408fc167b5a59a8494e1181284e9ec72849c90288f3a066faa284e29d871097ec76291a5a

Download Submit