cfdd0c949c9322b2bcb8a9f97de453153dd785f799692a7b97ea698362720038

Analysis

max time kernel
1s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a848a53199d093d943f7c85ef689f2c.html
Size

12KB
MD5

0a848a53199d093d943f7c85ef689f2c
SHA1

12a220358714c9fa1d6e528bbec781fdb7ac4de7
SHA256

cfdd0c949c9322b2bcb8a9f97de453153dd785f799692a7b97ea698362720038
SHA512

49d43468af827754bb7e72df182009644418b3dddecc6c40c0252e581fcd4e43ce033f435a93a3ec171a6fe57391d0dd02a8dc35c073ba43e61c2e8dca6239ad
SSDEEP

384:HRO9RrSWBld6rTyv6Rb+nQKrlibQmYMH/pMF1E:xODSogyvCAdhi8yfpe1E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C52D531-A79E-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1140	iexplore.exe
1140	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2452	1140	iexplore.exe	17
PID 1140 wrote to memory of 2452	1140	iexplore.exe	17
PID 1140 wrote to memory of 2452	1140	iexplore.exe	17
PID 1140 wrote to memory of 2452	1140	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a848a53199d093d943f7c85ef689f2c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:2
  2⤵
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dc952f8afdc26c9ee636bcb34380e6c

SHA1
ce9ffdb6a27476d089a2457449fcfacb25861c5a

SHA256
b1c7e79ac6028cd5ab3e1694e498e70b558c9957918a5874168a0625e6e2b086

SHA512
66e9c0d4587484e889d14d01369a560ef642f83dff95b31acfc8552a2dfeb449a98b58ef632f7c4452afe8ab7d3ba05f36eed7eb397615eaa91558060e118e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4025f68192a3ea179ff827afe2ac7d

SHA1
334477428d5792ac015e51393f078f03636958de

SHA256
e7baa9ed362702f85989ddc136e07efb77fd395bab86083e9b33d8f45eb3260f

SHA512
1be66cff6e7e330ef0576bfbd8ab5c2da433fac72a535fb393ba177e99e4b8920bb92cb38e86c8f1ccc7532b687250eb5dea2b7f6616c64ee9d5d2569e8cf570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f148a77d2ec477b0d9ed4259ef740a18

SHA1
50e0fd9723053531f3bb6bd5fec7571c2fa051e4

SHA256
d9e44aedabb59c20a35addf78b33da9058dd795669061e4d06249972f5d0d506

SHA512
53576682101739b99536d347161872399e71d60ca52c9dba10c17903967fc2e919d26ccbf3e864778eb66f578ade7273e6b6f2501241ef72b2e015a2085a500d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890d7be213ec1e5ff751b59216c9e8d9

SHA1
98b46f2a1272253bf9389b04736f2e83da842b73

SHA256
ad9fa5e00a97310581aabdc104cf07ae9a1d3145c670db38fd5b1d653b0b1c91

SHA512
e9dc0402e2d1c4f9319794e845c2e945c0ea9d15299f53288391bb0b988b4686496070ce8920ea2776976ea0c310ed94759d7b6b5e675f0f9b462ff746c52a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85a2f1949289a30ebf70bbc6d9cd9c86

SHA1
e0c69c4c7f375a9a5e20f45cf4c645d3fabf39f4

SHA256
09a1041d3508cd1bc40c44eea917acfc08cbd4650f61ba7ab866c0b66e4b95d9

SHA512
3802a430fc408167bc587793af8ad45b2ac2256390554b3f4bea6046a3d3435126952595e0c3a576fb7806187d1ac1debe8f240b712ec205ac54dbd8b6b072f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
316a04d6f116ebf3b866648777c78b5e

SHA1
ba50c544360aa259592520f85af6cbbab61c2a60

SHA256
4800b04a76e004f2ee3ea78341e5f57de1547b1a14ea09af2288c79d002b648c

SHA512
acf3b26fb328f1acc0418bad2e1d982f2965c1625285297bca1c66603c32d4fcd8fd2d37eb39073bb917996beaf776a491c11a65d788f20a08ed8b76f8b6b71d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1493a0c90359e8732de7cf332f5e0f7

SHA1
181c97438693688db4119f0ff0d352c5551c2bbd

SHA256
93bc19b47421cfbc00a208a149d99ef102855975c05d460efafc7bbfb8d71cc3

SHA512
3f81e1100a34600a61e9143b16ae51c703c54987c73d4aa4f4163b95b85dd1d2a4dd23340df8f6ee336cc5414db39e760e1cdcf402a6ae65c110974cb1ffed9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
296cc71ccde40d59d0f8e9b6aacda7d7

SHA1
d1c672924fbd873ae45f1911560aa8dad3ecdabb

SHA256
091776e026a05dcf91a5c2fe74e321ca70575f06d3580e30f6a3c7f3fb0f18ac

SHA512
128a29d0ab51f2da60695da1dc1ec8d6a5478c494434cf2d577a85679e72f92ad0ccc6e859540e207fefda4dc6ab6270df1bb00b0f1c5c45c7caed0d7b04fbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91572844b3d148af761fddf204827b2b

SHA1
db013545fb9ee09ab23165c8e8ae3fc608b3e242

SHA256
5fa88ea9305e514434cbdb8ead635cde8977437550d74aea4727c710d6caf5da

SHA512
fafa90c967214f4d88479fa7629e49418c4ca348503a129fe66e5dcf688658fe8d1d33378d2c48887960fc8c1dadfb80d1d0a6ba6dca52f5f09544274f67957e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d683ad536c2ea8d6b9293db737f1c2a9

SHA1
577f6e8a6a04482db63709f29704c03e02c1f76d

SHA256
797140b0daccc74ec27ca6af7386359ee74a1135604cc8f4f668f1a21f677ac4

SHA512
a008eb8354404b76d5caee9c841a06f65899d3466533a97e908e8ef2444ba4cd3275796cb5e09e4e7f0958126e7e32da41c33292a6c094fbccce6f0790c0a5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0825a61b4095b6ea65dc38403e33fb8a

SHA1
335f0b739e3d3c021521173e28b347858d4c5b70

SHA256
31bcc851aba394684885a075ed3427bf203488d23ae1ba9b12cd7f735de17f3a

SHA512
680e2970c04ccc48b9fbaeb15e2a72b2cd0c0c9a5638605ac5d76b9dd9ded3340325a26f28278d2ee2cdf960add5a55acfc7542408b4a8bc3f602ac12f88abbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4F3.tmp

Filesize
44KB

MD5
d87027b5cdc38437cc790c94263bd9eb

SHA1
250c6b71c3c0f24e6c60844e27a0c809a6c95e3e

SHA256
75c50c0e2898256d38562c697d4c485a5d12de2134689f4927e64db20dc30e85

SHA512
98fd0c02e0c895a8bcb3f81182445e52647c9719bd1927cfb1b99db614513b3eeedcf7bf731b0236664dc0f38899201833cded07763c4ae60bc8addafea5d159

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC29.tmp

Filesize
14KB

MD5
069701c98552b5f6ceb97b607082ddbc

SHA1
a0ce4930567eccfba2320515e6e06b2d77b7f594

SHA256
f249109ca1a4c698b144eb44e80c493c15a5cd1321aa1249b7f54f3d5ce7ab32

SHA512
ff0fa3cb68ec5c7893bf0a53d312fc2224d34179923235025977e80dbf79a5d24e12b34b1ea4abe6e9abff75dea884060eadadde4facf8db310c158c7f3ac9d2

Download Submit