5a279d1efd30365b9c14f48ce8b4fe3a0f16cae27ffe89359026bfbc6b311935

Analysis

max time kernel
65s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b622857946f2e499605f6bd5b76b85f.html
Size

73KB
MD5

0b622857946f2e499605f6bd5b76b85f
SHA1

40e98aaa1597405d6d3c8ab3c6c7e6f55e9d54a1
SHA256

5a279d1efd30365b9c14f48ce8b4fe3a0f16cae27ffe89359026bfbc6b311935
SHA512

2f45f443834269c9bca2cc613d22d0e1422909146ca1d3c7abc51b457086d174c0e3f837759184f00f8477f16a827bbe4d61a77b458126113dbeba30dd39dfde
SSDEEP

1536:EAPY8b8VSeO3vNfK3akoaS6cgRrZkhAGP5Cl:xeO3vk3akRnkhAGP5Cl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5194BD71-A72C-11EE-9098-6E1D43634CD3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2932	3060	iexplore.exe	28
PID 3060 wrote to memory of 2932	3060	iexplore.exe	28
PID 3060 wrote to memory of 2932	3060	iexplore.exe	28
PID 3060 wrote to memory of 2932	3060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b622857946f2e499605f6bd5b76b85f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e7cc9c7a509a2c2568d1ee31dc12244b

SHA1
2f5c166ab5b33578f86fe1699cd60b09f3a0b167

SHA256
a518e8c772747f47bfcf891e5c8c84f7ae415f427ff685babfa2db5cff047c0a

SHA512
198155f580b35833b857ad990439c5734677ba76c6337f7317b287e7ad6ca6261007405abfe98b7308c37e821fb2bbbd3daec8f544d2c61cf88c72f9b29210ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e14078b1ac58a0fb28d7e582fdf9972

SHA1
0e45e00f320a13b5508ffa47909020c1522ecc6a

SHA256
427338856949c898de64385dc22dec17d561e86dc64ffeed087527a61ef83ca9

SHA512
631315c6cd4871b054786dfbad9416ad1ccb8194cb8964de57c44ad1a4ffe099267d0e2cc7edf3258cff67e06443db0afd722d50b60d8e0d29b3e5fe02c877a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
720058b816f3d0dfb42f09d24f77ddea

SHA1
80d037955729bcf4d67c7a8eecccf6c670c22bf2

SHA256
c95f256a69b07a1d12234191d03253b9e3a08c75fb622278fc9073ace8d518c1

SHA512
3cead4adbfc225f9dc40b1ad0f096c60e089c91a8a17a4f03b44aee5644c8f40eec8dd0b23e239efcd1bffa05dd53334018b992b90279a1b5d1dfa12de203e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62313c61033ca06f4ca3a0ee5c0f90b6

SHA1
8e32a28b0a2bdd486139103d67c519905f86cdd5

SHA256
2fb9416603a3348e3f9ebc30f7dd19b8b10c39d9339c7d7fe04cb53647ebdb0b

SHA512
9924c96995c943caf9d15f69c593c76018420e5c791d100f0e5de016549e08d19d7d97d7e0c02ac7259965d970ca2488c5a1e151664821955bd0f1913fcb8006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b193e9af746ea972ecae86ee78aced9a

SHA1
2f2c4e441890a816bdd22a2b08a2f0bc6f35502a

SHA256
7a3162a6c54a803d37db12e4155b4a58a77dc050ee1c9e734d3a0a81fddf46a4

SHA512
1c8e9a13fe0e15ad3fe638b7b6a1f2ed49b6a527933a29ace9c413fc040d0d5a8f507abd82e5164934f8076c4ea2a9b37efea2441503abbc9dbd684cb08bfd91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5aaedf29aae604dd48296bce72c0ce6

SHA1
d3797ecb821f31fcfc5100d4856eceb264e46653

SHA256
2e062db4631bd6ebe659a93191a4fbdd082ae968b1ee145e0d3019f288fe69ee

SHA512
225289d81a0ed5233dab6bb9cfc6e91020595175ce708a3ef08e81840aaf4654dc6ab66082dd61441b17b73d3bb1cdde6f258ebdd114a470ecee6f444bfecfdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0875915f04b28152d18dcc360132b72

SHA1
780d1bb29584eb9da776ececff3e53702088802c

SHA256
4aecad7fae551db6386b75e2b303ed3dffdc4784f0ec4097c6e2ccc462325717

SHA512
6f949a05344aa960ce0a8b0e604dfb28bc6c59d98c23a92c7e865f858b2bc4f5baff2dbbc0d73c552c45290df2cca89617630bdd16208d850b7b3cfed04bf353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d21efb40f86ba3295b5f8996d2603ddb

SHA1
9f56ab598b065286460ac2c58de59ece612524c8

SHA256
4b688ae46f83b1fb1322f84d7df5cba90142060b851456391ce20d8c94b63476

SHA512
86b691ef1f901a71f47ccbc187d7b844be2893b703d4a8bebe17ca62dacdb1a0c29a863ea95f9b217f02542d88427344ee4b522abeedbd8041bbda400abee39c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
230bb20a1a83e687fb9cb5aefb156edd

SHA1
1cd4d6852c1eb2aa76d2c5da0f32d29fac47f0ec

SHA256
5ab543ee389eeaa01a9285840439fbf09cd6b4ee984022ebed4b6feda34d6957

SHA512
1bc4dc760ddeb53055f5295cbc5cf4182a037d73de742d826543c30c5977777f9e7949490c64363ab71a4f9c3a11ac822a3d36aed06cc64ed86829bda35f5a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c09977459b7f2d92edae31ad2770a686

SHA1
b777446a4ced671878507398d7432b37ceea5af1

SHA256
a7f8e3353492d5cb29f3d21eb70bdf5d8dc7d1ea84898b4db4a935089c02aebf

SHA512
5e0923a6c90f4de6e31343651a74fef703f5df7c04d09f7e38c03bbc3167dbe9b7718423067433af65457d905434b0a9de672c3759d1409897157177424f6247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8324ea6ad674d5daffe24121d328bed3

SHA1
177e3c92dddeb38fa3d16cad8f1138fb3a181a7c

SHA256
ad59bc3378036bcd2571ffff426f6ce239a52b59b461735b8a45fad6aa55c776

SHA512
54559fea094ab4289ba381a424df681fdf47d0de2567aa0a3aa0a428efede88a6266690c37a58ab3bd8d031f3a9e31043e939e1b7d1d200d129066ca45f0c9ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e35a5a6b4ae32d0b557441db4fa09397

SHA1
abf2312c120b2006d04378ea47a606bd255c7484

SHA256
baf55c5a24ba7a76177a9d3bdba78f204ae2253d000a80c7be9c6952a817684f

SHA512
6f786390acea8013cb4d54d18ee5ceb28e9c3abbb1c3797872fa49b8c87c14f6bed1ecc88ddea57638118fc0839f63ebac84b10216e8b1c89e6a43e9aab43b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar177C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit