834c4b46e8a5d23772d2ef3f59cf00ba515232ff5f29ca1a7155dd78080aeac3

Analysis

max time kernel
0s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

api/index.htm
Size

69B
MD5

b48f668d29cf52a6db9a95f56b3fb67e
SHA1

70d9a5412e54da30dc44868e21e1c00cabf04a15
SHA256

544503741cd48b65bf728ac517f8ed5b40961a7d8d359127b2d2fc24169cfb4d
SHA512

e30f600598f12bf6608a284eec1153720d1f8cc5e722a85928d02d2c3d53c533a1cebbda558066d4965b50d6c57ab06959b5003b622469c99db1d471a65b895b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB4AC591-A7B7-11EE-8459-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3056	2924	iexplore.exe	17
PID 2924 wrote to memory of 3056	2924	iexplore.exe	17
PID 2924 wrote to memory of 3056	2924	iexplore.exe	17
PID 2924 wrote to memory of 3056	2924	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\api\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c73449006108c46df5e8446c8c65160b

SHA1
df511dcf372e365cb481f3cb5cc3020c6b61372b

SHA256
4d0a5d6823f838f2be1918d99d071c56d7a26d23f76f67061e8db459489e634e

SHA512
9d5ec81873278d8bac0808d7e621304fe0d135cc9602a10df0d82a4a2c0610dc6bd01e8de67c3c55634a9dfb16e1679c4637e08cb402cd24d0026e264b629026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8254ff985d1ddd829d34058be770dbfa

SHA1
65119858beb7ec867fb68ccddbcf901c745b778f

SHA256
ba76590db565d16d7aa0c6c3ae86fbfe66e317ff2a78c9a98772a06d93628912

SHA512
a80b47219ee1f54bb74c62146d1b2f83e17934bcb000bf7036b6a6e64853ce96316ef21d014e7f51c6b2ba4fa3c6c8719b4bd04683ab8a3fd9eac4da81d5cc41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
890faa17b5d230cf0fa9cff67ea76298

SHA1
80322ab352bb99a697596abd337ce6c78ceb2c48

SHA256
2e644a7b66bfd3db598e0709de221d6bab24b8095217ccaf85c364988b842015

SHA512
5d3a8a66c74e705d138f12d5a719b355fef7596756599d2f05eb9febb7caee59d2ef7d3415d2e164b446e5b7df755f53512073829d7655f29ef5d35d68101f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0cb975235ec2a28f0932d478022307a8

SHA1
91595fe063a8b5cd433ab1a6562a763d9a225066

SHA256
396fc31670ce14ffc8474a7e75fb53cf03d47992fc9433238bb5a6b0713d3147

SHA512
91ea5f0e6d47965aa93f00a19f92dad59a134493a0517eb13992bc60bd11f0b28268bf4626ccf07d95ce63c3def5525004c4c4a08b2c2f4641f894476c9f3eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n7bgnbu\imagestore.dat

Filesize
1KB

MD5
04fa6ff84102d22919c13411b3ca37a3

SHA1
3991f0ea2091899e309ddae672621129d8579594

SHA256
2b1798961770bac544ab10254e240ef5f48ae456f30aaaf5c49aa1d44cab2269

SHA512
0c2bfec9d16fd3ef8fd3654d4d48207eb407f63d41337541bb5d1aed40ece5afc31500ef532daba122351cc029721a4e2bbd68a828f6c0afdc2c1dde726a773c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RI6IG15T\favicon[1].ico

Filesize
1KB

MD5
36023f9095bd20cc587ecf0d363d0375

SHA1
717c014504d8f771327734531e672172da35efd9

SHA256
893d5fcb463fc085f6b8f5a7d22fe35dc5de0418e35be89235b24bb832494a2b

SHA512
d3f8db3f417861a52feb0dcb1701e79ae81134f54b8f9ac90a848868dc37f31d81c27be431e1547e594903541212372d8cc900f59241f74b745e7f8e9f90af91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F96.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit