8a399a32b323b73f65701d0857f0834fe6c5d7f19f20a146f1a010a30fdd5673

Analysis

max time kernel
122s
max time network
279s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fddc1eb7c224572249a822cde2224d4.html
Size

2KB
MD5

0fddc1eb7c224572249a822cde2224d4
SHA1

0d3854df9126296c8fba0f61a4e576364ddfb806
SHA256

8a399a32b323b73f65701d0857f0834fe6c5d7f19f20a146f1a010a30fdd5673
SHA512

1a85514fbe2cc5aa62fc36bb3e9d2511cace837730ce2c8b445532c2aff00152ea33dcf74db3b557f79e4fef475bfca3dbf01c895624bf6d7132ca1c46b43d2c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDA233B0-A775-11EE-9295-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2168	2848	iexplore.exe	28
PID 2848 wrote to memory of 2168	2848	iexplore.exe	28
PID 2848 wrote to memory of 2168	2848	iexplore.exe	28
PID 2848 wrote to memory of 2168	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fddc1eb7c224572249a822cde2224d4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9af17c96245b6a05375c1690a1908dd

SHA1
59c8da5db97631c3a8e48a231db05cd754adb01d

SHA256
d5a096e083a978b8bcf29a9f6fd8b5762a5b9b567f26f39e58a1d03f3c7a01ab

SHA512
d46f93e3ac14f86113a0cf048108da6ec803cfd0be7039b89ca1c20dbc865837c290b021bde1d60d2398f7bf7bccaae159fc65a248ae9419f38b30592fce3a96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ea3ce3934d9472c90d567fba10824f2

SHA1
dbb3e7a11701b213755d68758683272fccd0da4f

SHA256
03613337644e945fa6caea8a0b16b07a727799991fff25d989ecbdb6c11b5115

SHA512
776bfdf8debf836c2d57e17648f7b44d97a2a6fd593c60b37a5c85237e3591968954890a295954195114ceaa7363c8c36da635a8686a4fb3f6a4b512f1bb5796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeb3fb4c3f8877f25a600aa3dd0c3c1e

SHA1
86711138834d490746c920c84111abee99b6be53

SHA256
3bccdd0a05141a55f77f536d0564abde0593fab4bd81b56540f3f1c7fa73db62

SHA512
497d091236fee385999dfed477cebb0a166076667e08159e3f5f7216d4c5ad769782ea51aba7986c7b7edde473b7d92d216031f86157f6caacd3a0ee4f0c60ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf7a31a4fc322964a82bbdae593f1a8e

SHA1
4a10b418a4916a1d5a4351645d42840d30a7e878

SHA256
010f40c2708f9085c46f319d7d9d36ae1353345f68594438dc9799b72dc6497c

SHA512
dfcb263c1bfa5c3e3c7b16612f5203530b1a757c9768bc750b8ee4a89a113e17b1804819f11dad1464891b3ad289ede5c8d5277d608c1d1b297c55e85b74d0a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c39fed2ffcbeff8744f6582918ec22cf

SHA1
23190ffc45d67ab740e67b0f75d383214a9f61ee

SHA256
b785294713dee4732b94c655ab86badf76073f22e1ac1b5b3285e796bd594c40

SHA512
c1b4ea6be60799c48b635257ccec59cabd7bdea5b47bc43dd3f25241e0a916ba918fca21b885198c83232c750f1853ce53bb2d58a6a1b1fd05ad594d150f12db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3386fa8094ca14e42a46ae6e6e46ccf2

SHA1
10a01d42da378e8aaac79f1b94ea98e311575c5e

SHA256
c86842997cf28b52ebd68898d15eef6180b35731b16a138751c72b663ffc17c6

SHA512
6684167908966ecd0bbe29629f2ec639b847fd64ab3a0b70674943d20ce4ec90dbf1f4d5bd986ae7377b6982057501e68e0da045dfba38cbb706905419c8ae18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0e232162d7058180381fa184e6a6b00

SHA1
40a731ebba53dabe17a572dac92212a9b0843150

SHA256
1a01632e7acbd35ddc465733ee27b2a568e9b02889e26d41b15599d9d437230f

SHA512
d5f963d4e570ca0fb6fd05c9e5a656599c1b59f55fc0a7dba73f97ee9c6997d20c5d6fbc7b0444c61e45289aab5553581829bcb812158cdc318429f4b37bb44e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e221ac953fe1065fec85f72f351fd55b

SHA1
a596b51335ea739d3183b189eff354c4d43c19e3

SHA256
9bd149507691984054c095326abf9c1de86da9a64d6dfe14b46dbabc4ce0bf27

SHA512
5635ef801b430bda22bc8ab2c6c70f1ebd3f15fd22a4554dfae552bf356e23fe17355b6a1378018e75f2e6bbcd2ce024dc195831928a92531ebf5acb289ce072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
198adc438dbdf740b5d9bf71a45fce56

SHA1
f3014200168e960780e43ad268387f9df0f78e2d

SHA256
339c5aaf849d4feae220fe0f5fbfe5d1657ffcbed31ab448dc8747a8ed30f8b0

SHA512
41455028f1cf3f8138652f4e757e59672387b5c5fac4062dc740826a8224a7b4f2437407d5ae8120780ec05b5f2d8b4d009d76ecfb3d6d084ea65765c68963ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2819743dde7dedd70fdd8578e6018d3

SHA1
0b4b8bae587bf8ffc9a3f593749bde65a7864d5d

SHA256
0834edf5304c0f3d1e797521b7597602697420c921068baca09984a6ae098055

SHA512
75fdfe0bef8265044fa34d07fa6966999d3b0fdff2f7d4706cb951b55539bb57ae870825e7e1d43861452907247fa7c775c6cbda5be9a1ea3ec296c15f474052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
794adc09414609bff6ed274493574f53

SHA1
ab3b3f50a7347bd384a0dbf411f296a35a518e34

SHA256
9c5d30dfef5df8105833f5d316bff25a4c571ab5b19538953030fbeb58e1f066

SHA512
f41c604a1abd636ab688d00c8da768a6eefb160067784bc5795d0c31e7434e9fef3222599ce469c1dda330ad87798bd1086c2f6f3afa61b817a11b088c82bec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96e996c73033d1ca57bc2253023a7f7b

SHA1
287d28cc3cda33b0746765ad4c5b83ad6706be06

SHA256
42bb15118e08fb08e07878a55bc7f357e8655f124f2088bb3c13d0d56a38f12d

SHA512
70d8cb2b6000e0ce023fff18614eb1c6036d4058b951b11611361b0c4c0491bbf69b280de09a94bc3942ddc2500b85e318d771854f72dfcdd9324e05fa6cd9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15a54a14b528b6caa7d64494e8a68034

SHA1
4595a362ff5d602e011b3da72c39b4ef94c3379f

SHA256
40dd7dc83e8118f2140e08c67c89be0bd70e278058f66fdddcb9943cd595ef06

SHA512
62f204d9272bc9eaeb7f686c1037a5f6eb85ddcca2a4f12078ad42fd5417fdb3160e970eec8bef6b3d2fa52b66228ea1e80591bae346629ddf138202cd0ca402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0473bbf218246af5b5f6bb689218add6

SHA1
a1576d7d35b42734d4e1074f6336f397a15b1d3f

SHA256
2b25a32039016cf6457bd9cd0d366548f1713b88e9a0951a572da89838a5bc00

SHA512
a4583497940197c1adc6096e8437e28be2e27e7546d0ca7d159fe69be741959aababda0bc2affeadb837a52ec707f52060f5ebef616c93106cd1f7a938b382b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a209531114b3b16335db24a1500b76de

SHA1
39581f1bd33485bbc9753da26051bcd53ebeb201

SHA256
39b9e7623a682837b8d03ab62228236bbc63a7d9827daa730f6d4663f7237627

SHA512
584bac4c4dbd2204a2a21178f48a7e5d04c513aa7f5fb2d67ee5b6f211a3444228eca37397833973f90b2fcddff49afc15ddcc58e22f60c88492493eced89d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41C.tmp

Filesize
45KB

MD5
cae17bc9c5d74e0e1142b20a7889efdb

SHA1
cfea5f7d29a7dad0a1a25daf18a0cd4cb79cac86

SHA256
4d74c7d252b593f92d04a5538ff5688a4ec720ab664ac723512fbcfa3f5ab691

SHA512
42ba66aa767f8a15ce38f9e72990fe41e4fb2d7266e4334be0bcb7db7ac7eb38e7f3b424bb4fc5583197257e9fefc11ab19285f0881a054f338463fefb483dfd

Download Submit