472fe8dc540db30662fa65925639b10dcb2c7c60ce9eb28a07dfd8d043689a51

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fff701d33d709c7f7386e2a393f35b3.html
Size

23KB
MD5

0fff701d33d709c7f7386e2a393f35b3
SHA1

05bf2b95806230d0a4590d42d635dbe5cfbc828a
SHA256

472fe8dc540db30662fa65925639b10dcb2c7c60ce9eb28a07dfd8d043689a51
SHA512

dcf2ddfd5c086f173adc84db39d3bb239a5fab677ba7e3429badc69f36a5eb4f6e98966705829b7c6c0c56def819c2fc55179647f63ee1dbafc849acf314bd71
SSDEEP

384:RnA4ywfH6p74WVztvukeKXXTuvwBVMGsh1KL24UTpNyOcn8tvG5nTDuU5esT8a:Z1xHutWkekMuaT1Kc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7753801-A777-11EE-B696-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2688	2444	iexplore.exe	16
PID 2444 wrote to memory of 2688	2444	iexplore.exe	16
PID 2444 wrote to memory of 2688	2444	iexplore.exe	16
PID 2444 wrote to memory of 2688	2444	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fff701d33d709c7f7386e2a393f35b3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25dc4ac40b34d921e6efbdf55d0955a0

SHA1
62d7d52326a0d09c6908be0169e846f235ca44a4

SHA256
e838948c6d078f1298b2b1dcee84c60c756dbfd4c5ed231b51f01c372d1c6879

SHA512
83a5d699afa6d8a64981c283bf8d8ecbe134195bf38f7d319ad6c292676220f4de1d866de502cdf045e3ca2cffa4ae2f678db72d30aee298b9b7895fba789715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
530e74cd02831b8dc3c900d30df6546d

SHA1
2bb1fe1f64b23323211030ac62d625af10e93b4c

SHA256
2a0b7b68cb87d10f43442b3902732011d74064c426e220a239462cc0163b0355

SHA512
777bc48b79a42743347ad1ab11997fffc5e8afa0731a07ecedd246ddc3252850322bd5abfe15fa45adc67c1d97ec389abff173a5925310eff56dd70d006e60ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beea9936a12c063d4fd34339e3e18c53

SHA1
c20e0f3b0938d40de93f66f77e9156f5b4fb219e

SHA256
8dcbae07651935d5602ad2dba8f66ac2301e7636adb732d65f468186dbb5e7f5

SHA512
215dfbefc8f6bf10f2a465cf15f3fd58273626caec2f960058f28efe29de8b751aea86ea51418e6d65285ac4d9e80bd3eff8dce55fe081d5b1c6971f0a8c3982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed1c81652ade88726ec34e18be5e8bbd

SHA1
f9b2d27ae05e5a700f097dd2fc26a096f731d2f8

SHA256
515837d110185e17f68653e02bdc9583e5a31f7a63338f847b9c4772c11db5ad

SHA512
a75450c82ec44a92f7d72438fb478c2743a4c17e684337255138a76312ef9cdb43bc9022109fe2ea98f467128f12c3244125cab7c4ca371d543a63065c2cd416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f85eff0ebe858ea5646a8884bbdfb9b

SHA1
3ad21db1ddc5513e8d09318acddb7d95303c2e3d

SHA256
168a6ec3848a3fa11cf6ca2bd4a82ad2f4825bfef55118a3910cf4f11d6b6221

SHA512
9480896b980727857542e5abe444257eb9892b9401275fe64fb55ea90cf75ab1b74d16ecb67623086ec4a1b9d56b71aa229f357ce8486c6f30317ea708d475ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d722e0ad4df26d8de371c98678fc43e

SHA1
da54373c8f63daef412ebb68625dcacc4eb163db

SHA256
6c37f536d03e91fdb183d1c8fd3a8c301860eaa1fe76f049aea99f62caa2424f

SHA512
78d6aae13acfcd1f4ef4777fadbcc8739d4a17835a2892cc8f85cc4b674163127127310c9d5f0828dd627b63365e8e5bf59bda36a5e9c5c3c4a05828cba9bcb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
424e4a47db71884bb86141f73e250455

SHA1
6d2686416b7826fe79b2eea3931df1603db700d1

SHA256
e35bf931fc6a438b2e558d16a30c63583de887ef273c610f959376453ca94a65

SHA512
36c99d712d645446670b3aac03b1eccdf962dfe6a8e50331c745fd04b9442debc9e5347c722fb0d675a55a631de66ab6b60f8306d2f1b99149e5174047f7d19f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4b826469a8e0d536d67315c22882a59

SHA1
f914bf1881e4b03b574f9781e57ca25e7c627ebd

SHA256
92a8d0da4e1f61f32a23d0167af2e53023ee07d38cfeacff9df061b12494c753

SHA512
0c08a167621ca5872d09c9e5865b7c91adc9ee1bb9c1bfd65045c56eea5da7a716c4647928730a638b73d06093fdba8ffbb52d47809f46e5ee5061645930427a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87c3c22fb6221c3ce226df4c5f903343

SHA1
d14e07d6b6a32df156d43fd1615e9c12329a14a1

SHA256
0e4d72f7234e02af1b053ac98942c00b1ea279cc47634d3c9af497511b007e45

SHA512
13229c89ebf34d9112c275c2122f7bcd033a6e27aa6b3b1aea92b6b725e3eb34c5782a54c4013fadfa5c423bd855ab3df8afd4093d0fd8b477a6ae340dd3575a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7F0.tmp

Filesize
90KB

MD5
f718d8a61b67505ddc4ad9303df97c27

SHA1
01e96750742ba942216026b7ba5416918f2ff0bc

SHA256
94cabb7495d542b14f072bc1e5a9937fe6b851f4a3faa1313a88efcc0c0ea218

SHA512
5acd963f31de39d9be9f0ccd458aaf19bcd81a0613e9ff79486620600d130eb69d43e17ceadb952099d08de67fd71f1600b23f83901a96bf6ebca9b66ffd0b0c

Download Submit