e08607668b39ec658ebe670e80dbdd48bb0e04d41b183ca95d761774f9248b27

Analysis

max time kernel
0s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12b45725d945d3e320b35ae2bd204ebb.html
Size

57KB
MD5

12b45725d945d3e320b35ae2bd204ebb
SHA1

e027100f19b5f24337391485de20c2330f6c4e8f
SHA256

e08607668b39ec658ebe670e80dbdd48bb0e04d41b183ca95d761774f9248b27
SHA512

2874bf405e166ae0564362f402dd43adf14a32bdb3cf7b48716b36240dc8b0e7d41287e5cb59d109b4d0e3d6161a34c192a308196beebb515bcbe6b03e285cc5
SSDEEP

1536:ijEQvK8OPHdyA3o2vgyHJv0owbd6zKD6CDK2RVroZVwpDK2RVy:ijnOPHdyp2vgyHJutDK2RVroZVwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F395301-A7A9-11EE-8459-F62A48C4CCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3052	2924	iexplore.exe	17
PID 2924 wrote to memory of 3052	2924	iexplore.exe	17
PID 2924 wrote to memory of 3052	2924	iexplore.exe	17
PID 2924 wrote to memory of 3052	2924	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12b45725d945d3e320b35ae2bd204ebb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ad9a4398627a88b3f922e270f68d2aa2

SHA1
6d2edf0d6799295021bd08e065ea0e479030efbe

SHA256
e155386bd6a298553be82fa378ce588d4557795554ddbf5b95af1a046c097bae

SHA512
00f0ef52b98f3f607d7fa179aff61e5ab52b67a6e58436e889152269494c9960e4e726c7764cbe4c1e6485602702afd5a99ae6960719bff01fe697aae2ee5f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
47b0b65953b311d75209cc9cc8877018

SHA1
374e6b945078d938b2d99a6419d2d09b08bc7aca

SHA256
f890a9cac326e543b232611ee76c1ffa30f975ecabea19d45d95983ca9dc4aa9

SHA512
360a964fe488c8c67cc74a93c4142a3a74901c8338ef78d9ee1c291b1ed13df77c7608fa657bd6e557f5bbb36f55d5d4fff5ff417cd45dd59872d369cd6ec41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c45fdc403978b026ebf4bf40e63e5ccb

SHA1
2a889c3c2edf75f26f3d38a699d05bd6b73f5811

SHA256
0e8d90d35f11d0aedab8e2574fe4055dff383f76418b183061ba38f2bf9ab7ea

SHA512
0d628667075cdd2d806b6979224814a958dd4790030b66d9cc7fb8fb2912c08925d0dc0c74e4419550d5e2d778d7b6fad8ec9926810b88245833866339ef4481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b85d9fdd0033d73103a6b0624a160636

SHA1
a84c56aba4856c46bc0557eb459c6e6b25b2e81c

SHA256
910def7659864d07924c9316566597cb02f523d9767680db3d1ce6dce633789b

SHA512
065879d39fdbbf479c18217f84f92e1768d60ca278ac863b94c91561d54754346207b5105eb1a5ae5f3de5da85625c99abee40105d73bebcbae8816fcb5de649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
525438b566b8490ae005c68fc1d73884

SHA1
a4aed7bf98892e55bbf286e19c73e20eca8c85f9

SHA256
473ddd053d577ee7d03541b21f0df98d2772fb395afda6a0274c8c9308f22d79

SHA512
d07bec3f40c6e9585b001b149d8b11e429208d6c00e4910d3d17425528f0785b623cae1d0a5b74f50fae8a7139eb7c9d4d02ae0294691e344275e0a97557d2ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f60d56b1148883d28f96d9b3476ca84e

SHA1
ff76af0e74be5ca47ba338fab202676af4767a1e

SHA256
1a920a6e725ee5e1baf5276266b5e642bfda006c6001e50d91c21a497f5e824c

SHA512
d2bd7275d37c9b8f3d646c75f56b04fe0d207b663af5cf216c1bafcbed12c335e229d797cfd0acdd6411aa5069e7cbfa1c53e89364a0abd0e397f741b7d67d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f9586f202dad91969d8af08d0b0da881

SHA1
98942b095b6166f75026d81df442c87fbe5902f8

SHA256
e86dae56deb14e595f9a54c2222d8c90c2a6ce95e0e1505f2d603f5166141484

SHA512
a5849c89dd3a54ac4cbd3ffec71ffe751bf8bbb79c11498d4a4e24fb7e463c8b743cf84efbeae86d9599cc5e3ec3179e33c3f72e8f5e6d796f138bbba1412273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2OBDAFD6\www.dailymotion[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2OBDAFD6\www.dailymotion[1].xml

Filesize
165B

MD5
efb9616cec05507bc201e808d3120190

SHA1
6bf1a49d7cb7cfb10513ffbac5bca15bc1da4f26

SHA256
5ae9fa9f56309427ed45ce36b0775348bd7e9ed8c35c38fe166a04ad64bd6589

SHA512
34507882c02844c879289b308c35215c0d846d1d6c751665fe7eecd80041897a054f3c08bd5c7e1aaf37985c761a9c9d161ccfc875c052f45a329ff79ddcca4d

Download Submit