dbfcc0a8507b6bc8a0b81095bab6a529a6f157d1b4e0f22a9b8cbe55121180b4

Analysis

max time kernel
0s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

130042cd30e536824b449e324c3df196.html
Size

70KB
MD5

130042cd30e536824b449e324c3df196
SHA1

078762bef611095e8f838fc28bc6f67253ca0e17
SHA256

dbfcc0a8507b6bc8a0b81095bab6a529a6f157d1b4e0f22a9b8cbe55121180b4
SHA512

39555bd165a3497f7547305724dfb252b25d13a7298793813043abe08e968c5831c77e199db3a20be3f4f843e07ae68e796ecda2d5826a33276fee698389647e
SSDEEP

1536:gQZBCCOdr0IxCwXvjgL0mQIrc2oNfBcy0C72vwqKB20v6wa8jFYO8Fd21qPHdmwP:gk2l0IxXjK0mQIrc2o5Bcy0C72vw1B2D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAB70241-A7AE-11EE-8CEC-72515687562C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2036	2364	iexplore.exe	17
PID 2364 wrote to memory of 2036	2364	iexplore.exe	17
PID 2364 wrote to memory of 2036	2364	iexplore.exe	17
PID 2364 wrote to memory of 2036	2364	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\130042cd30e536824b449e324c3df196.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e3d69a1913c399068def5a84b79038a8

SHA1
d89d7bc8e7e1e17562ca2d792b9c9d0b3fba58e3

SHA256
15fa7355872a0066f954c91d106cf8776a88513e96b5b2be26d583e7d6944983

SHA512
6091b2a00dc5f72661c641f2d230e6e8523360537a21c07a45f2ff34625e61e86077f48eb5eb9d889cc53eadeaece3c0dcc289c7c5348f02256452ed46e21eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89970574dd1aadb1b2198be40921f9df

SHA1
48db254c47ced2540f3cfa97dfa785fa0652d69b

SHA256
4cb99e2b420fc006aa21c2b8216660387f0b82fcfefcc1fa3a32a18e5272e07b

SHA512
30f4e29060070d219a6b2afd1fa14c3d12f5d4c18321b54eb868863bfec4ae039fa71773a131d808ef12d9b445867435a813040efc276911947d82e4be1129c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b6034e0eb3bb97b0495dd44983c66a

SHA1
4bae29f00d013c345b01519d7459ea88858d6393

SHA256
4fcdd3f177744558ec55016381033572354fd170e0da400db76f2fc95c4710e4

SHA512
38b33cd641d93594e4f82761e5cec51f97af150bd9784b0f3bc000c1f755fe65cca95d18e3f55b0e08d241c634828f85a93c2eee1ba21f3b516980f48ee6b3ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3d57ed076e4002bf9a66da8e16659fc

SHA1
c97509dd9deb3a2eace05cbc05c7b52b82885a15

SHA256
41d5209bd748a7260a4093170598a33e2fe700db89988d539704d877037c0fb8

SHA512
b77d97f19177b613ec9084564b27c95789ff5d9d407f339132e44fc54efa8743c1ebc09043236666a15f535493ba590364863bda97eead2189aeed43c3507257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10397bde088a9cbe0c3894d90b1f0272

SHA1
18f0553c509b185e9e52eaa0ebe5806f8eee804c

SHA256
85f1cb905d6baceae027bdc452dad92ba8e3c0aa61da099516ef5c1fb0780aa3

SHA512
2e881a616c79301870cc77dbe869fee2884a0fa2c0f1a62c7deb8096a4d7852c42620681e6dedc5bed743f746bab8ebe52a7299c30f0d8e54b859a069aa69c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3559a362e22092b12da06814ea09332b

SHA1
7f44ba3377bf270f178e053aedde18aea34af171

SHA256
a67ff2af3aee6437c7ee53bc097a86dc8629d18bf84fdc2e6343d807283bf048

SHA512
c4eaf2a4824cdc906f1b68e49ef482e43b85601ea555c7f24a9ce479d8171ef2a433c805bc8850b4672f07ed261555828bc17c4c57fbe4dab3ce90e730c13d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28e5a20a3c06553cb3b5797a7c73618d

SHA1
c949fafa7a2e32aa952d4d8dc343cbf568678831

SHA256
32cbc00c692818e728c23b87a8698473e79dc3f1a2ad4117c9c78cf7a60b3670

SHA512
28cf7303d939e5f69aad2fc71b38545100eea46315e3dc13e58deededeaafd268b7044aa9581f0d554e7377bd8cf446795833003537bbfb11b2f1d839c062a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e43bd5488526119bb3f98bdaf242e7cd

SHA1
c55f716185d250685aa376a32d38bb8ce8b1414b

SHA256
eaf985fdd24d566d00ecec23c41470ae8d70083a236ad770f36597358a950fef

SHA512
1d41cc181bf7a7a3df71d2c60c72098947f8eeedf77624326ff513bb697fecce3eaa31027ecddb7d0b34cd41fc505b6c79e092f014562ff5d1209d623fe850ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
043d0002d53c6fa9c4bec3efc0ca3f76

SHA1
29c7045135686e34d0636cbc733d7f3c85c026d6

SHA256
92373f4ef715cb69fad4c3e54b548c2ef45b11de5755db92b0bff3dc528d7b25

SHA512
22243678e15d236dcaf4a6d7e871d95a62262f8ccf4014a81812785c7da70e5c076ce0c9472ea56e5101b930d5ca2d9a524d6b26a996a3dedc0493228bb6c51a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit