cc1187a767a935f8bd1868b3d7ed2f95198fd6a79ff19f644c16f5ab8b0a1c21

Analysis

max time kernel
0s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19f57e8119be32755639c313c05219fc.html
Size

20KB
MD5

19f57e8119be32755639c313c05219fc
SHA1

40896d30b0f1991610b0455307d81e46fede3f18
SHA256

cc1187a767a935f8bd1868b3d7ed2f95198fd6a79ff19f644c16f5ab8b0a1c21
SHA512

31adc260bd6ec6d0ae8d410cd4242554566d073aed77e96aac0ef52f4d673f091927333a9564d36ed5f4bfd3966367dd547bfe06c03274059895d3a584128d89
SSDEEP

384:oS5EubkRdWVQwrY1TVV06Vvds6d1didvdVn7ZQA2IlbXlbldRlbhlbldo1lbzzls:oS5EwMdZG6JTvU4eh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C285701-A836-11EE-B218-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 320	3056	iexplore.exe	15
PID 3056 wrote to memory of 320	3056	iexplore.exe	15
PID 3056 wrote to memory of 320	3056	iexplore.exe	15
PID 3056 wrote to memory of 320	3056	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\19f57e8119be32755639c313c05219fc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
207aa7bce6ef52b6bcc6a82f006a314a

SHA1
14d7d75be34678f461af83b4394f4e2ff4990a61

SHA256
0afbde9717351da22cc8352202ebcca96d02479a37f31007de17f24a1440990a

SHA512
e2dcd9a3c36758b47cea931e7690714a9f610d51cedd96c05ff870ea6e83f64758c731377efc8e3aac2727130fd099472ada74637859f96d084aa6b8ed266042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfd8c9faa3fd484d3a7c7a55f20b3b21

SHA1
bbcc2a1aa54cf183de107ad70ee01831a72bbd28

SHA256
6d877fa52577e518c42735b61ed40314786393456ca948905740de50b14f206a

SHA512
f2712f3470b426ad6787186362895c43a2defbfca9950e294143d88f5e7e1ee6ebaa20a49e031d14ff77fe390de34bca617fcb5297b84fef141b611b2a2e2751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b45961c4536b03a6ab7718b87ca275b

SHA1
9b034e07ada827d01d86aecd9ea349223bd82ece

SHA256
d539c796eb5c4117d0cc6e794287efb2a1e398b13d5b28e520444b34782cff9b

SHA512
885a90fce654f29922baaa625c6eaeff81528f9301a4d5747ce772332cb8f6098df232522a4808b81a6142fc3fcde17dc7d36cca1887c650382740a92680d609

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e04dc5c22c7d67aecc8ea335b0b90b09

SHA1
aaae46dbea95b3825adaa3a6b7fcb21b7140dc91

SHA256
e6d0ca7408b7088d9b81a8e71c15f9ed21a29b96602a159b9a15a85963bc0b2e

SHA512
2fdc82f5f69e63cdb49fdf12ed161b3401dd3f86da93c78825e1964b3120535d2d988b8697f9d5de517278900bf1b8486a8d64bd5cacce7a438d7d5411b83f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52ff2f9de3c0c8b978f082f7caece8de

SHA1
bb6083e95df828d30c1cce30cb902dfa1ee6b7fe

SHA256
39f48926f2a2d35e5242062d7b16c2d15bb37df37844bca0990553e1c7b24ad3

SHA512
d26af6d71f99856370865c0539df7d20b462c44aa0e34583d3b2c9050057e374d33e75a596346f8c1cd7b2b76702d8315e45eae294d18abf53405b12a189e4bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19414818644ff1222defe066cbf13fcb

SHA1
2100e98f86721d998d8482502732d25af18b1769

SHA256
a26ee03b3b3564f8250e85f923da388bbe36b7b50ea8165904adb71779deb089

SHA512
7d53302dd24d2bbaf92bef0213a8a927adc4597022e72a839a8a3c25eebb10ba99f6e835ae0f8df9881ac12b65ce5301be404c3efdee4a64366852b42c5ed312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6dbe4c914ddaf611b5f29f795ff4813

SHA1
4c065b33b078e479189fb0131725e4c6072cc174

SHA256
3dd7bc76bf73ff26ffa7402cf867e262f31ed7475c81a9342558d4f725b1cc9f

SHA512
472e4cb7829c66270e335bdb1d2b896e80f108f2e9252ec12ff0655f84726e405ffc8434d0888ea999908f6863a45f7a81e627e4779faee1178c8acb9947410a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DDC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F07.tmp

Filesize
92KB

MD5
bb84d39015d7734bc7ec5da88a516b23

SHA1
1a15cbe452f750dc4f5d780b2517fbf82db39fac

SHA256
8f807ac7fa789d13f51c3451b2728ae70fb489ff20a8c20f073e68ad0927a882

SHA512
299dfeacc8cfdd600ce91764a0b3f75a431a795635989c2a53dcd40cd1c42c17f92179e8b239a2596414ed59ba7deda1e3503aa5ac611703bf3cf7a0a8abbcf7

Download Submit