5a18f78f1249a8d577799e285ecd8fffb1558fcbc069075aaa07b269f9b204ac

Analysis

max time kernel
0s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FREE-GBK/forms/html/1/13.html
Size

2KB
MD5

8b968c5ebd12722401651782b7b49922
SHA1

7249b7042629dc3f2a8f80a673d69780edbeb031
SHA256

ed6658efa8d6059d874b1907f3a8ff447187d3e3442ba28b6eba4907a5ecef53
SHA512

38b157fbf72758b99a1bd11c843c05e714d3986868a6d63abfa6c3ce904603c24581ad8f143fca92d9cb39039c39e30c72613d7b80e4599a40b671e16148c607

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3E0F8C1-A8D2-11EE-930F-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

iexplore.exe

pid process

2572 iexplore.exe
2572 iexplore.exe

pid	process
2572	iexplore.exe
2572	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2572 wrote to memory of 2804	2572	iexplore.exe	IEXPLORE.EXE
PID 2572 wrote to memory of 2804	2572	iexplore.exe	IEXPLORE.EXE
PID 2572 wrote to memory of 2804	2572	iexplore.exe	IEXPLORE.EXE
PID 2572 wrote to memory of 2804	2572	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FREE-GBK\forms\html\1\13.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
2⤵
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de5a23924ca088506991b6b878ec236e

SHA1
9456881b7508b512f2bdfe287f8b74b3e7d228c9

SHA256
d57aca44f6c811d54aabf274e26b6cb42a2035f5795f227bdaa35f10321380a4

SHA512
273e12ec0206ee8e01c37b2532f3fdf5aec532f1fed4042dbdc353beb43d30904de1d1fe236dd1125bf28c04a77cf3822eb70968f7e2a03f4e17e1ceb0fbc98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1451d86c04dbe8d5b1d08a07190dbc24

SHA1
f986f2c1e2a7768227d04efecbe3ae670f90c381

SHA256
b058014db7160bc198313b83aa6769137dfd5eb46c19c54877acfb3d683b6581

SHA512
e1246c9c3ffd056ebda144f291a35c3e1e404cea51cb0e34d12ba69749a79a0d67a9dc6c7af276c8c504c3e0ff4e843f50019666b651b8d3e9916e434a50b0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3525b292d7cbe86d476cdde917c82ee

SHA1
b21b7c1c34865979f67e8edaeaf01ae646b7f1ca

SHA256
8b972371a683ea51f9da6f755abf3dcab9c923515b5381aec4b43d79df129f0d

SHA512
955d970e5115ae896da9a113b8ed076b8dd34703bcafc7994f2a8b8d22abfd3a20fbd9c4ed161ffc363aa59e6da4c7db1d5db4b0dd5a05ce7e09902fe0b3a8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b320c23fac56cc32de26c28cca3ced9

SHA1
5b505738261684581e7972929a1767553c7286d5

SHA256
8c6cbb4894c88f5aa00af15be01ae63d0563f610907f16eec2a0f1c6a3acbc0e

SHA512
82559e1bfe455e6a580afef8557dd258957797676bf3643efa2afa814212bd426dc21ebf0fa193e6fb2a68cefb6765379b317cf09353e4f73055a792fda021a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30B7.tmp

Filesize
6KB

MD5
fd44659069ba32984b25f09b2b1d44dc

SHA1
850c859e120389491ce58336b2135fe6eb5bd145

SHA256
0c7e4b240e2827ac9124e862e1b89e5e6224149eed28afbf8c73902e90d9f574

SHA512
cb9d7a974ac99aa24476dc274de09fbcd729969ba198747566661cf3e0d689b0ee3c95685b26bd9d3d38ddeb18cbe6c0f54da09ebecd49021b2a6ae9c4a162ea

Download Submit