15af84efebb7deb348b14d60ad1dc06be7b5e4846605374b40d8d23c1b9189c1

Analysis

max time kernel
1s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

243984a17cb6a26f12f0c48e42d98c34.html
Size

163KB
MD5

243984a17cb6a26f12f0c48e42d98c34
SHA1

988be446384bb64ed4be21cd172729ee9979279b
SHA256

15af84efebb7deb348b14d60ad1dc06be7b5e4846605374b40d8d23c1b9189c1
SHA512

fd415299792b80d19ca01b44f933983a41d4f2413f177e9a6d91c94c34fbf3ce4cba6a55c2b89d62dd20556558dddadcd34157e9c4f29808dba32cc0439dab17
SSDEEP

3072:F5FGSF3VKUP13G4k5QhLpOatVsI1Gm/ORdcWZFUlJEljZTGU5zQ+GsbWZS/k/FeH:p3t3G4k5QhL8atVXGTdcWxTGU5zQ+GsJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14F2EC11-AB83-11EE-914A-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2700	2132	iexplore.exe	16
PID 2132 wrote to memory of 2700	2132	iexplore.exe	16
PID 2132 wrote to memory of 2700	2132	iexplore.exe	16
PID 2132 wrote to memory of 2700	2132	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\243984a17cb6a26f12f0c48e42d98c34.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9a5de65ff1e65e9d71a5faaf4129fe90

SHA1
8189473bbf7b7dcfec0a980a6def16a05fd9ad49

SHA256
1b3618cd6d5f4f4ae60d2fc0fbbd012e7b7de930f6c9df7aafd22a7b1ce74f25

SHA512
d9c2f52bbf85374a960672ec65790b0a4e8bc0863e48162ed1ba3de230b2f7e8e8ae3433dbade01b92f5d105ac1494cb6b16cecdc1d325f5461d9144f73199f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e548931e40838386666a62e93eb02a6a

SHA1
65fa27801d86259b9b982cfb3b8b6d8bf1372a24

SHA256
5466f44e901a7f3e802bf69b0ec7f62ab9938a108eb0a0b081aeaae62dcb9ace

SHA512
a54026137fb2ec116a5072e44276a8d36386efc480b28c024f18df371262ea2c0916c810b38b9aff1d1b07cc7bfb5a4fa625c7e966c547e2f2029fbff5e2b643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e06e5f648d951021d325c65c4ca02527

SHA1
b4d3661a75215148fa9ad4cbc838b70c08502ba2

SHA256
f0a89606318ccd908d54db239b6dac6a6e43c696cb9188385a1e299175bdf6c3

SHA512
86e296be9eff30177d81ab9984beafaac82f56f0cdd68ae7a0e51df5f99ab9649217e99f2439d02a21047010d1a1f0d94f3989b0a9aea694aef71456ea815b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
862933e95f8c8a2c927d7aebe9f48290

SHA1
9d77a2d0cf53c3ba8468ba1829f6ff6f58f67e9f

SHA256
b415a9fa054b5069af1f97fa354bbcff47b8f6ad51aacb7220493a97dcd0afa4

SHA512
340ef32408dd00606d99ba219f56292b91307ce113626fbf0fbfa67387fd0ebaf82c9c5a456864743538db19505ab11405518a3c79df80bcfcb1a18cbb26fb9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62d1b35a32b8607b5a587b235e43c530

SHA1
d5cd9c8f114893bae05c5d3a954450fa69b92177

SHA256
d68de9e881fb365c11268ffa1ce80b42a1900b523f31e48e5c982b5331d49f4a

SHA512
6cabeef0648321d3b8ad748b2def182111bf4b852a0132b26422958ce0b4f5c442876d43e2d34c9c1660d798db75e4a98e8b12099056cf8039d17f0f8c17896d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e30c6df6f303086d417c2bfc08e66c

SHA1
6350ecf68695fed7c6311a9e95787f9edbaac317

SHA256
c4a08e70277a36f7076dcf8bc399d72d93ad206b407c0a99409ffd09ef23c87d

SHA512
682411247b05445dfc1007599c920aa4ff1acdc2d7a6a2b4dca59a92cc702951ae5a49a96341b219eb8deae4d8e121185bb09359af51afff402432144e2c0d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1801ee8746e38a25a769f14260985534

SHA1
f0a56d724259383589db0005976be93d008322f0

SHA256
32050c6c42c3f16300a1daf03c4e7a99bc3b634844bba8d26fd7df7ad7b10862

SHA512
489aab49bb0607e4c10af4b62297328222a3b685578dec2ef897ca6f8b58a1c79b91683519b5d600345a335028862e2016dd973ccbd1ba1f9c08203832e5d4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cc16fadb42de89d3a95c9531a3b0b58

SHA1
ddf25d83fd5972178e822b2397c4f291e56c16ac

SHA256
dfeedf1291c3e6a2cf5bfd3760525d35d2df3b166a672dcec217a71a8e219672

SHA512
ef81730bcd5005d4edfda3b793bae4b4481be498d41a48b2bf6143003a86a47848536e94f5293eac25b197594f706172f568beb7fcd26564c54b9bc5c8c1d5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1eace7adfd3516acde575e18c9874b8

SHA1
80f2c7906555f1e7aff291fe91ac436f49bf7eb2

SHA256
3e8600d3838a3f541a3a7f1b1766df6fd66fe2f1d5a7ab4c4012bb97501e50df

SHA512
2d6060ad4766c799b948c9c71532d6bc0fbeeffc7a071b953678ff4f27514bede88c5d93358e42719ee0e6bce222305466bc22e415d014d9b8ef7a607d952f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9dabcca0481b4c8a103f2e70fc153f0

SHA1
679866271a07561fe91eafa70822ba9f0a020f50

SHA256
9ca452f977e2f29ea1bfc909fab70efaaab52116a43f88be73a472646241e57a

SHA512
8df167a822ca035545d43330068f6ed14abd8dbd896b9d207d546f79ebf7f052da10cfbf3dfb580d826f1b53a11cac3dd93ee3072f63bd6bc6f149f962411955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5409a53869b1c2cd7d8a54677411b2f5

SHA1
a426adc1023fa53df7dc4bd2efd4116062915856

SHA256
9922827037acfa2d70bb43172a487c55a27247b45862dd1595eced3370506f38

SHA512
7f3d0004bdb0415017e62e7004c8753bbbd479fcdbf21149a43fbeb5a620c93c3aefd924c2c96a4b9bb8c3d655760264842ce03a3b4eedbcc0fe3c8e5d504c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cf756b7ec25ab0950173a6c716619cc

SHA1
8a50d5ab27c21ef926f2d0269cdb8ba4240680d4

SHA256
31d20e2049db4844542e8c21b088623b4f90547bf3baf35973be4c2988ab186b

SHA512
ad021fe53d615823be184d53347fece4e1156ee6d2c05e96f024a236a5d76f0f83b0823f089293858ed7af7989000565c2a2a8b3177d82fc1980333d1efd64f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b2fc28d118779b96acedc42a92cce46

SHA1
e5fbbe4d86fe19d051c58673933b62e882da039b

SHA256
2e27af2d94992ae5e7065f1e083103a2ed7e3d8b1f4a1a8890f03237c0a0f3c5

SHA512
1213ca1f0c0c412b08137c3a28674b1c1185b51b326c300bbd74408db94d623d823b3fae6ebb803ff342f864748950b5011e49e57b78093df5fb383f5ff03162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\0AX0984Y.js

Filesize
157B

MD5
67e216a27dda24bdcb086c2385b0cb99

SHA1
17141c80f5d32bec3691c5ab24741d8b7dd5f0c6

SHA256
9dc433b2142d3ba0803fcffa53f19d34da26996d20c829df6d694bc887325dd7

SHA512
802319543dc64cb011bc2684004e878a842b73aa55e4da1141ccb8650cbf42fabbf2b46c730760bbfcc7a140e11700244b9f5da78bafe9fca7ec7825c12b4255

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C8B.tmp

Filesize
5KB

MD5
e02fd91e17406ebd0041ed3abc76fa87

SHA1
48ea9fe393175a8d2f8fb1e231ee462fccad787d

SHA256
f14125a62ef7e22570ab57698b56737a2e9feb135ba800543253352c1d7852a8

SHA512
13e87748e593e8c575074b1ea3ac4b7bf4396b6ef5f9c9f88c50407cfa5f421c7e754f19d0037f5bb4e20dbf3a2b9f27bedb13ff8635ce87f80d3669b761bbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2263.tmp

Filesize
27KB

MD5
ba6099a8a323e74479fbb9b376cf0bc5

SHA1
b426a2f71b47eb76baf455df4157d73f39f91644

SHA256
f9687c73dbe5915d7d2c87c675151c82d7115c66b64455ea65b1f05c8281016c

SHA512
1f180cae2b01bdefaadca35f7a89728dd7ddb14992a5dd314d97939dd6d09dc20d173aa387fb848d8613583bcaf21fa11b99dde8baac0663b0b0e80f46f9060c

Download Submit