45b4b9fa980f9ef7095c7e911a0b38784014490ae0e00229e6f7e87fea860ea9

Analysis

max time kernel
0s
max time network
132s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38c7a5b4113d54b5c11484f265163c3e.html
Size

23KB
MD5

38c7a5b4113d54b5c11484f265163c3e
SHA1

eb912e1897b8989963b4a59d8f11843ebe8d16d7
SHA256

45b4b9fa980f9ef7095c7e911a0b38784014490ae0e00229e6f7e87fea860ea9
SHA512

98cdc957c03d18bb88e828d487c8a64ad9d4fd13e71e71b455916a00998d0165ab7f0016a8ea1f3c6c2fb96abd39e61dbfba410dc2b0ed27467d32bd2522d0b1
SSDEEP

384:JsnA4ywJ46p/aUBztvukeKXXTu5wJxVQq+ZKL24UTpNyOcn8tvG5nTDuU5esT8a:+1b4qtWkek6ivkZKc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCE2AD61-ABC8-11EE-BFC6-D6E40795ECBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1984	3004	iexplore.exe	17
PID 3004 wrote to memory of 1984	3004	iexplore.exe	17
PID 3004 wrote to memory of 1984	3004	iexplore.exe	17
PID 3004 wrote to memory of 1984	3004	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38c7a5b4113d54b5c11484f265163c3e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
06c1242c504c91b11d9d72cc42813d62

SHA1
7f0432cf4483f70fe5c63bac3e6dc5641217e238

SHA256
b770e405abcd02775df8c501129be8c28f1cce5d571b7c7396453320af6f2178

SHA512
daec529e229f6141e271871f9dece166aa7a31eb75105446c56811f67099c4c4005f0167112be536f9ef26aa736ce8b20f09dd7a01c3bcf5a13d64c07b6a4b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10ad7360579950d7c0dca120a897c8b

SHA1
f54e3bbb138175ae7ad365dcdd741cb921ed56eb

SHA256
26312d006c27a0b8206864729a2a2052246a624e9cf106785f20f7fff5df3b87

SHA512
da89a68d58cff9a66019555d1104a44c1681ae6303d594bae53b6855db73e2d35e587d6fd0e3a0d698e8701c331e6a54cb6958e9f7a559d36e010cfaeeaf9190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d81bf52875e67dea97e29e58b5444de3

SHA1
4a1486181aa6b6c8a43a23168c780497eeb18338

SHA256
22ff358073df26834d3e2bfadf4dd1c5508357820a7a03333c2505279eae9dda

SHA512
7e58377f46dc79bcf22aa01923ec80ede63fc55755525b386a443fa6a4d3edf8750d2811bf41d7b7ccb4527a9bf4b6f72e3635e661c625081e188dd715efd84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51bf9c93132884563faf2e87809b4be1

SHA1
17a67886ddcfd9bab5ea02eb414a0bb075e2689c

SHA256
1b091c810c527b55b23b986085dde20cd673c5e1393efc3bd4c682f17af3cb30

SHA512
25130259e3f6e95bf2de9a5c0076988733ce8951f2cb88158838903e67fd5335c801c056c3fc8f36141c2b7996f809785df97862f9069219d2589d5dd5df3b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb074d3d5f4913636c7e1e2ce574797

SHA1
7340b3608cde09883369163dfd8340da633513b5

SHA256
9e32c65dc883fcd7d66375eeef6ddab3eb4c3e9fa722dc19090a1d8c4ace5c28

SHA512
2f0c188868539c9eab59f565f235f8bb2ca937aea3eed2dd06608ebac5c10d855075d650f6da3c40081a5b184a3dea7362046718530d6ff7758441edc791557b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0241dedc2e83324d8369360b5265a9d5

SHA1
d59dc80ddf2a84141b4e03a9a20390609dc82804

SHA256
c3dfadb68599767af2f1d423a830dc19362dc49ab6b6d7c60c00a36ed997aeee

SHA512
889757b0d42e5db404e4de700fc5c226764fe2476cdae3e24101ccad14be452412d2612a33003442bc9be403b8fd6649f424609255f75096c0f965e236c200d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a20016819e44a1a7b19aef5159ace4

SHA1
9d361df535bb066e39538e0d3639c03d118f6612

SHA256
0ac3287ca4307f7c08303bf242e409149c301a9f8e27f0ade50e6d20332e92af

SHA512
0affd3c7696274590efed91d612c21d7d9407f49aef65ddc77732b685073dd6c589775d9f283fd2512e91553f2360a328bea878c748654ccc23483298d59f0c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
447b31390ae7fa9e9064d277ec6ed4a0

SHA1
34536822147b503f99dd1870c9e2eed6abb76d00

SHA256
da6109f295d34bc4ce4ecf4502a40f0d74d7a6e2bb7cd8fb1ad4b433959b46fb

SHA512
019949a1793b3d07c523b1a233c7be545db2ac89c9fe6e941242c3f14b757cd2da5637300e240837f9539241a6acd7d1cbaec6ba5d4fc9d980ce7bb6ef47cbee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FD4.tmp

Filesize
79KB

MD5
9504d1149bd19493feae802e99ecf19d

SHA1
d810cb38e6d5edc5b43cef0e3b2efde6a8de95ec

SHA256
2eec2552a237e6ca2da8b4ca51fe192bdb5f3ebf3d459ebb60d9cb2aaa779aa0

SHA512
3f978212844730bccd259473c8c3ce3088293e9c49e23643c71a35219a6c505fe7015eeb3f09477892139618f700c0090846da44f847b296523786a1aa7731fa

Download Submit