2677cbf320f48fecc1a916b9b476c948bc19370a836d4b0a22aee578f42f82d7

Analysis

max time kernel
1s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

372e2c1a770034743dff361956a9f4b9.html
Size

25KB
MD5

372e2c1a770034743dff361956a9f4b9
SHA1

1c5dec0f3e3cc3e979358b55e7e9781486fd7601
SHA256

2677cbf320f48fecc1a916b9b476c948bc19370a836d4b0a22aee578f42f82d7
SHA512

33da6b4f6d3f97634f3db26e24927102344c0174bccce0c113db35151de460e4e9845301a2d24d2119698a34ebf3cca17b2fb36238c3858832fbe3077803b174
SSDEEP

384:aMdg2H8oEbGwaIjcOUtxKTeBfKTpE3v1EtRD3LgWQQ/U4yhoy7jfIWrYc51IlSAL:Ng2HlEbsltITe0C/Cf3NG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E650F3D1-AFD2-11EE-AEE7-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2900	840	iexplore.exe	16
PID 840 wrote to memory of 2900	840	iexplore.exe	16
PID 840 wrote to memory of 2900	840	iexplore.exe	16
PID 840 wrote to memory of 2900	840	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\372e2c1a770034743dff361956a9f4b9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9338d62140db31701954231a6929e7b9

SHA1
1e6a51951c2a32ba8a8a860f2ca8a594868049c7

SHA256
23a64d4626f14780ef47f86166d29a35243f9b8edef3f7395d49b2be8f72e301

SHA512
e9b799f8cd4bc4f9fbfb647db8a90fc1a45dfcb85206eaed38c9bdab72decc5b6e7681551c9b91b86368ff2244914fb51d754589d682776edf8f79c5803f9446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c20929ec111c86faf3ab81d73bf8c126

SHA1
0de64430751be1721286744b8b65595dcd3839bb

SHA256
77c13b5817b34ac066904f44521aad5925aff78008a96922b068ae3cfbe136de

SHA512
b84a67cf7247fcb66d61e122ea7a1054dec5804cb1e70068c68636a93a29a603081c9398357c94f9ca78df700510be867ad9e7b28f900bba016a964f1c77a0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43b615453ba189508c762a09b84de3fd

SHA1
ffe92005442fd4f5075234835dda1544001c90c1

SHA256
6c26d1331872c05f2dc80f8418fa16e2dc5a83cc61a859fbb3f541d4e5808b53

SHA512
fc9fbcdddc58b71db970924fd9c0613d09707f473e26154ee1546271841f5f83e82ed8a799a63fcd221f061ba28156bbfbd04a6ad5bd8dcb3dfb0677b23f04e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964b5f42c506fd17a24cf3227399666f

SHA1
2b75e95df19b6f53c172cc66f9138bbd67a37452

SHA256
2a86136d8f4f3976d6be47f243b1d60ffe2d8fe1f9382bd26b89b617939004b6

SHA512
b1a4af663b0998edd6cbe02d61a2ca8b1d479e9be3f0b12689419da76e201841c17aca5fd08284eb439e6b6b37ebdec08254633de58d588bcc4ce0c409d9bec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf6b9169dde8a4bc29a25f3ca202232

SHA1
7c28daa7e56f1d490bb0400988a36a9f89daf8e6

SHA256
fe75036bee5815b6e689bccd2634d2201218d44d04eac718cce88c2611651ad2

SHA512
a11a2b2ef6062798fe713c3026f0b3ef0c195a2f7c3ce9de35c23230dcd891e7b6e7c6b748e775b4c094662654674f0fad04a1bef20362c53f7c67622786dd6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c02e1e34a4daac682fd506765b0d11

SHA1
d3f8785d28e7d002a85a91becc05d557bef08a9a

SHA256
85b38686476cbf2db061f843e8b715fd15cf544ce4b4cc52dc32944ee0db5eb0

SHA512
dc9d0065b88f5138f1462bd1c240ae2c116de2f8d4b40b87e9b1c2e20d641e4da9022f0b616b6f97c2f95c3b215a51da0da52b9d150560d3af2a4b009f346843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbd15176f926c8a4eb1090317b5421f0

SHA1
212f0050cb6578da252f3a496d192690bf228dc9

SHA256
57ef59930d111134c8c7bb024125ea1faea69df93bf7f028b7a3f6362348940e

SHA512
9fc37fe7d310795515f1383ab998e75ad671738c7bce81902f42a5b26efccf8c4931d0ff8bd9c46a356cfcf96be2d05746fe5ce488bcda49b6ac3e71bef2aa8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e35c7e4690fd9767288d1914304bb87e

SHA1
725e55ab58ad87585f2830db71e483716bd1eec8

SHA256
3973bcd57e105d616e642243b2b6e2d62abf87b7988d4adc0843a2839d25a961

SHA512
16ba5f23f39a73f940b3897dca0a1d2840cf6d728f501fbbdf0d12ebbdeaa21eb8796837f3620712c5db93b504264ae365a42be4f48d416dd1e71c8766539055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04b0022357c59d3038ea07568ad43708

SHA1
0c5c9bcab6da964bf7384f6e8bc02ed74de5b218

SHA256
9247bf62823ba462ba49642f5639d518e26b46abab2dd8b5a3bb43c8f344c55e

SHA512
290338986327db24629a756ca714ce39ce22498f31112fbdc0baf6a72c72b69ad594380a714756d049619adedeac6cc46ae67ffa1bb86b6b60738779df3ab96e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b95a4893c93fed855a30e59854c706

SHA1
6263219388c851922d9fda2bf7c4d28a6af00797

SHA256
2db1a25f64e4f65b748e7c9c000fdb976dc616fd8302d1904ab635bbe7c5221c

SHA512
9ec34d3ad1fd040fcf728edde9d1ffb8f6f9603f580e731c6bcf02611d81511b8e5260e68502888c9e2994f7e056379b188fff26e38631fe7954cfcc7fe77e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8349.tmp

Filesize
24KB

MD5
87e63a96b8871c4a723449a6b2ba236d

SHA1
9b4626309ed7edc81ae7e5683e513436d0ffe803

SHA256
9df331c286423743dac3c5adebaae6775cf80c0587ce31c5fe5efacee2e9d5a6

SHA512
4d0aec5768063311010f509e1f1c31717fd1d26cea3dcff707f392d783f9e0829b17a4ff321834adb16243fb1d83c49ce2f2b09fe10fd26c88fd54fb1c1dae56

Download Submit