b9dca4bedfa537b1378c62fb8b3543afc5095b06315e43c2882a8490c1d20db7

Analysis

max time kernel
2s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

400840e95035181427e8acb3e897b734.html
Size

5KB
MD5

400840e95035181427e8acb3e897b734
SHA1

15f55be620a222adf2a787b0faa2fe346ca3ba5a
SHA256

b9dca4bedfa537b1378c62fb8b3543afc5095b06315e43c2882a8490c1d20db7
SHA512

49344b3492427fb5d075d679cb64236ef3fb9a2f17edfe2d2b533bfd97b1379f08a834cd91d1c0ac1ab7544deabf7eff6073c05e912e466b9543b335a802441b
SSDEEP

96:Z+Xr5k9WDZU4xwwZihTYFbNf3XXr5k9ZBDZU4HKkWVTATxXr5k9ZBDZU4cS/+xXE:k7ohTYLftScVTATrSSSFFWpit

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FBE0F61-AAC3-11EE-A1FE-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2676	2460	iexplore.exe	17
PID 2460 wrote to memory of 2676	2460	iexplore.exe	17
PID 2460 wrote to memory of 2676	2460	iexplore.exe	17
PID 2460 wrote to memory of 2676	2460	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\400840e95035181427e8acb3e897b734.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6611b4cbaef4b2cd9a57d02f8274101

SHA1
6f89eedd7d8a33d0a62107c51b114e1611e7d7b0

SHA256
79705634ff76708cc30568a7b481f25310a322709e5d8c271c2de602a8fee3a6

SHA512
32cebcec4607318f86b3bc44deae40883a52aaf2d71bc69cca9719a2965e8d556b7db84f58d195c2b0f8f08cfa3d8c19aadb31f52b508831865b14f217701674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
011338e3a0909668439e040ec2d7a060

SHA1
a2ef0002b63f48baadf0173bfc3435a78336b790

SHA256
35050873b60531ff0c177d0245a667d1604d495e2a317f589e229aa601dd004b

SHA512
51037b4b1cb03d911130588ad0ba8fe454bee317e5fcde6224a0f90c6551c73c2ba1c55d11a8b6cc46cd6d049a5942a9d70cb1c3e45253a34456f585e30df719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd35e8dc613d8bb66d6c1ea404fe9ca

SHA1
bfcce771c997256f9b2414e0c436824af3dc6bfc

SHA256
69e9e2d8ae98fedef7bb0f67d63aa8958652f6637b753b289c4af2f12015d49b

SHA512
55308cb835fef3b07492602dbd0936421140d8cf7a05f8f29f47306098069543bbae5ee4acf510ad2fe047a161241b855329beafe0dbfc5ba038f81056e264a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07ddbe21322ebd65032e32c0100e7abf

SHA1
b42805fa372601b19672b06c29ba66f491381c18

SHA256
c2c0ed9b28289cdec8a94421b891e8b163472a76d3d623737068c537c97463d7

SHA512
699871d565e12ecb163b73db85171eefb453ef27bf9e6e24d38ea94e9635fe7bbdb87ecceade95c7a0f2203346692fe7fccc3a40a1fab5510ac9c2cc5cd9f816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbfa38757906a2b7c0b3c568822d6f02

SHA1
ab6edf0baa160227b2f4f4647cf1647b6403d018

SHA256
0b3cc6dc725c396a7f77127ae51c0bad8775055b24578f867d3e736280c282a6

SHA512
3365a52457ddff9c6794a662ff28b0e15ec04f896ee74b8851cd8795129e47c4fc863be5ffd97f0b2ee1288e0aaf82bc32a4a422a36232a26debbe5b895f9ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e42533e44e7c0432122c1bbd2f02cae

SHA1
5192c57bb688a8642e51eb0b05c95914331f6845

SHA256
6c545e4fcf696a4107ac83a61eaf66ccd76f9829e2332e05e25039d636979651

SHA512
5fe30f46b25ed71e1075e098e0e4b02887523a5cb3089b3c0b8f8eebcd72bc88e13505a1deb72f0ec738658474f7f4b45224bddae01fcc095968cb955ebe2d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6c5dce1b40e76096a45b47ff2f87c68

SHA1
9ca59ce8130d4c73b04db9d01ce7e695e59a808e

SHA256
5868704ffbbca86ef758433bf3535c6daf3b1bc502b41f6beb2dff6b0e292ced

SHA512
dc710c9d4c6499f512f50e389ed0618850b139c84c8155bfc4ddc2364768bc2325d580ce5803fa445a8420bbf863140278ce5b408fdb6605926102cd7ad2280e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785f032a34c4ac5e33e18fac7ae3b3d7

SHA1
d18050ecff1374b4075c3e413bead1c5780824ad

SHA256
36f32091c0a953c5efd803dc6e80d892522a1abc27db291ca5d3255948d28420

SHA512
3e91ba4dce6b7662cfd983feedc19027667e36b190a6cdff703e2c89caa13306f49403e3b9171b3e8dc7742756ea96d24cf2ab14666483325e57325294041733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e9ae884e9898147f4987fda968eafe

SHA1
37e138df6a734b98c2fc08271805802e6c2330a4

SHA256
cf9a15c895282027d7df62b14cc7eec9605e1546f69c0c6e18ccd4fbdf879d22

SHA512
5a92a59c7d18d12ccd02e3e79f0201c600762f08f228baedf961c4d2ca58c67ed008b4cfbc7941d44be8ccd8bbaa157715107b25cf4964f345e3a336e83b9f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb2bdf3a78d131b26cd3abb2f81496f

SHA1
a6f576defd8f2f424066818263a5d25e895951cb

SHA256
e99c3dc3fb529e9ab9c3dcbbc60454e115a37401afb6c4ebe085d4924a2570cd

SHA512
e45d5471d330833fe255493ef0dd82dcd8a32013e377b45efda4d68ee3141949139071ab18640532b24c1d8223fb523b3ed50e7622bf13c023e9ea399b261396

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7506.tmp

Filesize
56KB

MD5
6a8e7033096e94cef1f35e94b62b1223

SHA1
1db827e462ea1796b27851611931afe0af7f0616

SHA256
93ae2f1aba06fb04a040e9d7c5c0ba0afada641e4c6e52cb2f020307dc1ef633

SHA512
c767ec8415dcd5e0378c02c2a2ba2fadc56d6437d1ad983aad5772c9b1ff44129beb4705197ad725f07731deb7c191c32df630eeff4b5d7b71a7f35f7ebd5f92

Download Submit