a214c55270c319886cdecb6c17cb5ca3c2be2d76f8c66d5745d0e6f2228a9483

Analysis

max time kernel
0s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

415efe86d3d0e1e5e155b36fd9c53d98.html
Size

1KB
MD5

415efe86d3d0e1e5e155b36fd9c53d98
SHA1

2966eee4cbce4219c584b08bec3c1eb59ecafe4a
SHA256

a214c55270c319886cdecb6c17cb5ca3c2be2d76f8c66d5745d0e6f2228a9483
SHA512

b0cd5dde3d62775e16a59880bef90dca1db66b159dd4187d3ca3531d0c3bd4e053e94c09b389e746370b6e0c1ad6c33cc2d92b389f5b2ef2525116e94bb57d30

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9194911-AB1F-11EE-88E7-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2224	1716	iexplore.exe	15
PID 1716 wrote to memory of 2224	1716	iexplore.exe	15
PID 1716 wrote to memory of 2224	1716	iexplore.exe	15
PID 1716 wrote to memory of 2224	1716	iexplore.exe	15

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
PID:2224

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\415efe86d3d0e1e5e155b36fd9c53d98.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b068ea34bc32707a04e0ade039ceff

SHA1
95f6e822e77cb208b938bfe38d131dd89c1314e1

SHA256
17aa7da895071be52e615cb9089d739a66cdb4652d64873c85763858d5e02c59

SHA512
ef6fab7a6123a440f6c9f1a36f5c8e45d4d460d462efd783311ce19c10364b7c821b0fbcbef1fe4a6c5a9e621490ec295698e5c969ee0590625fba4f4bb478a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1076a3799fc2e5619a6d0204297882e0

SHA1
1c0e98d1979af50fee4d76b9ecea7f12e349f5cb

SHA256
cf4aee34fe7cb865d55b349f29575f942bc4ee042be7d14c2058a17eb3a8cc7e

SHA512
25c9e7b082d7aecd3b3166721dc6e1ea0dd534123f32b7cee105ff3ed44935cc1a44cdd2a811b4f3157407ac587a306528306648c6b0b7beecb1b30a38b60c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a25d56344b5eb5c62f06750535d73d1a

SHA1
200411b5439dbc630b7c2afc455a27e1dbea8366

SHA256
c5f767e45f5f6310fec9ba425e14e8973045dde0871bbb5098e7182d55a29e96

SHA512
e6c28d7bad45c09b4cc256b6556f7589a79e42f7a5906fdf74d43bdb770bdd6872b374825b73fa8a90426ce8e6eb785ed9fd18f4c0ede7085dda0150e5fdbd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9692892bd2d026401814603bb6bee7ad

SHA1
df7087a71b7592294a02890cd9561ee3eb287ca8

SHA256
58ffc34c155a5251cb5108ca875d441267dafce616aaf5fe8f50deef890fbcac

SHA512
2a55cd4dc89bd7fc00dd07dc63a0d800920ffaa21bf5863f57f48d744ca9fcf3fda453851d10c177f3bb83b2f01ea62840648b05b8b307102786e4b197e9f469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69a71fd9aa3316061ce7c926a343d2c0

SHA1
2bab0e22efd08a1e233c98e332da57e4d08b190d

SHA256
abf5ce32f115616e75624071ff0cb0e5c872cc06065c6eff03b9cebc8a475bd6

SHA512
d1cfdc8791dd6abbc4b335805bad023ec3c76a0a34029db518c1c42dae2d14d0caa5498aa5debaefca6822342cd600d58c2279ca69a72ae8237241f00b36a14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a825b8cb7f884ce95c4d87fa398af289

SHA1
b44bd37d4d0dfa2d72f5c77d5783096d4ab0dd06

SHA256
ac92f40677a36d0e5179f7fececd72ec99a67cc8b1b68a44cea4ea06ba224455

SHA512
234984c4b7361c8d3243477ed3819635a7de467b5a24f84edd1419a3bba81ad9157fda8b44a64ad5872cd556645c1525cd99c87c888a21fe90fc619ec2ff8c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b32f5d554af4e6466d671691d273033

SHA1
6d3c7350d9c2398afed5d3c33c6e9efe14a9bb0a

SHA256
edf4e15fbc0b59c5364ef1d04e8e1ca020c25d5240569419d619b2c9781c3dd5

SHA512
b052fe9cacd5117b4def4728529d2420d22a7ab1b187c5d9b598a6666edadd74488b5700104e786242112741423f297a5d5b72dfd416c5f8a7af27ecac2f09e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db4982949c4886c4c366e70f7d1b569

SHA1
2758cefd6b4239df1f71c009fcc682546f53fdc8

SHA256
dcac8642e6cc2ae03a96f98d84976ca4ff6335b5ee8ed7416491802b1239e3fc

SHA512
a94f8509538447b7d29f885ffc00e6e0e9e951c3db255ff11ebe854d9baa224d06a03e8f02a3bceb2141b49cb351aff5f9d58ae7b717d8f14134e945a5f47b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7565b274e4ab7c610348594b8956a358

SHA1
0a88adc6a51fe74e23702cee770ad4001da1c6f6

SHA256
33a629beb9fcdc944e87207e1e47026edb881b4dba59ac587d5b6056345d15b4

SHA512
f445021511cd03e2ee57f8d68c645548b40cebf306f649b13460a781aad395b181042686af575dc7e66739604e93db51ae0171f2a27e5372d4111af9226a88db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3453e01d0bba9791c8269014682aa890

SHA1
0d145cfc7e502fb0b2c5ed76bdbd342671973c97

SHA256
91847ca80222493048423e58bfc97003de3b7e50127b086207a0e7556ed58897

SHA512
3a96d8a3d0103673596c8b796ad3c5f56e7550f967ab2c7140219ad965bdca296b2078f610128268a573fc934371a9511a28cb9850f594966916a32fcd492f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ee8af50d3516e26e0abc4812be61ad

SHA1
ad3e0c8ded07567d8a09089da0c0d3b722ef3511

SHA256
315fc5f4c59b8d157ed6c721a3c2dcda9b973740436c5db1c7d4301f395ec8f9

SHA512
7f9f85488db41196f69c2da6063d1b23c0d8289268995c32c42ce2982d5e051f1c8455bb6cdf3139c2edb08c9c2a651a1dc5a44b786307f9093d20ff4918501d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C61.tmp

Filesize
45KB

MD5
dc38d629e51926a750b443772d7c8c65

SHA1
2868765523e76b2e6706f18ecb665f4631a00d00

SHA256
21a98ea45d4ca76fc03cd769b01345da379395b41295e1506644149d0a378883

SHA512
beb8198332e8771a0475a925a4b31a8a80df9a04dc889442d1a4e024b1b66709acc3e347d50af1868d5d0c351d489cd454fc2523f752ea9dec56b9a9d6048ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D3E.tmp

Filesize
57KB

MD5
59ab7c1e24320a01573c30890f64bbc1

SHA1
962db718336e59bcdc21cbe0932cd67d019aff35

SHA256
b30b20a80cc4acb948c0047eba140766c7450ee5935f02b23a55c691abd14c05

SHA512
2f7b6abdb31f345ebc902d795fcc2e48d51c8f99ac576c0ec28fb50b33c3392c1cfc160dd6ade423896918a813d547de55f1496a55fbf00ee82160b3b57a472a

Download Submit