ddb956f0ce8c797a00d0417e1ff0b2240f57b0f8940c3ff3c894fb68c20128f3

Analysis

max time kernel
0s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

445832c994f177d5276e00bc2fbb4eec.html
Size

53KB
MD5

445832c994f177d5276e00bc2fbb4eec
SHA1

d14372e197786badc4808884073f462cb8b3e7a3
SHA256

ddb956f0ce8c797a00d0417e1ff0b2240f57b0f8940c3ff3c894fb68c20128f3
SHA512

46e18cd1a650dfa02ab5fe99ff18022227b01a9b90d63cef09d9c4bc0784c89cf568429c13bfc79ef982f0b775bd8f8691027ca0db43c66450e1b427b82ce265
SSDEEP

1536:CkgUiIakTqGivi+PyUzrunlYm63Nj+q5Vy0R0w2AzTICbbGoD/t9M/dNwIUTDmDb:CkgUiIakTqGivi+PyUzrunlYm63Nj+qa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F4655E1-AC07-11EE-9439-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2208	2500	iexplore.exe	15
PID 2500 wrote to memory of 2208	2500	iexplore.exe	15
PID 2500 wrote to memory of 2208	2500	iexplore.exe	15
PID 2500 wrote to memory of 2208	2500	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\445832c994f177d5276e00bc2fbb4eec.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c1cd3f8a46c3c255028f0840ebf8b2

SHA1
a539538a511011df8df4344880c6cda1860686e5

SHA256
195e0542190541c1184735fd415b7db2edd53be62a53f6e5cff4596b9500de46

SHA512
debf3f91b297c8a401c855d7600046cff768e2c88b000b4576c7f15b30a54e52eba60c8f8bad120a0e06ed0960a6549c411e4304c3dd887b84550c04fe789303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21dde502b50c72d98a2d99a7fd14cc3c

SHA1
0126cbd6bfd3f56e6b13619ede54d1e820f6e5b0

SHA256
d1b4cb888d275236667064ac1ae32609083fe4c1850f98e9905cb4755f16beaa

SHA512
7fad705af8f820fcf5853f14e8f537182f68ecb6aea37c52175f31f897ddd926b788bc6734a3186edb195674549d17613961703cae770337b57d0cfbf57d5954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26553db2af642ea74ea45a856ab41a19

SHA1
45df85925cd5914a7d7edff3847e434eaceae286

SHA256
c3ab2b1e164dfc111bbfaa1ad6d00cad6156b7da7b1fcc80707971c92b165298

SHA512
4d703863660f3d5bb627eb2e3dbdda46f8b7a298963eb633b7688c230f1e79a3581a2018686e79d9d046431c03ce86a58c66c15264444433434d58bf68c812fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0898c23f65828119c397cd6d267193e3

SHA1
f8016d78212f120f1ba755d6d71ed08a723c1ab1

SHA256
445f4f0e78d26784d863ff45febafe91b2d8b79e2e873e243ac2213df6ecb74f

SHA512
0cea98604cd70bf77a7adec3e62149c41ac32062f172ef092af9c874cd52c68142900611534dbf159ee7a21f1cc7768e0bc2aa7c5a12d58498a4b68fdb7c8e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7cfa38a1ec3845819062a5c657d643

SHA1
b6b599a737ce3dfcc4be8c799d0023458204dac4

SHA256
c8d3c7e97091e39f57a9e3a1405f55f4453bdbf16e39f28010048de09eed166a

SHA512
e1a2c5e7ff746ddd68b2c0261e4a814c7cac359e0b51a28fec00ea93a6bab3770d1a457dd557626e98c5f6fbcd3eb5a36ab11b7500f98a692789d401bfb8d49f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1fa0e8378df694a733b092091960f6a

SHA1
cc2e995ad59456c2d37b3d0e3a304da5d24ab640

SHA256
25035a50df0fcb619fbffaa50ad0a8fe3ca2c75a3dcc46a22c8e4c123efbf97b

SHA512
694eea640c761fe5a620866bbf53cc8eb9a43a746a5e8f526515ce350702c8356545ad9a544ecb7679ecda7ee72cbf09c905e60f1ae1dde168bafd02bd9f59e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC7F4.tmp

Filesize
9KB

MD5
c86e7b66def2e226809b1b0c8fa15158

SHA1
58166b788075c7957cc61b43793ade2ce616aa45

SHA256
79819c04854c0f8cbe59385a09fcb11a0088b6ffa7f28f625b69f7e42b986702

SHA512
6a993675f3deea23f1ccb759a757019dcc9806da25e5e90774f70f56c5fd7f562a82f4c2e3f54956341f26e59bacdefa26ac4c2a411dbc032878bb83a7f9950d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC92F.tmp

Filesize
14KB

MD5
46cd4c4576cf9b23d1cf17459468acd0

SHA1
a148702949d42d8143d85fed300627facb82b3c9

SHA256
1d16a8675dc8b0d74d5e5525d4cfbdb7de47c0821fbdadc8505506e881221362

SHA512
940e4066ac87b9f235d2e86d41530616d06bd04abdb8fed890b2718f68dce7c45a3a344e00604051e710521cda83415f7aee6167d1d0242bc9a09ead3e67f172

Download Submit