64936f4534859a823e54a0399838a8497bfdaf3c767e4c6919b6ab741b89023c

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b3253340165f765b956dec105216a05.html
Size

23KB
MD5

4b3253340165f765b956dec105216a05
SHA1

177c257508243ea3c7a81962f3e51792f130e135
SHA256

64936f4534859a823e54a0399838a8497bfdaf3c767e4c6919b6ab741b89023c
SHA512

98025e8d532871a9f420b98b76c424c5a028a5f86f5143fd92dccd5d187919bc50039afe6b951ebff2da6b48ea3f8e15d69a87d402899dbf876a883bc7c2a880
SSDEEP

192:uwP5b5nzAJHMnQjxn5Q/nnQieeNnANnQOkEnttVnQTbnJnQ6v06J4RnQNjMB+qnF:8BQ/W+v06kjX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA14B191-AE10-11EE-8456-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2044	2212	iexplore.exe	15
PID 2212 wrote to memory of 2044	2212	iexplore.exe	15
PID 2212 wrote to memory of 2044	2212	iexplore.exe	15
PID 2212 wrote to memory of 2044	2212	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b3253340165f765b956dec105216a05.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8310aa1eb24f7b0a8d67a96fcc73d5cc

SHA1
3da52af1ddf1de71c5b822605db8a481ac28c45b

SHA256
c36d4550564d632847b1bebaf679583a66278eb056ae5a302de2b0d6b5860e4e

SHA512
9cb0d434d8e36155f12e4df7923bf876276239dfeb9b970e5944a544fd5cf49c5e9e69f66cab5984d6ca726d2a0826685a0603d40d3f0da504988739d6e560ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e166958a45fe58ba908ec58aab0bb6

SHA1
797e1297675dfb9d28e7f4b90cd1d8d2dbcd1f61

SHA256
310f117adb56ec64180b2a05220f0a2ecfb23079127775ae1857026633eb517f

SHA512
bdfeefa77884da135d67fdbae584c459f8364470c4831aee6c438264d0bd56879fc32e0b6008689e6f94005706aa2dc2777b3eb8ecdc9d06b848be1d40560330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dc140e3df1d507a52191ffb131fde2a

SHA1
531ab9f9f6628a79582b01696fc98438ef54f79a

SHA256
08b791c5082d14401f3ce3dadd1500af7246b31787850e29a6cef86fa99f528e

SHA512
9ab09d2df28fa7fbc6a7e33740986552abb05cb674ffbc8bfd7004646362aaeb27f55200f9463692a7806241f9b30af5c521cc8f4930e2befb9a8d5a8847e494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
471dae93bba925afd36fba11d7037c4b

SHA1
9c943ac1cc8aa9eec3bd5c4a162f225646d88e79

SHA256
2f492cac79ae124e0fa627d89107c93217431716852c8e57c85c2daf43ac68bf

SHA512
a7594e03c395070b3bacd5e156c190be9fa989a1cdd2055d5146f15f57458969484bc71c688804b0c65a3d3e730654646d5eed1d2149c8a86131196f815edbff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41941bd0d4fa9ec6fa615858d74c004a

SHA1
20418140e4a1a50e0ed5f1c333fb53fb3b6459cb

SHA256
fc4aaa6e85005d5c8b1abaab2744bb470a7e0cc0c5d2a26e91fb9a01840167f9

SHA512
af877f1334de81d4e18bfdfb13cc4c5f9f67583861d8a289a0c12dc92cc1d56fae9f8dfa12b3b85ce526b0a05c37f3dba44605aa6a322ba58ec4201303650b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d6fb8ffba3d623e334b745b8639fb8c

SHA1
7872222806004a1c959c5191228ddf4bc6a7ecc6

SHA256
0237f457ae8ba7dcbe97e3880c679d6051d5d954d34ead9ce2a60f885e753176

SHA512
cf2402577f67351d89e0d413c72912a67611cdcc19c30f35a1388d627de7abd5e0fe905d807565a66ee5a3a9e42baa06622cbb78d510ed048c2bb2bd5ca0d127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62d85042ac6506ea3b9ea9fb47dc6d5a

SHA1
6703558d4931be55c436d4a9ab830e899e5b43e4

SHA256
c4dd9c5a31a1e70e59095e0c39824eb634567fdb9cb8837729a49bc123e866b3

SHA512
4a507ba619a9d9d38aa6904449ebdeaf732f4e8fbf36df16023a9f169c63c936f057582a74b09680909857c6907b3763cf31fa0a9844505446b07ee1b6a8a594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3adc76325073040f425edc3f9ed68649

SHA1
b181ad3111d61075c3f79d96e39e88b053a1afc2

SHA256
0ba4eeb1c38b809dda41d80536ffc35e0f78373e40d3fa022e3b27229aaed23c

SHA512
ab0a728cb3cee8c786bc1296d737ef8b999de4881503428da7de2e8bff1c21e79f7bf1b504120a6b033e09b8301fef02a0cd0c44c3fd294b8f03db6780d8e993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62d9f31c43c11186393ce2934f378f62

SHA1
f5012a9598ea27b985f10b852ceba1b7e907586d

SHA256
be0d250d677d82138aa22c1dcfa865ffdd117bed24782f7b4468f58ff7f36096

SHA512
0e48b128a1af76e1d69675c97dc51f79aeb28cf135a3c4c3a73713b0ddde0eb99bbf4d17d2b392b763d61e0a794d74f3a59e1672e5bb25cdc51aa8d42e84afde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25ae026d33d2e26a8fe2c294dc7b338

SHA1
76dcecbcac0fbf7e0fea99d84c7432bd0bde1d05

SHA256
dc1112084fd8c270f9a1294c4675149b7e9374a649ac6598ec547bf4817425cc

SHA512
f8e52f08ed58222c1030da763c5cd17a86b05fffbdc6d47b4c43cf233e0addec55a86c8a9e50a1b45d1cc37bac1707cbee51c775b2d49db850ba461d5e8b2409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
776beaf8c2ebaeae955bf4595df4b934

SHA1
2e5fef41afaf626957ebe226ddc8e4305cd689c8

SHA256
f14b2ec084251a30e01c00818a138a771030c2750df4e8873356ce3a26c8cf71

SHA512
b492979f6f920fb86db366f0e358a904318563751fceee6eef8619c674070d9ccac470dee8eac4433063e2444637ab5d6b73353f5dc0ac52a3d76ca93e3648c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1c8c24501c8d7e7a1a18aafcecff486

SHA1
f6af358c1635c795746f37474fcc5bf5556751fe

SHA256
ed397d93ed83e8add9d052fbd43e5eecf3f645897e30a82499f22eb63bbb2687

SHA512
8b8292d30938773d32287e350402bdd50e26f71e1cbd3cecb5a095bcb094be43d170a366290e7f88b7d888037eb8cff5e8a508efab01c5c16d4ae8424c179fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
81b2122ef634a16ab09358e46a414bc8

SHA1
5de131d16c817293201103e1fbb6a295a269d34b

SHA256
117a0680a6cc2605d7336538da658e2ca25065274f6fc5aff981f700dea66031

SHA512
53c2d3bb58b5108f3f1218f7e8161de82b68117b65717e1f051d0de4624167157423488a62975dfc73e58d0e405fa9e4a54c1789214e947afeacd96efb4642ab

Download Submit