7cf3fc7abdf789a9cc919df88dd8d202be20eeb8024c680a35dab26a8ba85d60

Analysis

max time kernel
0s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TAX EXEMPTION CERTIFICATE .html
Size

2KB
MD5

c4defb51f6d92d36105b592fc575272d
SHA1

d60ef3867f5ff6c99f62c85a38c95168586837a9
SHA256

7cf3fc7abdf789a9cc919df88dd8d202be20eeb8024c680a35dab26a8ba85d60
SHA512

da2373b68ee61d1b6b35621b3b35c2ce8c41c9973cdbd35ae0b83d872887979d0d1844dba3c0b46bd0af02734b1fee8704db2ef3b255325fa9b1315c50540940

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A59686C1-AE6A-11EE-910D-CE7E212FECBD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2376	2244	iexplore.exe	16
PID 2244 wrote to memory of 2376	2244	iexplore.exe	16
PID 2244 wrote to memory of 2376	2244	iexplore.exe	16
PID 2244 wrote to memory of 2376	2244	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\TAX EXEMPTION CERTIFICATE .html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
32KB

MD5
8fe278bd8eac660d0161a869da96b8d8

SHA1
eac6f73862d89fc8c49b5331cabe89b6a57019b1

SHA256
e8a6de34603eb9e91ba82f555080758e480ab044ffa9c140028706f916eb2c0a

SHA512
b180b8df22e421493dcc75a2caed123f7c7756295f691579ea5c426c741f80e381b4960b5cbd6b5e87547d75e44ab654d1c4704fe34b4b743a57f334bd05846c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0383781b79b4b26f8dec040e46f48acc

SHA1
373ef60cfb0587b7fdc4f82188b92c8f7a35a91d

SHA256
1c545c8b75051df79a35a9315f61b95c4d8af22d627bece7529e443c36263a6f

SHA512
0551ab765d74636bea7d37083c59f7b870d372b858811d872375558c2aa4459d18f3eee0894f5b049b02a711648a752b7c395d35ba1eee11aee2db51c39c1786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0b40902977312ce13f6e48567d87cd2

SHA1
c763c6f1b37fe607deca51187f9aab9d70e76476

SHA256
552b0db3e0b9d37555716365715fdd4cd75abd86a6aaa7b8aee0da9a21735a37

SHA512
032b006954203a0d222ffd5051806e7079ec562a80051b48b2bb7aac8cef77724f609bbb4a58c3a8ee75e606bd09cb5416e20541a1de7b9bda055b1391ac1ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3597312c3f54e929d2dbf51840f0f81

SHA1
b6e49d79f65a42c162a3d9128b02007ecd2b200a

SHA256
d72ec8edbb60a09c6fe2898b86dff867c71a1fb72afbf894ba755ebfccf564da

SHA512
a82fdf79df944e60062ba1d4399fbbabf8a7ae745d48cd06acce0b6f1ae6be08db3748a05961dcd8017b1539bfc3b50b20ed35a87a5095c44150a19452801b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
585ee69e5b5c9703d1c9729d8a38e0c4

SHA1
7cb7d03beac7b93e28d120f26ee0f217db7e5afd

SHA256
c7416642b85a6e00560ce264aa7b0722680fdbaa6f08bcef63f351b55d2b9587

SHA512
7669ef64ab80be9f7905d88c81f6635b708247adb65024cc08b68c2f2fc856df5980c9cfa4c680a338200fe044470f94ceab0dd93c4907a32676214122cd8cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4346552cf143be75cfc96c6adddc5a73

SHA1
847c7f6c6373cf9b757b118271e3b30bc204d5a4

SHA256
cd8b9fba8d318f1a26352869dbda5c0dc8f9673c1a4bd6ed1449849c40300525

SHA512
1ca5861b07ea23c7e055ef5e4e034bf642afe0ad5f9b77f723e07186fc0e0b913fda3534fd5d06b44e7ca8176f9e7781ae09e12e24f0293a2b62da82944f424f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b6db4fa9421ec0133c2ae515f3375b1

SHA1
eefd38dc8d9ca73bc30dabf3a095842b3a6894f6

SHA256
8aaafd027837ca7b3472f8cc03127438f3b85bda2ac8b3d1d902079c4881f13c

SHA512
58ec8360756505a4a652597026bd792d88668c50ac50bd7daa5bdb9c444ac80499bcd4c36ce4eaad1bbc4c20f5a5045f858d52cfc1abff049fead93247ca97b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892de06a502a0068c74ddbe39df793c3

SHA1
a605444f6c34811ec1fa4544f6958a3a5ce4645c

SHA256
83fa7e1ba81eba8e9ab6106ec2b3548bd541e1ec92d8ead2fcc12080be6cef4e

SHA512
6965bdf5fc513bb38b2f06196fc49c46d9a983b54921ace7b96e9def49c144dcd77f13ec904ba2d802134c28d243bf1e859d23bc7ead6443ef7bd2c9bcd8916d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0dc98275906aaf7239e427f475b77bc

SHA1
214898625a6000b78b3f34c85a7394cf3f349af2

SHA256
234522b963a10b223d42d4a6f6c081940376a7716ac7a57e11aab07fff1e8e4e

SHA512
2fb42b61be3e0d87c090cc25ff41497e5ae0f5a0714a8d8d71efb4629c0aa97df840b14f570322523a22d4b2a181098a22d79da99082e15fbaa2066318f46315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93164f33aaf3675a303eaceed0820e6d

SHA1
70b168ac49921d8a788d68bb4678b346c06c78e1

SHA256
b4485680bca859c666d9716b41d82863d796bfa6c711e450d1862f170a99be2d

SHA512
d5ac219d754eae057b873e3c5492e184963cfae1a40a3fdbb828c5667f262c602d1794d79d40a33e9dd04be7ac1278d496ae12004d96449ebcd64dfe534bb208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c352e0965cca8d627e73ab63891312fa

SHA1
f4e6f479aa30dbf3d27470587ee3a75ac311b8eb

SHA256
3204b02c17d180634a009e1d5ae8050eeb31314479ffa4a3f9f594af7b353c4d

SHA512
adb69dc58155af4cea2c515733344e3d570791d1552c7d14f5940361377d1dee0f9a38f2a68c24505c83655569998f483f4dd388ff0d364b3c3cf714a4a2976e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e85144f347f62b02dce3aa067c4beced

SHA1
23994dbef7537e46372904511bacc6aa3b5494c5

SHA256
a8613152f73a251dc05bbabdd8fc54e22d72e2de1616b3125b8e69f22ac9d9bd

SHA512
d74bf2a1a898ae493a0d19906efddb0bbc267b9737bfc6e357b6790019f8ab6adae781ed5a016c808040c90b937d41bd1c8342bc2581590026978d4e5a7ec2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f51b90564a40b8a3aed43ebd945093fc

SHA1
aebfda08be8a03b620b7dab8b9f3d3c086c8762f

SHA256
2fd122922ce08c73d8efa1bc8a88e1bea216498a52ec19a79314dd6df0e80e50

SHA512
ebed10b0b073b1abaf0cac5a67ed77ae3924f4626ddbaaa2447ee93fce50ce3fb9cb73ef4279957dcf81bb032e792da46d1d74fd6af6213dba17fa4271d8009f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67d833ea43c80303f2688890b1ab90a9

SHA1
f3c84fc791937add11c0f19da153a831e3de44cb

SHA256
ad1c9020ce1ab0626962519452db84113d9572b7b001d592083fdacfe5e5b82b

SHA512
5e5513ceb62b0c3d447a13ff65aac8d43e636fc32fce24166e3c82b0e5e0a3ed04aa26dc28661b7a12958fe44de0475cf059d9958b374c52a74bfac84c70820d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E01.tmp

Filesize
19KB

MD5
ff2d6a4f5146d5284bd5494dc339180c

SHA1
7e01f077e9197c07e97429cf481b83e33317d537

SHA256
223cc2ac3a090190c000914857c6869a40354f1c03ea17e267f995fba9f78393

SHA512
4ffebfe487840d15c79cea663c76350c1fb45bf66e1bea70753118ce39a93a57c25ec4f007d683cefbb3f24c271e4bd05ab9cf42bbee0f3dfe66d15b1937807f

Download Submit