dc2c0580d9972ec520b8c9ecd417459d28f774e3ba2a92afccc924984301590a

Analysis

max time kernel
0s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e90536a0545b814b59f120d3835dea3.html
Size

6KB
MD5

4e90536a0545b814b59f120d3835dea3
SHA1

c0512c91d04c39e1f1880b5f8e218c9c3b77d411
SHA256

dc2c0580d9972ec520b8c9ecd417459d28f774e3ba2a92afccc924984301590a
SHA512

d9f2350386971d537e5b414d8ad2379e729cc01de12fe56a49c92a9bdb95e24086ca6dc1d8f2ebfb6c234a0bfc3d6d8b6923570f06f1482cbd46cbf0e82650c2
SSDEEP

96:uzVs+ux71VLLY1k9o84d12ef7CSTU59cEZ7ru7f:csz71VAYS/gb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D745CEA1-AEFC-11EE-8C17-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
760	iexplore.exe
760	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2264	760	iexplore.exe	16
PID 760 wrote to memory of 2264	760	iexplore.exe	16
PID 760 wrote to memory of 2264	760	iexplore.exe	16
PID 760 wrote to memory of 2264	760	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e90536a0545b814b59f120d3835dea3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:2
  2⤵
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac664f86adb98dedb96a371cef7df1ec

SHA1
82cfb62fa79c03dbe6c70cea0e4194ec858fd74c

SHA256
3e63e888f17e84f55e8d82233b30c09d88662643f881163fb70c10abd3383c29

SHA512
863cce1c1abecb23685a6f7bb896cabb236f5c9b91a192f29a34d27808d5ece5938b5a811bb5453cb2268178ada7df581096c63be6e4b1f8237d6674f6b92f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbdfd93d829c76cc188197702a00b3d9

SHA1
918f9f242878777bd3c3e9e775e5d92c6b2356bf

SHA256
29d1ad56d6b1df8e330166393840bea0a6e49c0d26fed7ff04d3c8ce2c1c495c

SHA512
a00ab7b0cf3ee35aa78509d1cf54015552382c8661071a0c731c8d386cfc456d6770e64dbfc72c4ad40deb5ac2340efd53aff0091fba6f4e3b4cc77ffccb6e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3783d0c6338596ac82b531fa5905c4

SHA1
fdfbfe34cff7f9e67fe7d47b8f61c47c831e9e31

SHA256
50fd7a77ee4c096e59baaafc140908b7af287441bfc4dcfddab1fde977052893

SHA512
5a80633576544aa5b9f9ec2c5ab065b11f364148caeef3d79fc2f29cf052601edbf16918312a2c28bf3d15562d4a6bd875ba8bdb676f66ac7c4dfd25904fd3e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a08c3f4f36c5f6ba07b60f7a030c4461

SHA1
3dbc833f6031660cf3b5de73a23b9cd1164cf381

SHA256
27355b9beb8d689a89417f89a2b37c6196d5f4d70edeca4619575b78939dac6d

SHA512
f2144b674108e56cf6704de77dbfeaf02fdaa6bc0d4dac94796766c76b990e9f91a81f5893b0d714388708bbbd12c93c7a767667c188750fedebeb6148baaa96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a857d295c9c0ab534aa308d52a74cb9

SHA1
c8aa9f50b1aabc0f758e263fedb9fe9b19986908

SHA256
15cdc5bfdac9b3f9d3d3da6d0fde58caa0184549919f981f756aceac5812d534

SHA512
b912849d58e0449a0ca2d7ccf5b87a0e6070c5d31d2d98b4766e5ce311ca218e3191276b01fe16dd91682462b139f52ae08659eb72faa1b11cdeab11dded916a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcf9251927a613980a57960f11a9d819

SHA1
281882ae868c4d083208166226c422ec1874dea1

SHA256
04c65ac97f6272b8d387cdbb6909808059c149557ef6bc12139a74e9b41fcd00

SHA512
994dd51424815ba7c350ca16da9b532e1262acb1c13ca22f33b5c5d4be331a8c2cf8e9c074ae0955f8e9ebb81f1c3efe810cbed2dfc1bb68d42b643370de7e99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
275d4d3d6a18502867cbed773e1e9ed4

SHA1
fe635eec615af20a19d34a31887c7e4e60f2b1c9

SHA256
aed7d56bb6345fa5279e9f88c867a296b518fc8437fdbf9a5e3673e90170e08d

SHA512
3a1febb42bf83531e44c6dc9358110972da6a311e9b303c115489637662dffffe3bb9d004224ed84b8b36faf60e00f07ae7eb448c37dbd6e66a10a4cc84e7f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36c09b5def3430156b455905d6f30dc2

SHA1
ef7fe0aa2cca8c605b452c9ebd55feacd81befc8

SHA256
8b668ff6de8ad4efb0b57ffc64554292f467e02e6ba5c147e5926ac78831a50e

SHA512
07414fedcbbe54763fbbf6c9e1454d77674af6c98d84b6bcec3c8d3d47289bcdc536e2e82aba5c7029ffd6095b4b919d425dd25f60c8047cdf807b32abd2df47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29678b56625a68b73d83b6dfea52b276

SHA1
281f56eddeffce271468ff10c7027125d6dc4164

SHA256
52b3690c96a4778a4090d7f25fc2dcd799f364db4c4a1027f7cf2ce2974f930e

SHA512
e1ea62c496e240de37ceab5806006bce5c5bb1093ba8f4817b3ddf5f732a7b103749e65e4ca2805681c6b2538e57045dfb8ba5142fe27bf1a1d20343ca63c0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c37260696e36fc23811cc66b622c11

SHA1
e9f283244becb9fc983eb66608f68df5e03ad68e

SHA256
0e5bc44970a1ae63b6de92e2330ae18499c418cb5b8219c7d0aee65277d44ea6

SHA512
a86c74d5a840fa7043ba486b0fce095dca1e6f57a41784a9c8d7a456ea44de873e851c5731ff02600158d4aebc4dd6792431ab8059075e013f9b83e0c25ba2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75290e6da89a03c9053e39ceb9817ebf

SHA1
debe5ec97e85be08796517316183e1b1e26bfbdc

SHA256
4120751b328f3d24f3ab81dbd367db03310d6d3f6e465c367ee5ebecca77bec2

SHA512
735cc1b71a83142a8705630be2ccd17418202ba3847fafb49d2ff6ae2dfaa525bc915ac66aca5c95f4d1eb65d5408f760808f95e141acf47c4ec0fd801c0a37d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4c5db17fa9571cf64f092cff5239574

SHA1
eb80adfa6c5af261d521450a754769d7181ed5e4

SHA256
6e8300d605ce86e5ce86857d1bb0dfb1eeadf1cfd87f41c37e158ba16834ce84

SHA512
6dc0e278fad028108cc67a1a5822db587e45092a3784519735863157bbf76361c58dc226665a18fbd2bd66ae5beb990b0841359a1804fce763e16fdda08f03bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c2d06ea1534c8631471a340a209208

SHA1
9e5f41ec3ad376467b0f197f87ba0721a2b166d0

SHA256
5d83b96f44797cdcde921b4af502fa3f778b8c17555d6ba8989fd4a9a2714d9c

SHA512
caf64b509aa296461faa812816346e75ab448ef73a20a40b2d2166fc52b3648d6655c03dcc56204a61e3856a2bfe15bb7c313570dfae38d414bdb54b6da24cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0aac562097b729620870239e71e0f24

SHA1
84d3ece54f3dde3b8fde20f41a95317edd8d9824

SHA256
9a5bc2958eafea32d8a94d711c250196a4ba4511ae2e5e1d9defd605b59e77cf

SHA512
14cbb7bf6ebea144c9d2a28fe92c518090e8588c175b19418c3d1ee4e6310e8317de75988c6e0fb391c944c376c07b8236b5d5b57eee38b23f9ccbdbd966cfa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E0F.tmp

Filesize
29KB

MD5
ea0534fe4f9adbe81fd699d8ed722de9

SHA1
7748d82e932b477f4a2ef2f0f3b2b5d3dadb1af5

SHA256
369073dd061c92be5c1eb8ef230d58c55afc14b235f4294652324b588545d8df

SHA512
df82845673556ac527afc022af4cc2db1cac35f4e4320252b89efd0b21f9e443b20938b5f7a43ebcc285b322b61574d62b909a12d0df32edfae34300861364d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8EDD.tmp

Filesize
35KB

MD5
dbd25ee9064fb2807f740fb72dfb530b

SHA1
00a0769a5dcae8efa37539525fea345698f5a329

SHA256
4d4e61d9493c276fd7832cb4b261dee99b0060a654bad8a303be704e17d837cb

SHA512
9b890204e1825afcba411ac5bcdf0557862e57dd679894a23f24c177ab6cd17c1ac634c7226cebdb4b84925b89fdf3dbdba1c91f78069cab781ba8b447a4c640

Download Submit