59b0a7764571d716b6631a13a61ead18b91140960928ad9484095f9340a3550f

Analysis

max time kernel
0s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fe547bf041c0815f30ee7c19a98f2ca.html
Size

61KB
MD5

4fe547bf041c0815f30ee7c19a98f2ca
SHA1

541ee3f4ef8ccf05a7abcaa618153c81b1074489
SHA256

59b0a7764571d716b6631a13a61ead18b91140960928ad9484095f9340a3550f
SHA512

83715b516732ee500bd0492e43549f8bc5cae7cd7b7e442cc3242decbe32b358c0aaa3220e8a17a4098a5c44a226965dbe1dbbf38e208e1373fe8fb14e77b3ab
SSDEEP

1536:BAXjQb85T/rsq29lyBFvSKSlqhhj4kVhD7KkmoNRQk:6/gq2PyBFvSKdD7/moNRQk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC108CF1-AF87-11EE-834F-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3020	2980	iexplore.exe	16
PID 2980 wrote to memory of 3020	2980	iexplore.exe	16
PID 2980 wrote to memory of 3020	2980	iexplore.exe	16
PID 2980 wrote to memory of 3020	2980	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fe547bf041c0815f30ee7c19a98f2ca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
00dfcede93e66b869f9983f1dad60261

SHA1
e5d6162dd717e0b8b1b8390e5ece02c9cd7ac02b

SHA256
fb7f68aa89364143d5d56d8dd0b6f47c84f7b8337ff89b7644dcb4ffdea928cf

SHA512
8dbd41420290ce018a9f1359b6ead95b1408489ddddcf94c5b5f6fb2fcb81f52a7d1457e900c10efb7b92af5fcc06b6cae308444b79dee1421ddc4a890884f94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5c23a2a48c833b310298198871651ff1

SHA1
36b003f6769a0a071fe5d8761f2555bba4874af5

SHA256
073c36112db0d0cfc05344fbfef46652ba51e12af337581514034d177f379a2c

SHA512
18ee765a3da5219afad88b1f6976dc2931bcc9c8f65586518d63b486951c3f517ed6383523214ae5337d51e5a4233680d1cb64621797245a2191b06cf0a126ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1679184a47bca05789ae5694a4cdcfb

SHA1
d782e9583e6c68a9a3ba950befded414f73ea066

SHA256
548ba993044d0b4ca8460bb69c9a1739382e8371fec460680e975be8c90c0aad

SHA512
db311a35a96927f1501ad84d1a73151a05a44cf20fe9fd369fa9db1ae657be410117791cded482cf9d52e40fce527b06d75899c40f7b25dfd47622b5014640c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a0b517206f8734ccb27d5be21dd62e9

SHA1
f03fcb6d8ee378d9755a33628dc15f0fdd975a26

SHA256
0ad1601a2b59dd9b9dd8a7f722c5ce1758d824bca95cfee2dc0416e4f33c459b

SHA512
d48682e619c2d156657654ab560a59738ea546885e0a183199b24c2155684c1495a7e131ddb4d1fd85f5c9b19c35c9b7ea76b87a5dc9581513ddd45f60230f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aabc0b72e3b706b9b6a470cad8de732f

SHA1
10c61b23c4c858232c6a5f77a311be5b7b25969b

SHA256
1ae7a97068b93b6c543c74b6b95cf3b347d494261458aac25299a14758aa894d

SHA512
2631aaa98bcfdfb80a6b2d2c5dfb01bb131607ed6afc920b151c4492348fa8d3eb4a64b95f0a2731af806d7d8d8cdcf38e452417cedb8c4c492dccfe328762a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
259be9cc7e6ed7bda273978efe7dba99

SHA1
201c3ff88bfa2c6bc3a983a0b80567986a633ceb

SHA256
7e3e6883866474f85964edcf49f70850218de26020194707537f8ff253604111

SHA512
97b7fbbec86803362d1c0ab65a95ed7aa86e37441eeccb21c09ddaccc5afe32e07d07f9b0397f01172bc06555d9278d85a66ca3ea3c2e0db4f4db84bdd5dca17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
054f6f02215c89024ff83b54343bc913

SHA1
7e0b28a2e3be08ebb9659c92718d701940c32950

SHA256
17207cd176fed9aaef75a9aa92c868747ea677fea05ff7e75c4fa49a5af74485

SHA512
c3ea9fc779eeff7cb434c13a7a92b2e68391667f82e91635abacc4f2fafb52529da628bee4856524809d7cb7faa95f975da20f05c3cc622f2c44504317edc8fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
542db12a8475c3b1d6b5ad3f6502cbbe

SHA1
9b53e9fa0020a2aac747201f12cb25aebe699fb2

SHA256
3f5cbd2ec72e66d82904d80bf73552e70a313bf57840fb3b5a9a62b85357a344

SHA512
35f7bf867ac72c1cf80addfb26d80243ae6360efeb3687200972ff75ba38df9b076c168775ec90cd1ca80d5848cdfe01738ffd4e233d046f7be05a1f89b05cc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a44caf0acde3db7b2e43eb34a253abb

SHA1
33d7a43ae3c570223a49edcf8487f47ccf6e6d1d

SHA256
a408b109b86d043110715865b07c8dc6fe3b8cf89844f2c8f48bc3066c1410e9

SHA512
efacb50b612570cdf1db070561f018f4b6b5877a1510100ead0132a1703c6c520d6fe1e914f2779b7f11c10320332f80619f3a0ceecf3333d53993ba50117722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
058d48453c4059c521b9bdb2558d5f69

SHA1
2dc4fb87b4d4e5e1e62aea3d5fd8293c307f31af

SHA256
b0a6240cca74fc9da8786494ca19952c643a4f0bffd0e168907b566ffda374e5

SHA512
157d90681e2c2ee5ed9792d786cde0e3e6f2c3e4f874969f4dbfa8fa746782ff026d82b334744aae08e130f04c8efa57edf63398bd224bb2708545fe19ebc51f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
823d5d27e3bcbf895c6f8ce0111aef87

SHA1
2cba783ac1cc5ce77e5ce9305143aa13c25cf7d6

SHA256
b38d878911d6325002dd0a4dc36a73f1c3dea27f4e7275e9ddff8e94ec8b6f45

SHA512
ec54384c3c25d7c38967862c15c1442ade6f9e0f2d457efa26a3b85cc485ba33eb66e50d2ff66425d5d91b91dfc97338ff4c5da4ac53b1bfaf829536de710aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6212.tmp

Filesize
49KB

MD5
39b1bdfdc99d48d5a2662cfe982c5c74

SHA1
3b93971aa93fafd3d7bf597f09f00985ca4929aa

SHA256
c90583e109c3022cbb8c5a8082305d691f5687f70dbc10a987899cb603cd4368

SHA512
b0d32cbfe3a06a89bf1fbcb7fac564070d3bb18e44746b1910651c596abd10604a15575cb03d1321efe8aef55a6787e78217298ba21dc27a3a369001c2d910cd

Download Submit