f8a74673387ff661d757b707de21a16ccf58f2cc1cb9f450bb47bf310788f647

Analysis

max time kernel
0s
max time network
5s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5016f80a9ef9d9d6c9f493b2835ece13.html
Size

48KB
MD5

5016f80a9ef9d9d6c9f493b2835ece13
SHA1

29f22d424c3b6401c1c8525062ab65906b4637b0
SHA256

f8a74673387ff661d757b707de21a16ccf58f2cc1cb9f450bb47bf310788f647
SHA512

139ef76f226aa528c1b71164b6cd26b3c095855ccb65c065628fb94de35530cc3f6a8aa30841131337a4e33a5b1994c589f8a1d787391cf7fed6aff6551a2aa4
SSDEEP

1536:Wly8OdhdQw0h8Y+OyT+xATF/L2UxHByXgIYosG:WltOjdS9yT+xATF/L2UxHByXgIYo3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{015D8ED1-AF93-11EE-8CEC-72515687562C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2016	2360	iexplore.exe	17
PID 2360 wrote to memory of 2016	2360	iexplore.exe	17
PID 2360 wrote to memory of 2016	2360	iexplore.exe	17
PID 2360 wrote to memory of 2016	2360	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5016f80a9ef9d9d6c9f493b2835ece13.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

Filesize
889B

MD5
3e455215095192e1b75d379fb187298a

SHA1
b1bc968bd4f49d622aa89a81f2150152a41d829c

SHA256
ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

SHA512
54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
17KB

MD5
c1c47946a09d4be8a6e866a75b9fceb1

SHA1
033da7be3e841ca6e8219e8b6994d91477838851

SHA256
3396a623288a09eb647f00efa514af0f5a189f198c01b5eaea7b724e9faae226

SHA512
cc72bcf656488373081b95f2aa79ecec28f5c453b1cdd1eacbc0ccbfe79f5f82bdc5bf8df12060d633995973e6a4306bebe5959682a37668893f6daeb6ac43cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
27KB

MD5
2f92db7503fcecc911b6bad15010367f

SHA1
b36c7cda2527d1733fa7d1cf2acef7616170a56d

SHA256
dbfa4238d676b6684652de43ea9746bf588c9596cbb344dcd8c5eb9fe8b4a9cb

SHA512
1df5e3ea1800607235788e32b9b47cc2bce8e45c7d2b6df8edda75835711f5a148cda601bc6b3c56af5e4244d6f7583c602e822bd0dc2a976f28ae3134a463d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
00dfcede93e66b869f9983f1dad60261

SHA1
e5d6162dd717e0b8b1b8390e5ece02c9cd7ac02b

SHA256
fb7f68aa89364143d5d56d8dd0b6f47c84f7b8337ff89b7644dcb4ffdea928cf

SHA512
8dbd41420290ce018a9f1359b6ead95b1408489ddddcf94c5b5f6fb2fcb81f52a7d1457e900c10efb7b92af5fcc06b6cae308444b79dee1421ddc4a890884f94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
214626dc1d199cebfe6c3a7f373b01de

SHA1
acef1aa44b9c3688c6fb7f7858b125d17588d501

SHA256
956663d874a352bd87201106dc776ef5eddb4cab278bce082e33599d180f6d05

SHA512
1fe3a717e89ecb6758a3250eb46ea78254d6f00cca211b4d2d5b3fcf670fd124b099750e734ea6893d6a2f4bb1694e328dc296a506f75a3be35f426de586188d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24

Filesize
176B

MD5
341311129f24a66eb5157eb57185b473

SHA1
3f3c3ff3859cf9c708d9c3264525f6184bb925cb

SHA256
3d878846563e925ceb0555be0adebb23eee7026a6a70a86c639583355c471ddd

SHA512
a7a77d7f34f263e7fee8a103b3ff4ba5a4729cec2bcea793da9a6612033f2cc4f218c37245009b18135459ced88b2234f504e4a45084cda1caf520ae6be648f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7120ea0fdae0928c305ef532831cb76f

SHA1
14a9c61813fce8d0e2b71f67dd9c99d4d5aaad54

SHA256
91ab9c5b68d7029a346095d1bd83296a713e15eab5aa824e4281219830996ee2

SHA512
8544c3b2e60e2f6c67944efc81e9235a7f0ca702e157e6d0aa53c89aa56cc519de3271633b16ba6d33d677d521e23c140ead068b30f9b5210714072fab06076e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a25e7d65c34e1457befec7c88bb928d

SHA1
0404d443ea1e4e72c9c8f2375243a0c2c6afe130

SHA256
08390ee0869d075979d5b9d150d44035382e2e6d5872c1b62238163602d95cf8

SHA512
aab17edbca2ed349fe684e49ac61b072f785d93e5e6a5a0c58ae8ee35ae5f06b37e70341ecb2b96307a4c5cb3302abd7c25ceb67a005bd33c6274a3fdf07625f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d5aa00be0a93254eecd1c94a2bef06

SHA1
9f1feb023e702c1fcfc7acd30fc2b03bf03c3fdf

SHA256
2a70daf9da0d85afc9e6752c8431e1ff78cdd648520a825c526513b99ff55ebb

SHA512
c810057962d98b14a5cc65a5356dbfe490eb7e8a39310f98ee200b6fbc1b167228f5c05878677db5ba222c5016e6d2dbe4154624b143bde017fdba1d233e9f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4025488e0874f82cb40aa117380994d6

SHA1
8c37b991086dffb063bab6e50aaa76b649776496

SHA256
dea7ed3aa58d51487af9ad11c58225c3eb49185fde7773dace4a2685bc0b3c22

SHA512
057c76a57b868986d0a74f52d1feeb7b5e5e276faf1c0f76da05c3cd300ad9f3df35baa72f2268ebbdcb2de92ee0ea2fb2524d602cc53b81b2575198ebabb423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2c1ab8685d4dd6d2942ed0402a6be16

SHA1
886823c96285ba7deb24499b54aec9baf07bc8a5

SHA256
bfe6a27d774f16e6fb5dabe34acee6c0e0fd0843e15427e394702df076545cf2

SHA512
cbeedd1862be85236c5aa56f1275701f3768e1c82c3299b9babaed43831731dc618c50b852feb33240172f1d655443c0796e11300bcdd5a80ac8bc5ef9d4a230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da396e6cd040f9218507ef286490c8f7

SHA1
d72a2190498029a0dc174331b45e3cfdf41b7605

SHA256
32ad7815f53a444934d40a8651e63ea8cd71d1c0d19e5fbeeb4be65f77a79b31

SHA512
1a0ee38ab807b9b6eb4d2e281a8fab482f32a62ba9d09f5630ee34ac57c1d77c09311a364fdd74d33761080febbca2ce4c53cb8e08b8707857938cefdab5bf09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
010bd6c3f5baf8e4a234a228c790aa4d

SHA1
620f9d4ec9230131b33ee835d3bf0123466cfff1

SHA256
b731da0572cb6b8c9512e985705ddc345fafd83ccb7af279079be3137ab39894

SHA512
db0ab147e24cc0aed8e0964430344e3a1efd0efa3066bc32fcebde0e01cd1ae9961a4b88d435ebef147586945b2258cdf8713e07db65363c9d642b9d82506b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc75b99a8d85380a66c001f0e631b54

SHA1
cc87af0cb3cffb1b1d2bea0a7d2dc658ff56dee1

SHA256
9ad6e6232b65bbccf21cfd5faa1b9a472815d7533a0b2b6615a24418454d1027

SHA512
9b645f5e407b44e97e3d6dd409ea8b7b3c4658f41c79a81051bb97609e9bdd2f8d83dee2fbf11a0b5ca0424d940a2a7ff1c66fc3553cc4c3dc3efde3f0823c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93179e373bf7c4296a4f41f4c823999c

SHA1
88ca591a90734b6c0b1cd8fca1317c9bcae1733d

SHA256
87d12a4636c78f4a587ed1d7c45b9152d155c92500b2a2f9c0627959ea2535ee

SHA512
7151cbd901f45446367715dd5c1e5e2fe15bfbb63326a80f1908ad480f138c17f59a1f227211650335ce30afa97f40adcbcf51033bd3c6376df68e2f7d068269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1af5a2c417b31a9c510e26247f15372c

SHA1
0fee3808dc5169ff77bab5c556cbe078eac41414

SHA256
b206c3a800bd7197d3f88f6389dfe91c354e4b5c68202e4c77ae604805ce60a8

SHA512
e3917b32c5719382d06ce7dbbbdec7302d85303c305fd53c9acde976888fd0a75c635a45399cc1856b196816e26382fe9dc3c26d95fe8d63b579efed23c4a355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
2KB

MD5
e52f617efe9992c48f589b509f293a9d

SHA1
4588136b8d87f9448d93c8e18bd5ab90b606c384

SHA256
a8b05d140c9bf963223006aa2209c2cfb2063f784ef70a9d1b14c52d24563a7c

SHA512
ca14cf5b0f4079c5c0dcdbe242b73169992f5bff08a1df0190a4e6927cb766750cc7c56ac7ad72716d673d21b0abaa4cdebb8e3033dfe77d38b2bbfb9ba429ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F1A.tmp

Filesize
28KB

MD5
fb2d90bf6aff3d7a9897d9d5d97c74a3

SHA1
ee88f84e563b3eb1da29825f79119e9205caa7cb

SHA256
53c20935193023bcd11d6c44220f7c73676a241bc016e5f7d335cb9e25f8a25e

SHA512
2b16cbce438cac6a93cfe3f3a22682858c5edd207fbd70716841c8eda4f3c93fe41a389aae1ec040d82b5f7fe4a935c1e534358101c58e7f7824ff12bbd58a5e

Download Submit