152d54cc91b578a483fb548c81434e02056f5df9ffea7df27335b93b15315cde

Analysis

max time kernel
0s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

553fdb7a15b31faa661cde78b0bafde2.html
Size

85KB
MD5

553fdb7a15b31faa661cde78b0bafde2
SHA1

b11e250db87e841df5cc3f14b9657c86e70947f7
SHA256

152d54cc91b578a483fb548c81434e02056f5df9ffea7df27335b93b15315cde
SHA512

8878c4623cfc86a5ab603f57844f08d7de29ed96625c3ca78588564521029705b588019520f1611fab7e79457b2354354d3c0a5fe5684d2b38a908e90c37505f
SSDEEP

1536:z9DHhfaWb0F1Qe7p6wCbyzyM7Tg2ccPCIca2eHjh23jA6G2quitreNE20yJ6cuW8:9HhfaWYF1fp6wCpcg2ccKz/eHjo3jAuG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A9680C1-B0F3-11EE-93FD-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1300	2976	iexplore.exe	14
PID 2976 wrote to memory of 1300	2976	iexplore.exe	14
PID 2976 wrote to memory of 1300	2976	iexplore.exe	14
PID 2976 wrote to memory of 1300	2976	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
1⤵
PID:1300

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\553fdb7a15b31faa661cde78b0bafde2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
f7444dd0a0521633e2a86097f3c0650e

SHA1
5ccf236d10baa3742756841fce5c4cb150884243

SHA256
f978e47672c9123eb7b4a2100b8206a40187c2401291187751f18d342a3a0fb0

SHA512
85a907049548458d317e06e4830d5d37eedfba6161beacb57b7e7958c2f05df1096059e6472679fca42452db05d0d68dd5efeb6d40fdf507469a8e6fb2d16050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92bab01763ad7b120e9cc5a0296558eb

SHA1
960b2a289c17aba1aabb25276061c661e47c64aa

SHA256
8f1ea666451a870fd00c6cc8b0ba69a941143309fd2640d94de81ff1369f2cd4

SHA512
283cee3e04fb8bcf3e81a1accc54780b91e54ed40bcb5ee59668ff4ecca012e177df9b60c5ac22a6fa642f1cff6e0184cfbd651b69823867b7427b6968ec1939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fae4139dc266a8ab54f4be1149d56e6a

SHA1
552d1f54da8916c36368ec14980e6820b093b9e6

SHA256
23794da02ec60c3bc802c1b467a47c855d90d5cab322ac2768f7e586d061fec5

SHA512
7f70e0e2da8ceb858b58d314e05939d1df7f9b4693147254ade514148647fad5ad7ce73eb37d7450949e2d4c73251823b059b594d94f9d1ba8e6a961872af56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
000c6abaaa5afc4e2448a98b36f8f6cc

SHA1
85030b01307f36a9f35f8dedfebdf3b609e24631

SHA256
869cef6a7acf6bc2e18e5706cbcef92ad73f438703865b1888102bfb2ae1e80f

SHA512
dd98fc9f6bf532ed74527de4110291462ff230689c7590013c18802bd3ba2bb0f5508c67065354f0775687bf33f4fedb83ac5308a26b22c2245a9aab53a03e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
698f8dfc79406d577d76d0e3b9a69350

SHA1
3632b20eb3c8b6c17d24d41faf06a6e13797c5c2

SHA256
52b5884fc0ee28184ae65bac9ad4ce0e40731302e26cee6ee517832c6e2e30b4

SHA512
b30e2bd3b31d7810526dcf260293fa05552e2ae50bccf6d2232d84f2514673367b3a93377625741dddf74cd940f46400b78eb7b2d45a156a92e78ad481f4a739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a05d1aca265691299cc42f2256b7acc

SHA1
1759e218791d80b3707706e4b43851e266818b12

SHA256
01c3c80c5366b1c03169834bf71c2f4b60ee44cf80f01cf859cd00fb90d2ab80

SHA512
c5055a64ed503e039b5134a132eec7b9e98c3eb3ff50057bb99bb267b012e9f4928c05ec85dac591e7656b2fcf8630b529d2af75296b2e3ce79e45faaf31ed8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7aa0db763fe968d59d5ecf324188c70

SHA1
cabf58c783b5d5e5ffb7972bf2be14cbb248d318

SHA256
499811159aebf391981f5107d2b678d0041230122226d05477129074b6d1ea44

SHA512
43784686f9c7106200f95feb3267e29ab8bc9cb5629c714d40274c9c5e73ff3e38b81d8e113813d65838463e32a2111e6d6d640309af3f8403a7f9ce3d7be561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
990148a61d395b24be14a1d549c4c577

SHA1
f2a6ee0a69f29b593e5ee0b0158c715d364ea866

SHA256
020701a03de4aa41113221d1be9bbfa0ff9768df0e2877e598da0f294911e425

SHA512
521f642e709feed84373ee69da0c1b7e36f5bc6bfc5f61a320c2f05412485d5fc1c5d1c9ff782737ca4edead6c53951d2c38600d65ac45821bd317b59011b1c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1086.tmp

Filesize
57KB

MD5
1f811dc3d6948fdc4b3ba40fae7718f3

SHA1
befc9906f7c37b36ad408bae0783d270798790a2

SHA256
bcf0e660af220d8f4039a1492f241a78b43fbd189635fa6b5db8ae8085eb7c2c

SHA512
89cfde4c4ae767f2c3dbf2c18de6c0044b609ac428b7a12a24286442db9c63f2466707581c87403a3fca5d74550c9bb6465f1088cbbe348320eeff6d29de81a8

Download Submit