ef08e480f220301ad1dc1c46b790404b270d54ce0b6d397e497be74b03530f6c

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

76KB
MD5

2cc3b1d375b616a545a4368cbddea2cb
SHA1

2ada305f92f9a231ca853d1017ae81d833654e24
SHA256

ef08e480f220301ad1dc1c46b790404b270d54ce0b6d397e497be74b03530f6c
SHA512

13894d1fa0c2b34edfecd314551dc20705705a679598f21edcb5072a83d6335120879c1626cec280650be75471c3ca0513293c5c387fd2dd75a844198561a20c
SSDEEP

768:5xIwVMDsym6DaMsL5+Oq3CdVaIvRNv+f5AfpUxnHeob4f1u0eJwO0H+UJFIDgr0p:59v6nXw0G7Rw2Tgh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b2a50d3b84d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{330F5C81-F02E-11ED-AE0F-DEF2FB1055A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000d307b712dca3cc3e4e8fa9352a38ab08d17e3028830337505645ad4f575779c2000000000e80000000020000200000005c92b9ca500714adae2b432aabd0029e41ae9959f5024b5fe7e5de0c79dbab97900000005982e42506d7b8a9370209947d7b0c3b3cb66fc68e015cec89aeacc01cbce3bcb4d27567bf7de1bfb4322ee2d2f6ea7aa1af842dcaa013c3a588fad31e320f8f146ef1bc23ab4ab67b7ec5f7a4ed9d37dc1436f0dc43be2c230536bb294a704cb8686e8e3b4238580d5d6dfea796780beaff76eeaa64d36a1090b7c911c4faabf30a2107ce26f8016531852206ddfc2c40000000937e7bfc0abfa7847025f3d72c3c31eb1a93e10f6b06ecfc65a8dd66ca64a62bda52b7e74214c3e6309909f5781cacfbf64ee9782989f4067822bd5bab58423d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390596649"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca0000000002000000000010660000000100002000000019cbf2ed9d71742bbb862bf96aeac51b764a1f31ef15a5d118a6c3f03bdf2aae000000000e8000000002000020000000780c9e003d629c3a7beb32cdb87863cc7afd13c08f8da8887603ed3fc66c013a20000000f194ead961fee6f644a500f4752be1b6dcdaa9885445d9a6bc028bb59c1a3f0f40000000f5fad49441744439893f79620a76d214916a48d9741d2518fe5dfd33573399d02ed6c89641cbc4a46d692b12de2c043f4d3c05b17fb32bcb412bcd0adac980e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
924	iexplore.exe
924	iexplore.exe
1116	IEXPLORE.EXE
1116	IEXPLORE.EXE
1116	IEXPLORE.EXE
1116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1116	924	iexplore.exe	29
PID 924 wrote to memory of 1116	924	iexplore.exe	29
PID 924 wrote to memory of 1116	924	iexplore.exe	29
PID 924 wrote to memory of 1116	924	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
7a19aaa167634d5d56024ec77867e787

SHA1
6eb70fb420e0b3c525953ef0169bbadded081835

SHA256
22aa7f36516f0e6174f9837d877e851f1f61b70ddf899a3a01857eaa387b2b96

SHA512
c8d114aca8fea0e68a267a7c08a08d2952c8a8fd6a4849241602cf6336bc5e5405f59a5fcf3d6d44a8170dd2b2d02f81eb8f477b4b5cfc713bb8af66f9d01282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
788af4b707e89362b584b7beef1594ea

SHA1
7dad60dfd9bce5e33df40a052259c610a47786ed

SHA256
fe3fb459cd295a6fb7a2d08eca11a9fac69263b013890b30a25332e669092793

SHA512
3c12c4f83b78a47ec18d7864f4193924dd7214b1986e373d79c0ef43b5ba619e300b7b417faf22aa46484bd9b0db5b4dd80d40eff1ad440e90434da52c4b61c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab434af26a7cce89ed72812e2d93112

SHA1
24c16019c7fc866e15b816346c6a78d393d122b5

SHA256
b631b00f57e905eb8fdfb0aa171ec6871bf49b9de56edca17c42b33f7d2dd9ed

SHA512
d0baea22aef6c3379c1f59f016e034bfbdc4640c710ff4b2b8bf21990b4f0b3fbb53a3a1c506f32de1c5ad02e0e593d93f4f95cb639ecc136911bc441fcc0fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3482fa30ea272919c104cfd26f3c6a2f

SHA1
1d39b0d88405f545d39e8ee30acff6a4ea7f3784

SHA256
753f2f5c0c82f00434f06e25e292d3889b0b40592672cdc305e22bd4735346b7

SHA512
d6bb70ecb1d525b611c29f85e9e0e4fec546a755cb1db4e097a6ccf775aa1ee3fd6e05845fd16b66dd484225a651007e87ed0a97a7229bd0aea7dfdfcdafe507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bd00ec8577d5b45dbd8f44283fb4eb8

SHA1
c48ed786c598c6db49d7dcda8d3564ab69109082

SHA256
6ca95527ac6c916cf127c469041662d451ebaf886ed36531abc863963f85139d

SHA512
58af1f44f410dc736b45409e3a8389618850ab98f02f960275cf6d5b9b4877b08c910b613e241f49e7068a538fef389a541ff5bb13cbe0309d9f7d15e23eda98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583f126c13d80c7ab66c11ae24146ace

SHA1
572c0fbf403b223b1d334bc8c68d603057d5b425

SHA256
d73b99f659b92862e875f50650758b03143421e487cf4ec738ddbea2eb7179a9

SHA512
18490f7120abfb0ef34828657fc0da5eb5020bc6b4f616cc1e5331fff42d82c8158946e6443f02e31b9c25ef3c4c660a4f8f7b752ce13d206936169d35bf3809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54408a2f52bc783718501943e14ad44c

SHA1
71b4fe44c01f86153216ead81c7ca8a1f07b8146

SHA256
1b26c5355333a2c63ab4ef8df66065f3d127f0ec3001cf7c7699694d2f6c7cb1

SHA512
8180b7b86a78c4d388c493101ba11eeee5f103734207c89efb9cd74e0812ecb3e6313efc158237649ccec9dc0e6d8461ca06efd70c5aad1cd70080c97053a177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7527b15a37751d1e18c3bdc9eec2ce64

SHA1
321c0ef88667469a2118393f2c29502ed6c4d132

SHA256
4639f132cc5e3d1ad96d0973344738946cb55e337e662067723e9d4020ef9a28

SHA512
99682be8f004ab6bad0468188341955c453640d148247ea63687efc993e086bf54cc616b1eb2ec29e716897656c8308143b44f1498490b46b9d6294c56628e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b87ea3e21cb51dc2c7eced009075044

SHA1
f8a170ef33617891976775aa7ab863bafa3485f0

SHA256
2dbeea46cc87615cde62923e415ac59d56fc4845ca0200facfcfb7be5909f793

SHA512
ad06469f66ad8145e971be9e43e798485377b8abc93f5b524134b08ab6e330000e6dc43ca5407340474f8d3f353be3310ae55aec5c7144cfe56df8b6fa7c29ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddcf1d3909f2a222c0d07a942661f4be

SHA1
256469b2f2e37317b97a17a45140660ca325f04a

SHA256
7d64002e176b47e7f3e0ef6d461405502948a1075291f2b566c97334ea137c31

SHA512
6f24f6423431caeb1b54fc6388e06d5cb826b67ae77fd7078c941e1c928f0506e8e179e334feb496fdef1d2d17c6cddfac9ea2d6381e9dad3acc46943c7a930d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4D33E1QE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AE8.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AFA.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C86.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WEYSAB7S.txt

Filesize
601B

MD5
a61272accba95c065c17e0e66145dfd8

SHA1
0c9b66d17c429cf4cd97ce38d20a0c2ccdf8420c

SHA256
8950bc97f601dce9c1a090a9e7648c8972319fffd047cf4b4ec21cf1a1f3757f

SHA512
5e3366bb13ffe999119b61000447e5daaef6da56c5cbd8baaf0a9495b9d02f4273e5cf1ddcaaa3e1746795db82e8a35be3322708a15c153f526210d04d252f67

Download Submit