47b83f70af6d651f8a272fad0dad0868a1fa98f5259df6958e7416c7b3bbb0e6

Resubmissions

26-06-2023 23:17

230626-29vh2sdb7t 1

26-06-2023 23:16

230626-28586adb7s 1

Analysis

max time kernel
66s
max time network
146s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
26-06-2023 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

5KB
MD5

f933391632c670c1cf7fcdfce70d41e0
SHA1

8a45b536cbb1ef018a91672f330b8524ddbcdeee
SHA256

47b83f70af6d651f8a272fad0dad0868a1fa98f5259df6958e7416c7b3bbb0e6
SHA512

1a6f68c50596ddf7ba6f6ada70a7c0bfcf6b28260bc02fdc8bf248b0d8b8f706d98e4b3546edb34e2313808645f913837dccd0993697855ead64d431ca027da8
SSDEEP

96:PQxSTPei7bpCS6VS6Mf8kLL4nBAxeaQzZ2M1OZzMiZM/hK8KM3s9S:PQxSTPeifSE5LLL4BszQF2MYZzMeMECz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007d43243bbdc854aae23aa742990f40b0000000002000000000010660000000100002000000048b65ad564c9d60d111850a5e42fd441fbae3683936e5bc8684695c22b1355bf000000000e8000000002000020000000c401f6c9dcae5b1e0b5b2015b5f9f80a3bc59fa584a12d8b588d217c5dbc82fe2000000033f83ca7c149dba15eb22ab7a40ba791d622fdde0a6b561cf23bd0c246f80d664000000011e59185cf099f13de4a6975aa07a31d72021bbb555694346b176349dd1a5b3f334cb33ec04579da8a463b868b9b542f1bde2f139334a812808fe57b4de89ea8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2078545184a8d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{765093C1-1477-11EE-983F-62B3ED22FDEE} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007d43243bbdc854aae23aa742990f40b0000000002000000000010660000000100002000000001cfd2d40574721abb6120e933e18ea06528a3db510e2c1c8ec6d7bf178ef2db000000000e8000000002000020000000352ae3969c856817076aa780a616c75bad21195bcfebc0e2907e819e5fa74eef900000005970d95d0f40ff585b94480f6f1592772efe337bc4183208b77d034a66648e1e46ba23e1949c30647761852d7eaea5a970ae1f5a0bda83129d1ac481959a8d73b416c47893efc530793722d5fdd8ac0940e60a176e38ba72b827e2289054f5f2b901d4c381b5a8340a3cfe17ffc718832011bdd3dcc218c50463b8125247a565d177940f857383dfc87f778f276bfbc940000000587e65e32c8cbd9fe86609ff46ac82e06a9961a49a541fb7beb230109bfff512d2c4abd2f91f6e6aa5563ddec9509b6d9fd8899bb01095b042d179bf535f00c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394586356"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
520	IEXPLORE.EXE
520	IEXPLORE.EXE
520	IEXPLORE.EXE
520	IEXPLORE.EXE
520	IEXPLORE.EXE
520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 520	1716	iexplore.exe	28
PID 1716 wrote to memory of 520	1716	iexplore.exe	28
PID 1716 wrote to memory of 520	1716	iexplore.exe	28
PID 1716 wrote to memory of 520	1716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c4cb21f7c43797b31e82aa48696bf28

SHA1
112d0f91d6e3d91dd7117f1ecc13c5bc81fbc450

SHA256
f5fc5a1fc450c854821d422ed0909d5c0a50e55d51544ada154839fd67075e24

SHA512
121f7a744a502d3acb4159868bf064d6e1ed44a8f905db4126a09d3b9f43b21d609f07d49a66f82065cffc5925b8edeacd9f0d5fe860801088d5142ac26fc47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07249364ae69ed1564dfe5817c77a891

SHA1
1e9b84be0da4111a28a60559af352e3c783e18c8

SHA256
0041f4708ca0d081e795b376d479dacca517b2fe65da070e3a323da512259799

SHA512
0523a5764adcc913b48b6046819170751a134305cba787b67d334434ec8d011b50b68b9fee43b4f82055d4bdb096392df5ab16a9fdb31a3ae3d63b2ed37d1259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b14eb740ab85a5f0390d8034fce4faed

SHA1
8f24d013392d9adb6f0053939b799612010d6d08

SHA256
9a1ecf40b14e6fe606b293fec7e480a63f49ebe877bb52e0a904daf818899dd6

SHA512
a31a571c99f34229612ff75d28ff2a96d17567c4c654b51ae364336a167c3afe78fe6bb2c637270866339d4c2ea30c403ea59c4bec953838dac1fcf78eb60f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f21a1cf9a91ada8b018f53d896381ee

SHA1
4db05760d2bb7afe214edbe36ecdf86c3c08efde

SHA256
8231ebb2b63f80f685242e41ab48786a05d9fd1576d045106067383d91c4f2c1

SHA512
3c1caf5dd4b1d1386cbdb1c91e2ff0d792b220cf054c9086d1b817b046ec3fc4705a83dc1bf1f43276f5136b5b6138fc2a1e81bf64f8cbb5f078f88d3627cf49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b8bc9d66ef300d406c01142822ac5dc

SHA1
11c3714202958ff6b4104ed06043cae037d4cabd

SHA256
35294127ea45d952c83d0f1253a6c79a507770124be687f33a9a25e6b07a5797

SHA512
0250ff671e9a324d6c8adfe519fd652c4a049d470322c39cf30577bc9e1f2cb59fdc786b24d16eee74f497f214057a60900791c26a29f7defd72cbb45338b680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc93b155c1cb27648ae27711bb5e49c3

SHA1
9127964e8f7d519caac5516d9c1e8c701dcbb353

SHA256
c3d2c41e10cf4df0cc263bfadfbf7b05299f2538cc4ac93a8b6a0d09b4a3f6c8

SHA512
3600aa614684bfdfcad254d185d158a3c16133003671246aeb09c9846fe3411052f163d089a58bbd943c56c191c6f459db4f2df94037ea09fae61c1575eb5108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e5a27620ea0004cc80668d829f625b2

SHA1
7099005c7007b560d842bfb3209c8881db04f87d

SHA256
d7a07df631c09f0d5f2f6432138ac6b2d5f7fa403eac8ab2581731d7277d534b

SHA512
55c36156a9e49520d56c253f83bdfe9c2bf6768ecb514838e1a8abf6e7da0fa2826fb55235f6f2791533809e68ce2bc86c82927eba5d446ae8ad100d4e0f7c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09ab9654232862e4032034dbee46efdd

SHA1
9cf27531fbb04d11aedc47b4610946c6e9135e83

SHA256
200b427d82be3d4c8ad72a43e8d72f5c9526f77039750d513e4c178ffcfa5569

SHA512
beaa96d3f32a124546f359c975b3ad0319c95ad46ab02d326a4853fa079e7133ce0be64050b7cf43dd33eac8622670dca136f1773160c4ec3ba10040e1f1e94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
228a1774f8ba1299aff5c0c3cf92048b

SHA1
9b083fdd39d0d74c4dc6db74611deadf675cc4b4

SHA256
e74b2c69985d27543127617dc8eb75ea30287d47db62eab3a9dc4c97e612fa28

SHA512
4f5ccaa5e6dd2f87d13e0454c600c710ad491efa21f9be0f5009ac59988a9c0598ef85f0dd726b61ee6c5a260e8c4cf86c76d3718edf61210ad564cc938f21b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
6355dd7a8b597efe88e80fa52b947d61

SHA1
bb0ec472460b57df547bdc32eb89c9ffc59a9e54

SHA256
ca4de759095f309e9ce1f9238f4c328eb54b0f9eb3082d2240143198869affa2

SHA512
9c1c634678b3b87a388622ab4c41982cc8e80260f170cc6347fc768dd5a322b753d097b52485ae58a1abccd096754b07f6940bd43a57283c4a8e8e32519ac4c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\21EIYER7\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63F3.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63F6.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DL516LOJ.txt

Filesize
608B

MD5
a0d35eca078759a4dd72d1894ea9719b

SHA1
dad760b2f4935f2fb2c726dd815cb1a9a922915d

SHA256
84bbf03c8b5470b061795794fc36cd5d936a830a46704bc92c22b51e2c63ed18

SHA512
8421425e20be36961b5970cab0bb24f7dd8ad3608098ae0b97f80fe634aa41ddb8f786b82f11d86db32ecf6686b0695e6b26ea81e567c719ae3302363316b766

Download Submit