296ff45f8653e7561a575ff6ae22b28a71322d850899ed2350e94e8223b7bfee

Analysis

max time kernel
602s
max time network
618s
platform
windows10-1703_x64
resource
win10-20230621-en
resource tags

arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
submitted
28/06/2023, 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

818KB
MD5

d8b04c847d97337fc113e6c6290d9225
SHA1

8240d647ef5a25178df7f5c1750607d2c4391516
SHA256

296ff45f8653e7561a575ff6ae22b28a71322d850899ed2350e94e8223b7bfee
SHA512

ca5d205197b44b31443de12a776cf664228871d4dcfbac0292b7d6d834d0a6b36f228c1b9c86b526468af402e1399990840b211859f4b383fbd0293dc32d0d63
SSDEEP

12288:IlSLhDEdBCTYxVVbmoEvs24JZEmnVveRblumkWZmaT3rmhXcSM7XxHLfMhOhFkhl:uS+dBCTYxgr1dC9IC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394503006"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dbacb1c2a7d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "173810926"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003a9cb1c2a7d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "173810926"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31041987"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "394551592"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "394519600"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3552B0C6-15B6-11EE-A34A-DA329EE4A0E1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000296578183db0944ba1870415c077a6bd0000000002000000000010660000000100002000000018822de5843d7f8c483b0230dfbd5d4e10d369b16589c17a2bcf0a204824554a000000000e8000000002000020000000616da0c2365bf9c2f46837284f68e5ddc7d130c49c055064da751bf9cc4bf1d620000000d5203856fc6a490405fb4af3c90a52893cc2584d87c1278dda6924182bf5bd28400000005ad9cb15d75e2de64dd74d1b2d2b131349662bd14993132b235160d2ccf4d1862c82280dd02c4411aebc404d9c4300af41cbb4a95726afb96b50e472a566fd3e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31041987"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000296578183db0944ba1870415c077a6bd00000000020000000000106600000001000020000000756233e0d534e15a7ed655edb3969475a28ba6d60084ea891ad6580072bb0317000000000e8000000002000020000000ddac774d4a8ce867813ffb29f984a8463970df6c8bfbba1b76dc002ca87a512a20000000e55814e9e4cf1afdce0435e7b93cc53be956489d3df3f2fdd8a306e040652352400000003d4b9e8961f85d26accf8e34f88e4bbf3d6db9fc3a78961df1701549cc1ed9cc37032e7b1d5754698912f94f5974386ad04fc558e97f45d32cb43659a1fe6a59	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1989575376-3257970224-3313857678-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2424	1748	iexplore.exe	66
PID 1748 wrote to memory of 2424	1748	iexplore.exe	66
PID 1748 wrote to memory of 2424	1748	iexplore.exe	66

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
302B

MD5
84405a663813542b57608188733bbc66

SHA1
31294fc0eeb1ee85dc911559d2b2c184949b986a

SHA256
538c581239df0d8fff9a5a9f751c0eda77310dd1c62b3aed75dd1e51b3559054

SHA512
e6cacd35745609d41c3fd9f1c17b533f7f694fcd1c1d60d31f49655689b4f5abc66c9d636c5a2678281372a54d6c16a6076fc81998f443ccde346fb2719e1ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C12XYPRK\bidbarrel-download-rv.min[1].js

Filesize
645KB

MD5
d40c7c545e16d1a5a138947b75caced9

SHA1
0b15d9fa10b4f2f1d86edc10ebd0dc1551518bf3

SHA256
443bd1703a5a4ca55bc24ceeab377e6832311700f1c89ca99c61466c1057113f

SHA512
bdb55f7208b9c3dae74cc189c489a410b4d2cfc2411c915cf827732ce8add43c0cbb225a919ed8a47542e7ce15342622a96c20266e65818882bc494f1f75092d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OXL802X1\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\61PYY34Y.cookie

Filesize
613B

MD5
472c96b38fa9f058555ec5641ac644ed

SHA1
3bd3e3382c055cb0372408d2bb79b1b38ff59785

SHA256
e81d5ab3ddc39a57ef7538b0d4a39d76c2e6726663cbd5fb84c3bba7529b2ffd

SHA512
f3badd45d2c476ce206f55ca1c3d9e0c729b233e757e8e83350b1032e1663ced8d6b9c126be9fefb2797abf739873f3ea3ab034f7dc8ed59a9812ae27ebcaa47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\XQKVGLQ2.cookie

Filesize
613B

MD5
db056cc02d1d2cf37a71eca0aaf677d5

SHA1
efd9b11974cfd06ce070a190d4d7843581275e70

SHA256
af8487c1b0b67efb75488c4cf38392e7c9e3ebec6ec283f989e33af4e34450b9

SHA512
94a5cd0ad6144b86bbfbf9dce5ec942ecb78fb0cd6facec658d5f31b23891509f585ad557841af06b9814031f0ac9838cf677b29fe4eb296d4ab5d9da3e36950

Download Submit