31eb26b8fa29d27969dec857f66da511f1048535393798962174758870e4ace4

Analysis

max time kernel
138s
max time network
170s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

24KB
MD5

3bed5d109ff3f42b64cdf06130f31083
SHA1

cd95a2861fb74b1a5e5ff1d9f85431684620c0ef
SHA256

31eb26b8fa29d27969dec857f66da511f1048535393798962174758870e4ace4
SHA512

9b70a0a0b71abd993b80ee11691a4d0e621869eb9ecb7ff15b180bf4746cd43b7d187149b5a5c603153fb7944a0fd63caed44c440d14a21fb9a26d13d2f74c39
SSDEEP

768:r17uBVoOs4e9yI1MY7Bhb3R+g4Yg4+ReJQQL:r1iHoHQbYv3R8O

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f00000000020000000000106600000001000020000000b4db12974a6d3c9c37c6042af8278fae1c99390b239d04e622320d4146dfb075000000000e8000000002000020000000910b725b284b60ea8a5dfba0f3783dc646fb49e06ef7efd78d11cbdf573eee0590000000c2e2f84a5b3ef088e05b153984a53ce9018eb147919eb151b994f25360d8cafa127224a0b3c0e726ab2b65391f0a23b2d59844e1ee93890aea5cb6483c627d734cb5c6afd3d80467ed96ba4a596c3087931b65a41092d6bbe700c7b1e9ca95b6892c904a669d0700d6614add7a7f74f4d35fb829eeef0fcce41e5f744e78af71e1ea4c9d4ea44bd38b9d4fa43bb8d1d8400000003a3b3bdf5b5e810f55d8815d935034f170853efff45fea136b6b0c5329c54e19903eb34d815aba3fcb6682f0301816ce5f3a7fefbbfcb65ff4bfcadacbec461a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403218847"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70419d9b83fcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea3dc2a7c0fe4d49bd6e8f3e7e71513f00000000020000000000106600000001000020000000801b86e3c68e4ca21411445440d8e6be53e4bac77a898a6187f48ebb83b81bb2000000000e8000000002000020000000e3bae46a2b0c15bd43e3033f35fe8138e83240b6d3f2bc30269696bef8af460520000000eb9ed5c0bd63abc0b2944863b83a5baadf56c20a8e56119baad6e1da8ffb9b0b400000001586e03b3750df0ee3ed5f4bb08dc1d2262c8c864fe978fb8f846302d14501c432ce781f14d410bf3fe8d4b82acadc59139265348625948341f3c68dabd85e3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3F3EA21-6876-11EE-93D5-462CFFDA645F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2576	1612	iexplore.exe	29
PID 1612 wrote to memory of 2576	1612	iexplore.exe	29
PID 1612 wrote to memory of 2576	1612	iexplore.exe	29
PID 1612 wrote to memory of 2576	1612	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a59cdfde15cc4f12995aa7cf92ef0a0d

SHA1
354a6413f8a6de77ee0ce877499cf81737866003

SHA256
4d805031942003ee4562dff71066d621b5632d36560ec0f8ae578778b58968d5

SHA512
f417101720cbf5c350abf8b6d7a07bff20f91405abd64a185ad2ca75d9e0b33660094e80ede02ce71822982442ee4a953ffc607e3abcf23eb709257db65232c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
697b0b15b26f6159c2eb35146ca614fc

SHA1
53a1d0d8b34087b318dace4eb9bb1b062986d825

SHA256
19e34bf5f1b2132ee3f812c49832f467163f585bf3883c02d1e54a96ba877f0a

SHA512
1482793bfd1709e5a80200814f8439e4cffa91127ed28e9120373561dff1a00718ad060dc26860868b986670d0cf3ed178c4ce818d29f6d0a6e40c58c6ea405b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38114c061a940009cd41f66ae4bba452

SHA1
efa692c2244d42889d256a5495adb3c8cd89c864

SHA256
8532a939d8803d7ad587bd54d73dec172ca68815764fa75896823a2e22022ae4

SHA512
73ec39dc9ca134999eaa360a667fd7298e0b3c82dd7c438454b86870d6819f7a289b0b9f414dda5222f96d6e78ba9a18c95318a8cba48c3d9cf6752bcc5235b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a0902ac77ce66b41579fff4bcfc48bc

SHA1
189857c613852c1c3d54a6269ecba613e9b78981

SHA256
f12983ecd49c15856b8f7612d39b6cc4978a448af154e56f453ee7901b53812e

SHA512
b34a6ad7079f11500e181e7929a69e69d4de20ff3448985f35011298effd41fb942ea01d43ef98fd9b537b92cff9bae421e517d8311281b03e2ade4dfa35e0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
649d01289ae2d10ec071c2a81c2d5e44

SHA1
520f4e18355d8912b23fcd0b480c9d064c7b5bf7

SHA256
c819a6e86fe58ba0683abd7d929f0860ba1f706cdf56f1e3f53901064eebab2e

SHA512
9512badd40a9dc0f15f79153209733eb99893129f1e0b92384e9d3095bedcca1ff614e23b9c2512fafefb754948f0e530c0800199b026f1840514def658c155c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f0661a254620f639d1721d97d3d8ec

SHA1
192b90876b076a031dfc7f4428d8f32b98ceee89

SHA256
61610095c6854cd85c3c38382ac801ea8a9d8ec2873a8f622cbd7583aa13eeab

SHA512
7787860734190c259d556ad24375f1c16d86956c8c9e2efda82e5dbd1aea87dfd2adbd7b272695b47153320b7e74791c019d5ffac9416cf566e0df6f8153d451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d9440d5e6d396f56be5c1cf782cc08e

SHA1
22992e9c147f34285d708f30f57a37df1e21415e

SHA256
da2076f85706a545b0c7ffafd66c446a8e3e1c4f29792283f8dbd6d44be0a654

SHA512
73c0acdb2cc601196e140437041ba8337bfd31e0b01aace3759ce0369ddc5a367b51328e22b6320330913d847b1829d02fa347869a3b527524e4b2d044b1d66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc0dedab5a8503f886110155a6e79962

SHA1
e7f58bffc91126b6303134662fa7fd9918d2d6fc

SHA256
306075776b272318547c3363e7b517fd7139027c0c26bd96380e853453dd5731

SHA512
9086ff938ee616556df5c0c5563d2ec19cedcc88ef909a578f3ad26f3be3451c8010ee94bff326e0109be1113cd0a338027b97a4b259a243a007c756dde7afd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa3777848b122ad537dd0ac1dae9542e

SHA1
3bf689a2ca4bc768fa8eb6af75c01a0a6c8784d1

SHA256
c782b1e62ab87288a2d68d2ec64ad5627f3770734a72aa83bcc406c16b49193c

SHA512
c36df21a0780ce840ffb7bc87323ceef9a8288e8096051a2594064d38e7a895631e458b5a34bda43156979f87a05d6d2ccfad61a90e57f27c3efb3f6fcb5cc6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95be37134227a28d3acae1f1389e97c

SHA1
5c986a16bff4a92e6d4a0b2492a2e8956be8772f

SHA256
cab655f55d31a6a8aab383760913aa599bb69eae1de6013b1407b397dbd10201

SHA512
e9f2ae7c6ae9173c44cb52737aa0e14e00886deb8cf093c7bcace895eabee8cccf663a96071bff74cae1e3cc26b6cbcabe1d4909090c1d088ece09aa789092c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ceaf456f5a61b6c83c8b63bacc98c5b

SHA1
bf0504f70a6c0a0f3d01239ebe92aceba68ee6f1

SHA256
544d17eaa73141548b4ad64dd1ae7076da8758526759e53fb86d7cfad06aac7c

SHA512
007d52a7d863cd7bf840b1dfc1460b686aa4cc118a8ce2b18e70e928f44de296e7ec02f53fea392876c937df8b54aa412d171195978f99ebfe2593c685beb15b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea69e921728e21c3cee31d25eb694488

SHA1
bb0b72d45e76553d52bf47d1ee645d2588bc192e

SHA256
f42f8b8b2c4f9d797f964ee9cbbec9e2b89b51ce12057f75a17b7613c7aba0e6

SHA512
2135947e2e29d8e72cd0bf9aabb128b13cd845c875c3033c68d9fa5e7ff044ace94acbbf97be8dc8b97a7dece5397c6328c391d617e5bed1c96c7ef7609a6185

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF9BB.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA6C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit