547aa126a73ed64b64ec9e0342b85b92effdeb97176363ff0a80f97322f0619b

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

1KB
MD5

79e06b3aaccb91b66795146153924c74
SHA1

109b547884e40e9cd9a6314d7c4dcdcda1511926
SHA256

547aa126a73ed64b64ec9e0342b85b92effdeb97176363ff0a80f97322f0619b
SHA512

a162076f483f23fba4ce1d3652dfce808c730a5849354a22e8b008a7f956ebf8944a286bfe0a584e908e01de47fde4761c7b15d566087d1d164a226e3f1b74a8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503d319e6601da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7CB8991-6D59-11EE-AE61-7200988DF339} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000a14986a7a3cc7280b22b1143478a2bf6a231372cbd3dc71751a2e245df271381000000000e8000000002000020000000860f0133d94ed4abd95cab55a2abd35bbf97a2e6be0ee4fb666d09eb494d5fb7200000004d9800ff0ecab683404d8b1d1318665ca60cc4706911c679cd5b29dadcd4e5e940000000bafce85e99169a563254e0774abc276a72e1bd31af726ed8afc959d36f411c03b8b42ede3f6fc25c5484890ac9629108fa8c552bc78d2b9b6434df4eeb39a4d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403756157"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000fa39a26fb31b477d37358ebdd5a8e12413a999646faa940ec7d327042340f7fd000000000e80000000020000200000006ff4f16ca7a21660698dbad25a5d723b76f9069e7bdd9df3aa1cd8e8bfe76ec790000000517dc65ba2f0a22f63edd543ec64e0f2e8eab25071fbd8afb9947f6ae48b613714c59b93c90d975af901b7385dce999eaf63d731125b29b3b0673ab362cae88f1e9f8a2be6419e8486d97ac3b37f587af0e123e165b3338f81ceb2b690148c84abeee69545c85bf43d848f323ce603d3af6ba2ca64aca87c74eb6fdb5dcb5b25f6e372c9617ed3c1ebf9480f8f40d7b840000000bdf32d34acfdecad02eff50b3e2bc2bbdca12cc5b3b3aa2b1a6b4862054851107366665a82a546da845ba10e39df4ae728a19b222efb51eaab72c746229afde6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1928	1696	iexplore.exe	28
PID 1696 wrote to memory of 1928	1696	iexplore.exe	28
PID 1696 wrote to memory of 1928	1696	iexplore.exe	28
PID 1696 wrote to memory of 1928	1696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
25fa57850c53ae68e6815ccd550d9261

SHA1
13a10dfdd6aaca2d499d8bd6a79376803a612f91

SHA256
0de43d179ed8727bf595ec9208e5e14cddcd1d4c78ccf928d1e48bb4b3d4b561

SHA512
91ec184889fabc52cbbfd28e52e47ad32cce8002f8dafa769e39c77a7be02df86a2cacc788ad933de86de8bffff5bb3424dbe6ec70d43f7cf885adf31352ac26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e3888e50c2ab9f1b207586b4695baff

SHA1
a3bf2c30a5fa8383d4eb0b27d3d6bf16603832a4

SHA256
20508c8d179a39cae74d4e9d100bf85cbd18be880a7da582b1624e3642d3368a

SHA512
8312e70af3832f5f4f54cba6b2196e2f6535c2fae879f3756b79375bb105a4a43fcbe299fe19e016c67d15f20be6333122e97c00d933d617cab96ee69a4c3af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79f1b8f0a3e7647cb2519d90f1766559

SHA1
703c2500258cc951287d1ebb6cf3fac38129ed28

SHA256
ac9b553bbdc0d97e6df97f0d506e132fbcaaf7f4c0bef5ba5f74999e7beda7f6

SHA512
94c42b57c12f5bc816f4c1e6668354a4cbe81871ef6fa06744332f5353352e1d8a9a0b95078120bab0842f499a0e1f4330004a45a3982ac64a349c1fa1883942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa5d9d88d7a01e130f864ce6eeea9da9

SHA1
d40ab6176228bdf9cf7c77d7ebe1ab7ad3e8564b

SHA256
ff4617aaeb18fc580b1992346f87fd6d723a3b2045ffa7e9b24b9ac85e3c4eb1

SHA512
03eb3466bedacd9cef907d0029eeb539a90206762ef914ac82e1d666eec31ff36292184f100e760eb8f995faf22c5dd37fd36e34317ea42a1ba58f4d71b8ca2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeb8972e2c981b566f1e3a5b6d9aa5a1

SHA1
9284d790d9f4962a677d8e9bf18b3fc7c7553a5e

SHA256
be3e1ca44122b61776b0a51702806c3ac57d3c2bae9fd298a451c88a55153f39

SHA512
ce93c4160c5d5e6deae26c9b8990222906a49265c2d82e9cc352684df0e6e1ecfe8cfb78c7731d99969c02fa4cc2ebc0125a0422f05b157d8de002509237cd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb32b5ec049475f4ebe54291302b30e

SHA1
19f2bb44ec6bfa4c6b51b923a6ab79775698e872

SHA256
14d7a5ce6600f8d2371b29201f07433ac3dcbfe438addc6ca4c472b908acf07d

SHA512
e1cc5311a4501081e4e1efd6f981128c5f95ac56cdd97ae39505fbdd2ec0b311053baee60f4b8ee6d183c77aeb899c2b42ac227f40b7a869fd262c51f3368205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b68f24b2b8477743acc0bee65d1a55

SHA1
a577f42bf324990e45dc307fb0cf2202734369a4

SHA256
94c785c3bf61ace7dcc6847072c5a665cb5068db6efb583c09f9a5533d63a6bd

SHA512
985d08ebeb6432d174e014a3fc86fcf38c4bb90840adc92f2a1a20b63855aad6e184f4079ab6e17112cb1836edeb88e1d87a9c94608a3c6f8f872b8cd8a62c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e2bec5e2b095a0e59982f1342221c5

SHA1
17ceb55f5d257ca5933b533550601c667ce13758

SHA256
61d134bdeeba0c709e324450d7d802a2a41345b0d857fc60024d0fe85eda6ad4

SHA512
8aa30df0a5af238398322f8fadf9e88352b591d20ce8571f5586dc8ba638d3a68d62e0c8d33487e60e3bc6a703fd114553304f53a4271972c77072355622163f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee1e6abe897155c1abc179e58838290

SHA1
3afa9cf3207e9feaf876cc747eafa72866b6fb46

SHA256
eb50f8c1cc8e60658f8eb3da083faec4f1dbc1730ea8d73023c4f6f8224f9c12

SHA512
f3e4c1417511993ffe46429fa0d4278800d31bfd2528943a62ad0901fd23e0257c1bbdffc0a871c7961ea5fc9d56ae91d09d4c81ad3709b48690bb5285d9220f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59ddeeea41ac72013da25cb4d12bf356

SHA1
16c2f9da6eacd7424054f6c66e1ece33be22d728

SHA256
e518fd54c3b070bb2fc0afe710912d56e7402942a7f6e52bc462f2866a6e77a4

SHA512
4969455593ffe54c841855df226e3e063bdfcff4bfc6eb0d8db29ca9766baa1d64c948d302cc16eb2d6636d00192f6c5ead5158d6371763af9384456927498ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09e97053f1676d3d4d2badf9c1aeb158

SHA1
47ac555e39294826f1556df27f2da91374704e62

SHA256
09b8be398660a7bf6ce0ed49ee145d5f2ca081e82ea992c3a0db5637f51d460c

SHA512
bd75198efb938f78091e009b254e67423016ee781fec57d1b58c4144930b4d8aff679a92b224ba44ee733668a72e4ed31ec06ff655db7ad7965fe94e8ee9d140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3127882c8ac545c84481dc4549d4e787

SHA1
a444a99fa92f3ade6ea8f5e66b9d4f6ad0c35db2

SHA256
6abbb6e12cb008ab760bec25b609a10bfb49da46b9fc28c97abd480760297934

SHA512
cad0e36f0afe1f70d358d99553438cefb86e9cb804b4ceead4bae83e75d298f3071e8b101809a9aa51b8a0e7ad07f479492b64e75aea63914306cc30e299ee5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0cf5f86cb4c1566116774aec8400d5bc

SHA1
cc9642e763b9087b2adf26e2fbf6851c8fe08694

SHA256
77dfd9a0896b3adf8fad2f66a85c334251228bec2d990e6aaa2e9e31bac3d72f

SHA512
8f125d861d03d1fd3a61436c12e830f69c76f3f155589c002b5bc86f80dfe1dbe85d2303f9c3280ed39e3abdd0b150116150f6ba66c0ab42d374079173cf4262

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DEA.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E0C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit