51abc00ae755ee53679f4e504db7165abf3348c3d9d246aa5d99a12148776243

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

26KB
MD5

88a6c8977411d8dd53660f03809951a0
SHA1

76d1500ffd60b797b31ccaff0127a998229e4ab2
SHA256

73f80d2cf61d58a8306596eece9adffb9bb9fe43687b151b69640978e02d6991
SHA512

f92f5817e4d47b052a26d05abab0f751e2f820b6efc37ed82797a04ba8b346785701c6cfffdb57d9e18c7f0507fe4ebc7ecfadf39699a08a92d5532c2db805b6
SSDEEP

192:SIW0NJvSpFpQg1s27bgdjDa9NqZGTFBqXyp3geHFTtux2+zanXYaWcxEeFoex1vY:SICFpv1hHCClnM+H/1RFDvMotdvu3hl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409663983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE115C01-A314-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000082952f9b53e1715514f14d2aceb4236c2e1106cdd46ab0b664c24e734c26c4fe000000000e8000000002000020000000ed72b19db944f75e933b4a75a4c2143a6b5ab44e6f1e19950af0a12e759b76fc20000000530e885b94d3d233b993355873bd23480153738c65acd2c9ab806100e98f34b24000000089f63c7b89284721ff4c26f6c4946840177d6c0ad3cdb05fc958c4916cf426384aaf3d0c72854457401b070ab031e63ef39e0bb663f43dbc1873831b0fbd1be3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302b5edf2137da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001bda5d248be9d18b245f04a67774e4a7595a178cdb8e2ab5636ee3b6a5997973000000000e8000000002000020000000bb4fb90870c47b8193ceb88616235d645ed4820d8289df89598e870f0266a77d900000006b7f4210ad8a07e018417ac64c905d1e57ae65ef25c0c6cd659bf3a5984309bf371a18c8179b4b4678a3af39e5fcbd1125973a40fc0d66ae75cc25355376f383d21ba57de0bc61b92363d64cca0f9a1f404c961d2117764326c1f671a2df748dfc75d09a0c6fe5087cb132992938fff2ccdcbef972e161ff510993b460bd9910b7919ded32c838d3f9b4469dc41f3f8440000000438997428dc33715c57adca24007fa652897508e52e869083c556bbcaa91df7e453147a786141c5bb8bbb1bcd5accff38b8043fb68301ac6f6eb26af2153be16	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28
PID 2312 wrote to memory of 2788	2312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a979d90ae58f419f69c27fa2ef7d008

SHA1
751ec109336e22d8f0cee590e6e2795530c7152d

SHA256
9636276090d59cada9603e54c45cbb3e1bef56ecbd88c8f1231ae4aa3394b808

SHA512
8441df869babe474ae801f69c40405399f72b51411710c6782f4df8ea9af681f36e79e8ccd9451879d1542f280bf2317ca673d9f84c81fd6c763f8919fc1260d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd69be8974b3b496346ea71bcb375322

SHA1
c176191bc0ba53e0adf4d6cc51c5f294035e3b24

SHA256
8884e15bc348e4c5fc3c74648b20758aa6e2f67af4c3b11bd7a00ba12e03af01

SHA512
014a7b4ba1a789b650ac6286d81cb7ec23ad4d832b28072673ddc6937fefe6f5b230eeb3368c0c7f674aa9a2fb981baf5539ecf9a5d1b683a1d9870da72a1c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e118db86e3a59dd541ae00288a030adb

SHA1
50135482b2fb836db27f74137006c56f0dbe8d72

SHA256
eb18a0455cb27bf5faa1d264398da9da521bf73c6c4951dd85ee0cac13b3c3b7

SHA512
6d5c33b7f67c4f90584f002f49e569ab82e40d399ecc8c930af95121c566b2e8650195a8d648b7c15ec3e8664cfe9455c5d04ec33950c3cf8ee28b8079c0df2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d5359c1dd2af9f6fe81d914f75d9342

SHA1
07e38cf65af258e09b3ac83c9041a4392521d0e5

SHA256
f4a3974044859a4a7ca444f460b3a9b0db83fde3f1d96591846e41fddf49d8d8

SHA512
fb93abdd00545118c5a8287faebb1e842a4587a86fc8080c923eb2dd799c85a8bce8c1533068bd2f6f9d48b26117d9025e842c0cbe372031eacaf5cd69ebdf67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8408700fbfdcf27bdc1195280befc199

SHA1
c04b44b8e7e203d459155a787c920d87fc3dd8f3

SHA256
a20a557a17b3f1abc80b893341c25ac8962da38dc28005c8dc52f30726204b92

SHA512
36bf9671dabee47bcf6198aeaa2a330555b980f5eaf500c08c912817377552ccd2b9523eb57dc9b99eba2995b6a783f2c6cb3466e11069ed92772e826b2bb35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e713e42600e966773883e8c97467725

SHA1
30855af6f7e70343710ce75562325015197808ef

SHA256
051b2bf0a4267e1cf7b4f1bf5fd6ed9397fe37cd43f12bba0db498fc409d4f01

SHA512
1aa917422a8ae2220df63ee59b54b466d8cef1033da4c08091981253c44190e0f2acf61f8c6d1f027882e67b4f84b1aef9bd3bbbfcaa43b7c4eba2b65a159c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1520ec3550611c74115c31da2da58dc6

SHA1
9c1c2a722d6751eea6bc7808c957c1c79eea21a8

SHA256
318a2bd1bae62ccb34781f06ef4305007c5ade05387286cad5ef82abe2608f0f

SHA512
b46edfad9f9d491250e9e497b9a3946edb328711b8011cb1f7cf14b2123591baa20657b1eae18ceaa18e348b5e754a9072020106a1adf39d561158ff6c6252b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a421edf6524983e282ee1833632fdf2

SHA1
ff37e0a31eb6fe33b3ab67df7b02f93e1734748d

SHA256
e8d1718fb894ce3273a2795cfe15a8196613b594c1aa61ff24c0146bcac8ff0f

SHA512
9ade8c8f1487e05cf4291c345aac9242436d1f816cae4e50a08e72f1cbfb94da6802ad3b232f2d190cab4b80f30a7151df2b977030d8e19423c4de414fad8d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95eefc0a1f89c16fc229056527f048b

SHA1
d55eefb4463ffb6bebbbdbf35d9b4a4f882bbf93

SHA256
b48ef90a1be7e96f9bafae916c9ce75fb51c99bc49a736241f8a4b9c59ebed1b

SHA512
303b6dc5804c41b08a541ab06c72104564d408113a93b4d399a2eb8c3c126d3683280d285414c53fcc04538bc7e82b84496a54f09c7314f48198bbccdfeacf26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da720ae94f992939a031959b8c4f6526

SHA1
72ed92149514037ddb182f929ebfe50ee3ba47f5

SHA256
95bc8b935eb87311c42553b8224b076c5ff33cef18b8e26a93f6a98623e25797

SHA512
f7822273c822c8eb91e7a76e84e24bc0026cd3d0a812fb3457489ec496b534c4d182901a9600aa41e623fba163f1ceb0eba42da0f8845d40dfd3f9b23890bb75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f935dd3299c90df51b79ef4572fe3864

SHA1
f3da6556bddb44a4b0e5520b396d220dfb7bf371

SHA256
82d4d67418c050894740229f239e08e2e66720621ebce953318111c65695bb15

SHA512
18cd0ef8e5c1d632e3bb7346276bf39c98cbd60de737a500465110e86c959c8d1fba4092074355033e0252420f586008ea4b04dbd324ad416c9d5300f0d32535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4387ae3448f1f247fedb86de034aec7c

SHA1
dea8fae1b9e446ae56c47ba8191d8d7489d4fb51

SHA256
29c177b8898838117c5497b04fd1fcad13a618faef51fe45b46c0c52d88c181a

SHA512
91f17763c58ba1997c41e3f79d60c0d1391a1bb5630e5ab09a95320c19466fa7a7acba7152874a8b7dac24a245213ec2f8773c660ccf9c21d8e4f2f982a88b10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89a5359d1fe16f0667c44f78c771d175

SHA1
2744133ca5716db6451f3186f6dffe75fc92cbe5

SHA256
d3ccdd67d67457c4505f9e7ae42c9dfa16cec3384e2ec7c7f1b772a9d8284dc4

SHA512
e6b16b51ae857586920c676c77844fcc699e76939963d28e5ab381bb96b0c4c0250aa5ccba263eead85f79c9fae37d2f5d729397e4423e42e8ac2457f9442941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\Muslim-hijab-porn[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\Z7O3B312.htm

Filesize
114KB

MD5
1fc33214a308d78bace104d3bb3873d0

SHA1
e458a02f7746553c4fb51ecf077bdfa5052221e3

SHA256
8313f95fae1ab43cdf5dd271f400f632692c1159c07feba5a7cd9e48acfb758d

SHA512
c55719857433fdb2a75a535b04f11647c6ee5a8b2cf451858e01f7e321b4c8944b6f28e27506432ea2ce74cc2696fc19c53aa442db59d99af2774e0a272b812e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1A5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5FC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit