73403b9da0ae91ab2d9c8874f4dda0a91806454dc07683abf7bd21f06993e72b

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

20KB
MD5

30230fef0ad1bd722b31387905ea3cb1
SHA1

407e93d720e0ee0d1d61ff47e8b1fcc57a27fdf8
SHA256

871d74ed3b259c6302f94417150b66990f51aa799e9f5b604fb82cce2b84b61c
SHA512

e7087c8bfaf0534a60f585464d40f4523d02dc729964e8403d1746b856eeaa21537baec753c90937cf0cc96c0db5d03d996f49d1c996fa7ab14531e5a7c5c314
SSDEEP

384:sSFpvs7umyCso/PiZqs67/+xddJdDZB/1RFNvMotdvu3hl:so9YJso/PiZqs67/+xddJdDZNM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d093237b76a67b992dc7e5a88214ecbd3d3367b4c785c06dbce89dc9675e244d000000000e800000000200002000000036960746850dc0bb38d45cf0c5cde69802284f2db7a36505319c791631130925900000000646f31744f6597b3089f546cf08fb6b2bc8390d87613585616af54ea265655e5ee72b3cf5fc7f60b3bf2dddd48315ff5cf2527438e00617e0b195cb325671c9d2c46478f5f0b280da03ef2ca38f4ebaeb081f5ebe273f7412464be6f2821cc453104bd6f46baacc291127ad0cbd4cf0468f7d8890725d931face761a675b6d4645acc821f8a4ca1fe245232d5b81711400000001697578ae9b5a05196d264582479aa758dc8af10caeadafbc7482560c83a3b7b6db3a12d81491dcc21a67560345a03a008f9c778c627972443fe1f251b9f104b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f1f6764a59d8f5960104a28ffda729163bfb03a21923d2de97584f0c57e5df0e000000000e8000000002000020000000dc0584cc8fb38ed82be422efddb859ae9fcb8bc91c4d30f0cc447f6eed6166ca20000000cce2b0fd96ee133d88a73514666d48b7a25ed61dc20acc6e466751a8e3932353400000004b4321b8cc3f586246e6d41673144fa0d582d33c8a939ff85e4e650d8650315355efbd922b7ed5574b95d4180c373face8198f8f2319606f62280e3ce7a35930	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409872090"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4019866e0639da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D8D9431-A4F9-11EE-A5E0-76D8C56D161B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28
PID 2404 wrote to memory of 2384	2404	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c06f5400814b897732b184610ea18247

SHA1
93e0ef98145ed4dc2adc4d189ab05456df99de65

SHA256
94c2bcf5d22d7e2a723ffbcaf69983ddea09601add4e97a5958542e1ae58787f

SHA512
7fe41b8eb8a0dc712378ab11bbd4f3f2bc6cdf509a4f150fdcb30be4030da63a2e36a87dfbd4c52ab4d2b2f8abe46cb936689a6567b2dc7ade9f6c0fac5d7159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2b2476212205a37f22f37fe9f981aa3

SHA1
a591bf1e665f5e841756970fbb987e15298a2754

SHA256
5bb4bae7bf9639578c347d192d256cad7a818b9966c6fd28e6a3bb8a84c976e8

SHA512
3ae885837f7d4bdac0c16e34e9fa66cebba8112f6e6b68d651ee4fffcfe98076f9b217c5e35ffbb7ac5a6ee7f24b99665ba877aa3aad1457cdaa3f297f20a697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c0bbe21f2d077c0e0e2ee79c059a48

SHA1
ac52a68561dca005dd3806cad244cf777b80be0a

SHA256
73d7a8f805693dc55410bb5280a9f0fe1e2e48f6664fa83982a9047503a7975c

SHA512
7e496bf2fde40b2c0e44d9829c4f71b9261456c4393ee04ddc3e929624a2040f53595478c127136d9c758a8877b0dec57a0175a8f5cb1fd8789c045ea2ebff17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f740b7391b2980d88f7d14d118bbf42b

SHA1
c850fecc7bb531e8692f005832f986b60481d894

SHA256
f4f6cc77e8323abbc31820ed3b77999017640843dea4ec4c26d93d1b93bc3db8

SHA512
3057d3375c59c8f85d62a05e4d52861dcf7d11ef9395692b7aed6c73e859d136f47d4348023969ef3e939701290e00e7edfc91abc2988a4ff8d41f2b7f1ee187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
693bdb385857ca62a4ff0d933a71a84c

SHA1
288a2b5ba46a6f8a7fb88c24279e3371603a4888

SHA256
1ceab68b5523ca058bcc07908e5a792b187ce2aaa867aaacfd6584b703bb0846

SHA512
30b7206349d3ab33ae9cfe6ee0eb3b83d70cb1c108a858092b0794bf595ad5570c50df485ca285323c45e817dcd168a1003ea615758220d723ccd2bb0aa3347d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c3526e43c61c3fd3524aa51f1381ce9

SHA1
83b5738239923916a9b72a222628554828e22ea3

SHA256
2f55322e97ca34f7cdf2e080833a0b78345eb1c284b624eaaf19e71fc17c51ac

SHA512
de6bbd9e9ef93cd3091816785f1b554c5553f8093824fe9c3b7fbd6863cc1cdf7dff0dbb1116ad0f3549ba406fb2cae03da33cd231cfd97e498f0a95e512c35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ce89a1a086001a3efe2105fcb777c3d

SHA1
b2aaa12217dcbe56a97b7f16b5817049d04e43e6

SHA256
10a229a165f42ab2b7884da8fa2ced8deee314b37be2be6535508acbbeaf4932

SHA512
7171c8a86103e5fab73e590729698287ee3a787dacc24b8b6ceaf6b37d7d9f87ee8eac60a03d4bbd713da5bb4df047283cb459af39d3e205a40a679977240b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d054469c918374ef6c5a5fe8fef697e9

SHA1
acde125c256ef6445c234755bbc5a688b2417f57

SHA256
d7e2d308418eab4a04eca6ac57cbf8af724ebb865a1ac01afd080c1ecd4a4bea

SHA512
1d54116ee0a97023e4ca940f76ddd3bc91dc7d004c03e8dff86aa48386a89b4a763f8a569d2a5d237291abaa2e81bbb7ebf7488e78cff3d9fff730def87b2bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8ea591ba8da9dbfbf1dcefdad21d854

SHA1
edb12c255cedac65e7f0d16d7f50b545cbc83123

SHA256
72253efa828d5967635bf6fc765a580482e79a0a2595c4ac11233dbdaf47b138

SHA512
2cada5e5e069fd6b598b5bb24ab07775a6674391d4636232bf67ddff84a186a729e6d5a06ad34fb5c72f445f6b4eea214ceb2399b8e8f13ae3bd463469600dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
800993e58e4ff2525f18abf46fc35fd1

SHA1
ca8851ff665403058ef79c8047d78f16ab58dc53

SHA256
78f0c9abbe422436d439c308003d885d210f4ba316b8873d8ff9485a05ab57c8

SHA512
eddd375f20e324970e9f356e558f9801035ded55011a0e1a474fd6ee6eed080232bc9936edfaa5471652fc127fd9165c5e7ff8b09665510d952861fbcd130a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12aff53634bd21196cec2967b9a4ee8c

SHA1
cfc89c9f2fd872eec8e78523f0b4baa4db32cf0c

SHA256
a0762226890dc20a99aaa6e982488787a0f07c29a785fa994b9e75bf3523beaf

SHA512
30135108591553aab97d33ce92302255fcef4cc6c8175159aa14ffeedb077ea7d9f7ed540e02ba2cf073b265e3dbb900e1eeb92424fcc3039ef3a91add6ffa40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\J4ESF6JX.htm

Filesize
114KB

MD5
1fc33214a308d78bace104d3bb3873d0

SHA1
e458a02f7746553c4fb51ecf077bdfa5052221e3

SHA256
8313f95fae1ab43cdf5dd271f400f632692c1159c07feba5a7cd9e48acfb758d

SHA512
c55719857433fdb2a75a535b04f11647c6ee5a8b2cf451858e01f7e321b4c8944b6f28e27506432ea2ce74cc2696fc19c53aa442db59d99af2774e0a272b812e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\Teen-Brandi-fucks-a-Mature-Couple[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3036.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3049.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit