6459ac633d8b58960fdc290bee8b8a80582a2ef26aae1a86664fb762f2daff90

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

23KB
MD5

f2736383ad34ed08cdfb579344d2c2b1
SHA1

1adfb7644e45b41a20924940d1a29983345b7c84
SHA256

ed009411873a1b628bd5fb927f07f1f33daa02888b74a52727468865d873cb75
SHA512

6c3a9859da12bdd89cd7de11035673af19bb959e4bb530eb4ee6d771b874ce1b3c7b31d9f0b632c59a10d0c146590467c8e20d1d018706cc0e29a09a3f355069
SSDEEP

384:8SFpvs+he0O4C82LFF8KmHVd0gxZRZmGTw/1RFKvMotdvu3hl:8o9NDC82LFF8KmHVd0gLrmGTXM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A014DA71-A3A3-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80027e90b037da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009feb3a8148c82792f027f57dc82b25ca9535670837f69740e3ca717b83203c20000000000e80000000020000200000001047a35d1382e2c3aedea141d60bb7f4ebc7104f9fedff5dfbdfc3fdffdd495890000000e20476bb1d437a8fc1f9b98080f2ca057b91aad99b70ea1f8fb05c0d670af90872e83d374b666c8ad5eb7fd693c00a6009345c312b6606300c630a0740c3f9a2a75823e9f25066f8dfa32860d3ffd73750f340d70843e45cf21cb699c6f2191e0dcb76064d48d32c1b9ba7a56d0f729afd65de7624e26be4d69f337b31c445f485b68dbd44e715f5e7d6aac314d90c51400000003abdac39ace574b4aa2d711c5a2fad36755b6713a8fc9de026e41cf79db8d02d2a88911786fce41832c469c7e319bca2753f62934d02feb2bbe3cf3a5e485bb9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409725236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001cf67839f6e1963018da9cf70e7ae43046a12f3e30eb930f417b120e30205432000000000e800000000200002000000034b03703a63d0b8ba5c8c838f1df135e5dcb531af00282efc02083f0ecb4b4772000000004bd3477627239f3e7074953f238e4b15ddc6a0b8062550e88f929847f6b528e4000000029650355f0f29131c7af330e766641f0b410e7c03dc23f4c1c1046eeab7c980af6fae574811daa56bf4a0cf00b2a11110b9349c5c239a784c471f626c534eedc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3020	2112	iexplore.exe	28
PID 2112 wrote to memory of 3020	2112	iexplore.exe	28
PID 2112 wrote to memory of 3020	2112	iexplore.exe	28
PID 2112 wrote to memory of 3020	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d72144111e2b81df85510f62ce11da9b

SHA1
c7aab216ea7f795bb2b8af518b7c83e9fd266ed1

SHA256
5c71a36d39db407038babe690ea54ddceb3d0dba63845acaf01094dbc519bb33

SHA512
c50b71318d87ea12138d357c3af91840b72f5dd79270a03b380e44e47b0decbb200b518e5d9692a1ce9f73c95099a4e6a695ce6e371e495a0a915ffaa40a2ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9d046322154538d30f05a63a6250fab

SHA1
00887ce259c682764e9e2683667ba2770bb8fb55

SHA256
08941aa95123c05c7e68b626c96457a54ab4c6966e7f4289205641183840845f

SHA512
ed3525ffaf8ffa03a4417f47a6fc7624d7304a1c1352e183f4542a2507fe95620fef89ab82e0fbb9a4efdbc3e7abf17ba67865fac302af4e98feebf55b502ea2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2daa795f8d26b0ae46dcc26bcbbd0e33

SHA1
c38be410eeae6c92609a00cb67368f22f6c103e8

SHA256
839360d8dcba5a959c65d47a5a89d481fcd4666597944dbbadd3dfa003123e56

SHA512
67ad07b06b2e92e4832c3c84ea3201ceecb69402554c65012451e5cd4a2052a2d2e25faa8705e02991085adee7b302ebbada015cb9ea9a6a7a43424f4b9ea9a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e328da88ca494502f62ef68792fcc302

SHA1
f35f9d7312145b367bf6d55684456e8568a15021

SHA256
41d0c65453e587309594ca4c72f374b5f8ae8625a4025678f0eb39b3214f96b5

SHA512
d3602e632722bd7f8992a1ddc011b710f09111dfca97060ea6fba5b0f178bffe8279ce29571ccf80cf19d9cd45458d77aaf65a4a367c5148f72189f0b0f3b9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d440369d5638f39ccb520078fcf784b8

SHA1
5b05b2a0be788988f028a722bea512cee06ffe6f

SHA256
92aa0647f1db2c4e3f50d82ad1f8ce163ffd91f29a9aa7585f6d470458f4fa18

SHA512
73fbdb90e37b5056e77319c9e4d7ec0874fb3710f7751053b679056f19295b1f375477899754b7071216645db021ef45ce40362c118fccbc7f644b0b02d8d109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36e95895d36d658ed1b4f6b7babfc2b9

SHA1
6be65230892b8e05f9627a47be886307bbc23e68

SHA256
efed7f253350b2918bcee57d98d84308bfb43558b3558599a916db177ba17be8

SHA512
74091623ad8636d6487e6810aae11b6572b4b016c2c806e6aaf1b5c20a470edbbc5d46f45c46673abeaeb7324e15fabe7fd115c127033416a09b77fc2de8b315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0cdfc7405a644e3b13feb10cc352f8c

SHA1
6d6c8ff4d226105ac05f565ac06cf9f4935a0d3c

SHA256
0667763cb83af8cebd83f0ca5107c10d22376f49bdbf9aa287baad0b355d6cf4

SHA512
d36f3386f1d0541ebcfaae848292c066df50064048ccf321631c5dd9877c1e9ce808eebeaf14d14fe53a8d37f9f456c6298786ce323235173c5532c7f1e3ea5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b7eaf7f8319f6225d793745dbf9414e

SHA1
b7cffc1a54ce373cc94edf66ab8e11bee6737522

SHA256
36990a497268f77cece0002469a2285f83eaf933883331c4b40df754e058cc09

SHA512
05fb302fe186c660492b9795996dcd6dc02092c579029f7c520e50b14cc234a6c91503829d280db6e478ca7171ca8733d362a4b9136e7856c148a3a77bea206f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21fb844d229beaf0c4f9396caae20ad6

SHA1
a449bd43bc5ec027e5f4b882e23850b9ee8e1058

SHA256
388a1cb8b896042eb3719a22d3180f81705d99d5874c3e433a1a1bd8f8ec347c

SHA512
41149873ddc1bf6b9f981f2bc0107023a526fe6c9ea1a88a0518c08ca0b037470670b241eb55cf325508b6fae2acc6a243e0fc7cb831cf82734d0dbe34869156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\41QT7P0L.htm

Filesize
16KB

MD5
7526c5fa41287b98030ba55692454ea0

SHA1
34575213aa4d9f5756324050ed05d37610dd87ff

SHA256
61d362cebda315023baf4504c491e4296356e5b944704214e17225da1abc46b5

SHA512
89f60006f15ccfb470122c860392b6d702d214136cc061aa43c7ecb9be65175846bc8bda113868c3c14405bd3907973535f71bb7f66d6ce1e1935e8485e0e0af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\2-Asian-Girls-Oil-On-Bodies-Kissing-Rubbing-Pussies-In-Scissor-On-The-Bed[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab869F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar875E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit