459199f43fe442aaa3718d5d70849d078f04af3c4a49a1f7fbcd932ee17273b2

Analysis

max time kernel
137s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

22KB
MD5

ed88f75d57533b46fe9a95590cff6a05
SHA1

6edc93154494050dc27e5bc730885b517a1a2d93
SHA256

31e9c2c84e01586526bed0fff3b90e68416f76d3be7e29ae3aceb3837a802a4a
SHA512

45fe697a51156f0a335a2fff79ec43a67b6546cc0972e64770f7e00400425b7e5b41171a6cbd5bb1c889d4a4e3cff32cfb6757fb927ff3ca02581345a4567ff2
SSDEEP

384:ZSFpvsihDIYCDuNB4P9e/0o6/1RFnvMotdvu3hl:Zo95aBDuNB4P9e/0o2M+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409727215"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f476e1f02b0c9002118ddcc1cd206ebb227a14e65931ef9bfe405ab673f4a2eb000000000e80000000020000200000009193d4fea4d8789e933192d91fa58ee16316a0f5785c7e397a35b96628e174a69000000012e724829f694b1ee581bbd40efded490158578a9aa3b46bd276fa1224dcd0bf7f683859ea6522db30ff966e5df42cc6b8dbc2744f3de14c4effebc4c61c63ac6cbb706312db240256248c92208da4b521abd0069374605f1bebfb34fc7773056d510a330d55b6fa5c0ce3f94beb8fc37dbcacee020f2786010a6aa8f7d82a02789b5d0c6ea42801f3465954ac3c2b1e400000003638007c677f814211d37117bd39f4a3b7e4a1a096858f73f8b302639faa978427fc0d3f38ab2849cd0430f70d097f874d92c2af9d1b6e14aed54722394328d5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40178b22b537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000097425edeabc3e58c492518bce80e1832d56e9cb86f5b2514017dd92778e8e1c3000000000e8000000002000020000000ecf9eaecb336ede0f3a32531f174159281fe00725d1d64839c3f76b6577c10cb20000000b64a52e22e3453d9c003a9fbe7235e4150b83b7ba777ef6a20b2bb6e5d3094a04000000023c42bdbaa70b8088f288967cc09d3a93aed17a2f2193c88f826a3b8a7bdf803459965c0e5f3064ff947c9e8405d6e8ff2c8068167051f42bf2aba635e5fa620	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A47F6A1-A3A8-11EE-B696-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2140	2404	iexplore.exe	28
PID 2404 wrote to memory of 2140	2404	iexplore.exe	28
PID 2404 wrote to memory of 2140	2404	iexplore.exe	28
PID 2404 wrote to memory of 2140	2404	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22fbb6b08beb13a3cb12b9a3749ca37f

SHA1
6e09ae0240cffbfb8a9a481f24571dccc15cb544

SHA256
13e0d95ffb7cab925a7c057f2dd902f36149010ced7f4f45190314739b436076

SHA512
ad93071757aeb43ca1e4530b54fb285c14634f2a7cbe61b0c2950bf52e698e60b6cddfc1f4761558793d76caf938035ad8e5bdeeefc2b80e973202b4be488200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e952fc201a2cffca85defb973d1e3d3c

SHA1
26fee9a38dced575c528f2cc9453ad461554833e

SHA256
f8eb047d1408e554affbe5b482bc8f9bd50b8fa06318b212b4c0cb26b915bae5

SHA512
f3a45b2a0a6e57288876c9986d70110118e133c514cfd51d5c930bc7e12db4f31f21a72b18915cf6c1d47a0638ff76f8b072122099c39c06b55b75fcc91d3d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d1499690d353feba1b294822dc726e

SHA1
f6355f310498eba0ff5dc4157794ae5eeb77016e

SHA256
a7a14ff7b1ba776007f074471c771f01672d6d60539932cf72469ca73c303c23

SHA512
70fa7d6e6a580a54103080368596de1a5c627fb6acdc33047e794f4d1a503cd14c0fc531370e69f9d24fdfed9c725c1faeedd137a95435bdf8394cf86afeb992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
636d97a7be788e2ad14dd02ef40cf903

SHA1
a806cce8aa722db259dc925f81dc79bb77392a18

SHA256
1dabdceae7a62c35f11717a60a8b81a4ea5b65e90b1702f6afc3a10295dab38c

SHA512
fc3ae500056b2942324a4f5296bbaeba35dfc53a347894847a4218fe10cece1668f293cc6a17c1ed2919d01f26ba7e6eca46c92d2576434f692f3fcca23ce12b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be019dc0d76cbc86c7d4c82e03861f87

SHA1
4aff0e3bd3cec592b8226d984c75ec406d4ceaf4

SHA256
2794fcecbde29c21d4d05ffbcb9311d4ce2743660eff14b93c04517f58a00af1

SHA512
2c9c8d93fbfe62e112e17846c08fbace297c03fb8a5ab810ecabac20a8de1f9018801b1c5e66b265ae16264afc9f596cfe5820f8d44da711be17de31a0be7c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5860a9caffe9f6ab36960bf1d6bb1cc

SHA1
ed8e69c925d8babe7257dcdb407f8d10c0aea07f

SHA256
f6f62471147d07914888887a3ff6259348b9350c69288ebbf8d0bd363961cf82

SHA512
9a9fa39e4e40e19850d3961d30b35e5ac973da7e3caeb5d67adfeccd53be76e33b253260dc81caaa518bf4826042ad2ed295c90454f18f2435210c659764e075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d49f1ddc6bb16a7bdb2803eb07e3ccc

SHA1
b1fb2123a3027c69a7cabddc0f10869bc3884a9f

SHA256
ad7876781b522ac249e1c42dc537d2b312b2710258b597f6eebc0b527c7d52ed

SHA512
37eaacf93b1aca0c445983ccffe51e6a72e106acb7a9ec7a89265185f5179f903e62c04a41699c21b6b94a517063fe6dfed07f4109d3cc59d5831f8214fd1609

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e04efa1c4ec37b4efd733b33e74bb94d

SHA1
43d8c9aa1dfffbacd4d923f2de1f8eeb5c0086f9

SHA256
ece33debd51e5188d7e54e455568af1d5d897f4646b13a0e4a1dbf955dad6c84

SHA512
a1acef978bb6a148d3d3a6c146463aa7c50cb6cb2d6076c6bc8403d35e9d003baae589ec1e4f7162e5a4a33406172b704339ea88223a11644a3e1a71f7ee778c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b30eaeba47b3f91c8ced327fcecddb14

SHA1
2553e1eeec70f3d6c1f994c2bd4dc9cba5080e8f

SHA256
1267dd6b472d71e8cf47e756bde014127cd95f79a29acfa1d846be1628f49ef5

SHA512
1f2c4291c749583cf3f075f17141349372c9a7c8192bba293ee4b076b3a28f0d3630db0b821dbd1228912118d6b8ed582e1a73218c84a3b6e8089e5d50dc1ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11eea3a52bcbbcdc46678c98b782fece

SHA1
6973156514256d671396e3cf87b697fefd896279

SHA256
74a37892713c510bb4a7b25608185aa04f7e95a089c7a0ff4be48a86f5fb92a6

SHA512
5350d952c9fc6cf3d8cbfdf15d2955ca462c4792f1c5d3a829aa5338fb743b4ab60625f5cee26c50857ea08f2ad0ab8bbcf76eb3f868979c9d148aa59cebb5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\XVCBU3FG.htm

Filesize
67KB

MD5
4abb8cfdccbd4bf499ef4cd2dba1af03

SHA1
f0120aa5d7341945637cfff372697319d3c52c5f

SHA256
c7564da7d280a5658c2686d8a4951e8e80e1da108a387236f5aa1dcb9b372958

SHA512
9e2d4bd70577d69aede153293723c07a80be724e2b6ad5d8cd75c0b9856e877c24e419e0776f0821b7fadee530354024f108aadedfc984041fb2a569be1886f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\Caught-hentai-gets-drilled-all-hole-by-tentacles[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D8D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar71BC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit