439f870727ab78629fdfdb32107e30287d37e89733968150ef5fb7d56fe5cf17

Analysis

max time kernel
179s
max time network
276s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

21KB
MD5

f5be5ead053e118a14adacd5b7338f43
SHA1

b142a13c43b99fd15326038219af4a36f20dcd3d
SHA256

a5c01e120f76c535c9ca571f5f0ea0fdcf5d24c4f8011bf2549b12dfd046b50a
SHA512

ef6e88ad062b3ab1d0efd7968997569c21edb82375dfbd7e3af5f5858754fcee3ab59f1664969267a49c185deeede237e1d222ccc7cdfc0586fb779d88945f68
SSDEEP

384:sSFpvs/ubACcWeSxddJdMpqS2aT4WYm/1RF4vMotdvu3hl:so9GAcWeSxddJdMpqS2aT4WYfM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006032e3d40829007098661da2d62919faa4606a1c370a5b707e31d2cc8b026667000000000e8000000002000020000000e9b5681ab236f5f224c783b95585cef611d85b05e55e549b798d3130199414942000000053f0ff33b3cc10c276e95d61188533d5b336af1990ec4262c020c22bd8768e6540000000487daaa61c8aae7bab82ad1c3a1f829cafda316d67803fcb0b130dab488df7cd31d60806f537e600c94b2c49f8002ddb54270bc1395178d6782ba94f46a10fa7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b19508af3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B323781-A9A2-11EE-AFA1-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000685ae3929c4e5f0e027e11b4b1b47c175e12ddd65c3551b1c500e507598bc7f2000000000e8000000002000020000000654373a3a071e0553d9fb705a4f59e1fe73b9845a2c1347339a2c8bede035c9a9000000046afe913348ebef01777decad0f666b090d5138e3601767c1126ab019fabf15936b9e66045d436155efa6ac8c8bde3d66f4889c64cd524c348baa2d59adc5a6bdbbe3e15936f303859279ac8ebad33263e6c1ffafac0e336017d6faac980675a2788597eb70da8b1c4b821035e6b456869390ace46225ed918fa871b6efe652f8cb32b790e5f11277d11d66f464466b4400000000ee794e80559a739d6dc88d8bcdac67537ebc8e569751d45ed79981330914cfb34a50f4db1908db4503ff5fc93e81cadddaa2ddbfd306e98d02999680a38fec6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410384301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1988	1864	iexplore.exe	28
PID 1864 wrote to memory of 1988	1864	iexplore.exe	28
PID 1864 wrote to memory of 1988	1864	iexplore.exe	28
PID 1864 wrote to memory of 1988	1864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de6ad51b904fbbd256afcc9df0aaa6b

SHA1
a2e3377330eb3ea303b41fed7f40710a7b183b74

SHA256
901edb38f48993689a48cbdb294eb32fefddca85ca70f224ebc6c602b4faaa75

SHA512
bd29f3056f4a39b42586ca3bcc9cafbefc6d600ccde5c2d85c666d73df65d387d693487febfe69da2d40bd260f7614cf1d62f53b0ba56d6a0117f845d1531e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eab9c9ed65d3f19a7eee662e4fbb13dd

SHA1
6cd2a0dd32a70a5cca5401994b757a846c2fa4cc

SHA256
df33cbf8b2c3c3bff3f31e5cfc6b371e7ad4ce46eae721ab8576d80385f0111f

SHA512
a51a2414324bda89d5de87ca664f0a32599d52f2b11fef5d4c5cb401ce5579111b6e15e442bed651e1f5e9980dc4ea2c96fa62ca1c1a8ed1ca7f8ce35b55ae76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cae572cb9666038211b0623b17b1952

SHA1
aec4b2cefc26eeb5762c4754810a2e0a707c0d34

SHA256
3903ce5b6701ad9a471be53f1cfb5128dde7f882a9c141225389ac73d850c07d

SHA512
58946e30b4088539e27750d00262295522a61de0a964e3e27492661719e5663023b86fd7174e2878534fbfb8be16f3729458512189da164436131bfd32a5ba83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df6f4ef749a9c71368967d40d366238d

SHA1
788a3e0e613ab1b08c65f3fcd06575fa009fa1c2

SHA256
89fad2da0e230dbf7233d2fee22a8243bd0b31a098bc90c89f1148344aeefe07

SHA512
9a44afb6ac135a96cb53eb567bf768c30d842e7eba3de908964dc7b894c49389783514e23ff84208210a0d6de03c6a33ae4a61c908cfdc927c8c051becb3156c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc1390e61975989015b15c54f2be173

SHA1
8950ffc86ddafb8fdb7471a9be19cff6d7aa785e

SHA256
acc53596065a60806e4eabb8e7055f8a3fa02339386ff70abf716b160f4b4473

SHA512
71fd8c637ddd7b400058f808b1936113f6e384079fcc9c820a8d64b4567a2a15eec0e8b25eedb442ab423cecae586d68fd59ce59ab8b540449c9bdc10d4f0257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a169e645a19398b64aa61b11b010aa4

SHA1
cd06587e780866f8ccbabd45ca4e69ca5dcc86d1

SHA256
26e3e055f1aac46aef43533e98b8052ce0b50fdb3e736f2400f5025e4cc4e6be

SHA512
f3121aff0c20298b7fd13b329b8b4f983382aa3309fde031dcac48b28104ca1861138245abc206b58e067ae63d9caca6f04309ab4c7516e4cc96f36b3615d4a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
837faea69999392c99062519b4094e75

SHA1
984b3fc06274c57e060e350e0758f0ed7a3af33e

SHA256
56aafcfacebc3a02526d4c127da24f2e02e2adf69cae07daf3451ecae856df22

SHA512
744cd590034f648bd1721d5cf12b9bb57943ab2eb667eeb97fe5a9c3839a4c877ce1abf16b0bee0e4c2e341fe2d075668252b487330c356a5876261073c9d43f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
facb3bde838c3fbd24acd78b2835e292

SHA1
f756c7b035acdee7e94dbb04c86633e4a03042d7

SHA256
c3d2d4ca5beeed5b655bbcac0f419922c4f7ca32913bbdc6ad0fda7fc4f5e4f4

SHA512
0a8067ab6bd6532e410f724eee4017dee5dc59beff860713ea6fe6f8cfb93cade2b7ea031d304ba9d816b05d78279d55e1939fae7e882e064ee620593b4a055e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2ad4e58afa6614ec2a1c8abc95f93e4

SHA1
1dfa105a66b1df7c6b7da95019a2d08205cf52ce

SHA256
678419fdade6dda9b129defb557766d9cf0e91f49814e7f27a7b48f51b8354c2

SHA512
2f1c4fd4883cee79fcf77e7425f1a1dbf32b874ccfb5ebbcf30c01cac868dc9d42fcfbbde1dc312920eb708acca8680c0bf9d4ab220bffa3421198381cafeaca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aec9c5a49ca870b9b1fb959d1773981

SHA1
79c070bac8303e034413f83445528e2f69fda1de

SHA256
52df9888798c4751685b327b7cf11cdee80e2d7c724806403d6405f34c2f0f3d

SHA512
54d081933b6d4add99554deef3fe61633d610cdf3da6c35d82056487e5d00dca88582c4cd0b60cb214ac9fabee15fe362b064ac4c06a64b015fcd7ed98d2d35f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB55D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5BD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit