544a570ee354e9ac550d7dc11a5a0bb97bab857b209dffd097404fdf6ff4f93e

Analysis

max time kernel
189s
max time network
226s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

23KB
MD5

7e614c861d59b1d3165de3375aec7c9a
SHA1

686b25e32c267448a459563730197507eb9edc04
SHA256

f31a2fec954f18c10feca181ea8f636eaf1eaba282261757f4f067b709cbe2f9
SHA512

9ac061ec6bab837542ea0e839a59c3548340cf361274d9db3cd7088b43dbd5d85b17de12ea9c110a4b14ede70e8bafb7c52deab6848f877daba9747f0721cae5
SSDEEP

384:Ij8pSFpvsD8hlgUSHCPf9aFAxddJdmpqS9ZMzd/1RFzvMotdvu3hl:fo9rMiPf9aFAxddJdmpqS9ZMz3M+dvaL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000fd06dae9e6e78f91017975317a2fc73a0f7aa0b302ee219fe6250db21c7df550000000000e8000000002000020000000d3b43d7b96c07e87a9228438c820e7cfdc240b97478893dd3829319281a1878490000000ad8a9ae1a3df7afbf54a87e0caddd4871d72e3b039f8c02a4c833716fb9ffa2d5a5f1a334c7fb98356b9306a48071eb391a491892ffa196986ec4ef35b1377726bcccadbbd011e7c081f707e3aa884fe6e8abad0ea8d82d3bae7e8113e4ed3266a17b6023ee09578e7cfba989fe617925db7bc9e6aad3cdbb68cc4cd17249daf22c2d5530423b57220962ae1b6cc47da4000000070c6666ae8ed8505ddeb451b348a856f016b55666611a7b88c2ea649d51ea640b8b1b92bafbaed8f68a14acf38aa16d9e912d2aae76efec2a32403ccaa93ea6d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409855018"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3D01450-A4D1-11EE-A581-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106cdeb1de38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000005ee408fd4eb807eef8387d2cd85de8c79355031a8258f0ca2f2552a900f61e04000000000e8000000002000020000000def1310f0e20c8b37b0e348430520116b27f0cb358bff4898455e7bcefe4c32a20000000a3a3a2cd3b2e0a105dfef40113756346536dcaf19a9d35a9240d624090a43b5340000000fa406a892b13b208512a0fe0d8eba3481404be049ca79b595fc74f1cfd041e0a79170aa5ad7b783245c05ed4284e88311032547ce238301c38023e97be90c01e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2436	2700	iexplore.exe	30
PID 2700 wrote to memory of 2436	2700	iexplore.exe	30
PID 2700 wrote to memory of 2436	2700	iexplore.exe	30
PID 2700 wrote to memory of 2436	2700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e3b071f36e93103d4fbf325c4a04eed

SHA1
74a73543f38b4225ff9356d39305fbf9d84b56f9

SHA256
09433b5172d29388b3fa53b0dedeacd80cccce3b35b87b8309f1c2a02230e6da

SHA512
bfa5fbd0b6f527d7c2479c316421761957139b1a25ba79a7dc4ef6ae6088992ac373213c64ea977d47e06f28278407d1790cd88d8699f1dad7923fe3683d68d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63452b17247344fcfad6cd8a73adf29c

SHA1
2d5ab12488ead06fb877b37c8e1da86dc0298fb8

SHA256
4bd24a57f69b23f8c11c3b7103df9cd5e20605f0817a376c2a476fef3b456491

SHA512
6055ad3f9735db012c9e98e80ec78f2ce82005bdc03970c1b643bcc9dd7f0529835f7f89fb1c4150c43edeee6f6982bda0416638d6067e97eea21c8b6e463924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f0f56b5aae3efb3c151d9cc9cb83b72

SHA1
a4f45132c67c94fc7963735b69dc75146e09aae4

SHA256
1323a22d66bb1c06c37b4fcb2aec5e55936ce0b8574ff91aa1396feb9ded5e2f

SHA512
5644307c044d8213aa03fa448cf5ce68d1460e1f12303f93df435fa349058ca51ace5663a81f3e37f80a007e138ae93f6a1e4ab64b82d8b55aaa7c307f8bb305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe0eeeee428a6d834823eb1613891db4

SHA1
bba95c712b5ffa7094fa2065efedfd623d9e7c4d

SHA256
50ea511cd2ba2c5a8dd09dadf217ce41083d8f91e23d3d5b97186a2a0fee6de5

SHA512
8190640e43eecc52e8920c9131a312e209343c13b8996f492b1b384d0c0e47fce3b7494a1159207692d1ee6d7e87fad6dcd060188b6fe60869bf4b745a15606a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfbdac13b77269fa5e71f5f86efe0eb0

SHA1
8ba04155ee9163328466e8031f3a283b9fdb1cb7

SHA256
f2970c8076c048aa6539800566f032b06852343c0e17c2a4ae4e7d6e4fbf0af2

SHA512
f9a45d50e40b850540a3f540ef6add5c9e2c9ccd4695e2dc51e311348ff84743e04db8919dcd2b6c81af659606f4c8f927c35103e5194c0209d9af08f645ed16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba81dd041c10d47bf72e36f7154c3f2

SHA1
a15a145add66fc2ae89698a035e51b77ff5d5807

SHA256
a24468eb6df811aa479dd85e3b3493d0b3f1f2326ca64f2c34c1a9075b09f00f

SHA512
8bff0b04364bb9513a082aba6a24daee2d81cf44db18f74dc45254e00565910ee86298163a7e9521873f761014bc089696ac5f5499e57c564919bc3e4d517148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28cf081f53eeaf3779f12b2af0747ccd

SHA1
0162053cbb2de8fa1fe297830bcfe1fef88b90cc

SHA256
47445b642b28e5c3c70ee57d22312cba5444f699c02fdc6b85a4a765d1f7339a

SHA512
afe10a69df59dd0588420f45d054ee29e75c99685524fcc6c5b3e17310387e67e4474d666f719fb02b3df28ee47b0b0a8d56a3e1762434b7672398048aff5d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ece89902ca8531b14e7539a4d761053

SHA1
ecd849178b3d1190ab4d6a196b6b14e0eff49b1c

SHA256
6e7382fc3fb0d743e5e7dd4a0a9ec6d56a3d6cdab5c197de17fed070fd2d6e8e

SHA512
fc72d97cfe24887f9806c56fa05cf68c18d118880d9fcc8e21d005445676bea281b0041f8361181579d809c34721fd4f04ccf8e58da95a6f335a239dabb339d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e12a3854fd76a09d09841e347acbce86

SHA1
cbb33c7bc5fc4986a669d1658ceea2102e5bb15f

SHA256
347fc86f29a5610fd1f85259516ba306822d4a7a3bfb6cc7a70e1f23ab1541fc

SHA512
9b52be3e0e4b477bf2a34348be5204d20833fcc00078621aacdaff0c1c2568e54fc0960f9824f4f0122cfc795a954cb06b5cbce2460d954c4258d1cb7ba4302f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
148f30f99955814ee5a7b4186d13d24d

SHA1
3c304bf3caea1edac2ddae4a7ec5bc2dd2dd83e5

SHA256
6c2dfa060dee9e587435a806caf360b0e9d5255e56cb8f38d96be45e518f96be

SHA512
5d79d8cccf6b0701af4cdcdb21de784de142ec2f166786669189d47000109b0fbf64a893c0b988ce0054d7e3bfd6a0504c5c3b7771d15f32ab84833fb80d7d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\Horny-Latina-Maid-Got-Fucked[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab94B3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96F7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit