e1947d350f040d87c0d61491edf1068f66e78f9adc31978854e891649d13ef2e

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

28KB
MD5

a1b74ad9605c5df02a707b754f2f70a6
SHA1

20a0066c59cb8a87e2b41ce28812a4dc1d5c8855
SHA256

31926df16f90b2cc3262e33fd7b8fe2ab0fc0f07cde258ed3da24c83d65e4e7c
SHA512

b19074177cfa668b42d0eaab866a313b5e46fd411c0bd026e10f43eb0a8dd21295730aa58d436a909b7801e78f41b1ea7b182d515c0470f29a1e5b7f9e76bc5d
SSDEEP

384:SITFpv1bHXThdFe6llc+tYR+/1RFOvMotdvu3hl:So9BHXTxe6lxtE1M+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A885371-A51C-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409887095"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002402d76b145cef8cad2d47c95634de892ad648973a6b2ebe0d5ee9db80a71a3c000000000e80000000020000200000002b04177d3ffacd1e5b40ee79d12e84cb4d409eee7e36de6b50f6b0432d8d88e7200000009a21406c86bb06f77be16d3a7389a41a4fceb9f60257747e5cafddc395ba68a6400000007d0468e08be66b492e12b4e7ad7bb072f7a128c9bd1c2165167271985930d5add10748553862f176bf72bfa64d0a31ee49d96ce49fd97b163b6f9d08c8c9d2b1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ce23612939da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000d58887e25aacf76967fd55d55df62aaf19a4fb13b283039c47a958df3acda6b000000000e8000000002000020000000caf6e8b3202c6f0d5a11cd75960a84fde9f9ab0531f6c47030bbff917d44ad0b900000004718658f5dc62eeac785f76b030e37eca57d3cc276bd6df6c62b13ec1620b297904b21a30ff74fcb3bcc6b3a58330a87ef66d3c69b8e5eee9a908cca2af04fbd0a474ba12b9772eb3f85df74732f5dfe3065968440a9a5da7d9c2386209f86a9ecfb07920f3568bff061d83b10213c6b8916e6cadb0b3a32c3d5d0111a2c1915e7750fd93f97de413185ea930383578240000000d4a841317003e4e6ade8bdea5bccae02be640ed87dd4e263adea5ebad902853eda30ae1134d73afc07584fa7948b5bba079a9cc3ea1cdd37bac9ad5d53e812bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2840	2204	iexplore.exe	28
PID 2204 wrote to memory of 2840	2204	iexplore.exe	28
PID 2204 wrote to memory of 2840	2204	iexplore.exe	28
PID 2204 wrote to memory of 2840	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0030282e337c776c954276e039aeb8c

SHA1
dd4dba598338392f6443cb162500c034e6f51cc1

SHA256
5de51de838404323ce9c3a3b306ab0d2bc671a17ebbca77fa1e457dede5e71e8

SHA512
36be8e97159ea5697e3f6a917cf9561a29811b2bac67a2b8c1fca8d6d951868d134059574c474996927320ccb9b62360627246fa06b1729473e0e50193d666b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b09a1c83ff516d71f7a176f2daf02f99

SHA1
07d35a5fdd66c07f707efd509bcc6aab82114439

SHA256
b2d2d2ab0c42c68f555594fc56f4a03063f9be2998f298ad8ad09cd0d3f38c60

SHA512
62ab99205f24cbfd590c996651221876bbcac420e4e4d1393dff3842b3808dfe8cddd85c78fad392eecf6100077ed830f2b3c05df9f00e5da4985caa7df53b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
848eb69c219d85d4e44e6a23b0bc46a0

SHA1
35a4a53b828581e3d9230ba39cf7152969ef32b9

SHA256
dbde9c15392c9645cba0952e3bb5f22c303f6b19d794f9dffeb175f2a6983303

SHA512
ff10299d696dd38dafeee3d172f7f518604d65fe14a097173f870be982dfb5c7f57b11fcb3958257964df6542ad17f26555d5e5ad20fd2b217826cb890591578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e0105f482d0ee91491446df77039ad9

SHA1
9c743c5be1e2375f79dc5343b988ba85cd3b404a

SHA256
b1b36818e47d6bcdab1f2dac71556571ebd2c47e03474b881028061386aa5def

SHA512
1e2fc88bb4b2896ae144a3df852d19b21ce7b65cf9989b5ac2a3d267aca4659cb9f1bb069bd8c058cdea20c4e3816f102006fab07a15b66e2f05f3d7bdd467bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9182dda0169f18dbbab7a32a296a3a7c

SHA1
8c9382317ce5ef7ec0a7f402d300c7f97337986a

SHA256
957b9f417f6fd9a5b065db84e5075e2ee6d0f861f2c24844d636b91db8fdc3ba

SHA512
f1ce7c91cc1d6269080cebbb7be4d7fd7f5aff9b2785bb217da5d08ae426fb79ee922d2c755070f1b515a05c63da240724ad535e6487da9c830ceabf1f51d448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c57d92077842bdc79bddc1c62451332f

SHA1
c947cba08c05aefbd7f0ce961665ce0dd68214b4

SHA256
d05e37fa34a0f8d01c0f7ccc5dccb0f6f9cbbeeae527d34bf6607353560fcfeb

SHA512
b6b2996951e411f800133da97f677dd39a44b041b86f67aa79bebfe6b75abeeacd2659b4e5ba6475a7977f9d880ed2e617c13194092da98901b7fa0c52386626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0448255ebaba0aba7a6bb49c877ca21b

SHA1
b6e3e52a6329c61db7e4596691b870f95e0f590b

SHA256
782b1e5cd2ce06fa1c04130430a2d163b441f5456685896490b26dac913c1e81

SHA512
be2a87fc482026a45152d7676ca286c3f45068377662640b7522510a9be9bc1c86f22086690fc4dad40de0e3599bb5bbf96177f28adfec69b216cd58fa3d7384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b2339ed7ea4eb21b30098ca356453b7

SHA1
ee80c6d8907e8df2ca83bfd057f7848a3ec6200d

SHA256
c4ec6196949e81ad8b8f29d8f6611849e5373ee2e1bc97666d36dc45f07ae2ad

SHA512
9fe9e6461fd52bb6c08323aba3774c438467a23d72c77e0cfc79de98249c88675c1124878ca3600ad18d020737207674cb712808d24e8d91502b42cb1e009141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92fdbe19faa2406e80cce847bcabfe52

SHA1
5605e6315d2f300b56e5fc8b640e7dae1f96e267

SHA256
532baaf4ba13c8223934b8a93078cf8c865882e7f55e6804af0ae3094df7aede

SHA512
376f5bace78457c2b381839f821dd8677f2b5acf5f6f3530d95d887f5b7886c4ed463508b3712fb8fb011e4eae7fbf94d38d1e614dd66da41b055ac4d6338792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94a45bdee2f7cc2d4aef491a3f45ac2b

SHA1
48ec541486630ed8c8cc65d8673c2b722199ff19

SHA256
13a86fa7b3cb9f028b43c6d7858044e84bcc01676321694ed96b1deca93e8377

SHA512
d002cb216854db6121f9e0b353d3147d0c991dcce7dfaf43e4be76c74cd965ff1108f5314e4917502b44a4faadff8141399dd928df8a6606538910ae5b3bd32f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464049e441986fbc0cb01c5eec3dab7b

SHA1
7211ad2b571c787adb6c383525dfe02fdf6669d2

SHA256
854565b72373a1b343a4eb633e8b2796b42f1ca988946def4d0cf41f612d3e9b

SHA512
5ab873127f5501dc972eb82287ba227b1051327133a007081603c6d37db4f11698bf2a4ad05612fc0d65054ddd719a7585413619fe03f294322ed78bb980d9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcca089f2b04605a4aa114a331280bea

SHA1
bad5cd3c9e04a9aed7cc6e78948844ddaa41faea

SHA256
d5d3ff9468860b3fad40bc38265c818dc8a256fcdb3542a256d766810b287d23

SHA512
4f1db0c9eea4b55b42fa2be9c66fdbbc15d6628bdfd2b2ecf27dd685ba59269717edd31789d6ba5ec30d7abda3892f71b8f2e9b2df5141d98473723fb56a744e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\VWCZSA6F.htm

Filesize
114KB

MD5
207eb0c6fb34dce8fa209617efc42bff

SHA1
e7e9c05cfea2bcea178dd921f91908bcd2fd1237

SHA256
66b6078e7d3d1ebad0c31c5c23749ed03329ebd9e94d0f92b8d86e7d15cc9cef

SHA512
bf2f98ec2935d429463cbd68d5855e8017dd2569989dbbd50bb7c99dbe5bf02fc9d07eb515b6431aaf90cecb6c8eda10597cb0dfbe6a0a2ee61da010b3103321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\Office-Anal-Sex[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB000.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB198.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit