585f5ea333b0d0ab06e239d1533532cfebb8e55bd3505c6c7f56e3b37536cd56

Analysis

max time kernel
180s
max time network
189s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

20KB
MD5

8eeeff5dbfb75d8bfd859e18b567e028
SHA1

d80ecf9a93637f491ded47616f868d40ca98436f
SHA256

942739749451930de28f1720339695e8e4531a5869e81afe6f0bed75aa6420a9
SHA512

e02b3657925032b009707a91a81c220bc9212e93b1c745e54130f1770ade6b26dcd825cc29a3687c910f585f03ec8dfdd350bbc598f1541d63406688fa2f9689
SSDEEP

384:i3IiSFpvsbxuHW7tCWXxddJd25/snVgV22/1RFzvMotdvu3hl:Co9kuWXxddJd25/snVgV2+M+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b42abfe0f3911f1d332033cb8f324449f47acc7b24ec70390e3189ff5eb5190a000000000e8000000002000020000000e53a6b27edc5d7598656b4bd139cb62a08bb9b8ddd9fb308bcd7bfbe7c243cfe90000000a4afb13c1c3e96169b9fed9f5c5243bdc1af0bc927c0ce0af19c8964e39cc619331b2c0e8b99d9cc5652415810cc47598136fecd972310339c0236bcfbd95303c51dcde438df13d3ed16f1226481364554d67f6fddb36eb46bf4a03265ff08630c0b9b9c88b1835ef3a62636eedd8217cfb78f2d3eab3c73db9acbcf18a9b37e9a9cd17d3b73f54bb759e286af659ee44000000088db4b39fb4e051525d10771c46c4c899177e78c46057e212f13936ec3f0c073beb1fc3a91412bab455aff2518c92652326a71a6660b35164d9af01365c0d0de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20443a025439da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2306C7A1-A547-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409905417"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000001fbfdb3185c248a23c0e0437537cfcfc73ca0f8e966aabbb7d4523ed803d646b000000000e8000000002000020000000cdb77b9534151095c854d009a41d6a7c21e33b48bcb4e381e04513b48706818a20000000e3b9811ef6ab117111d808595ee7ae9cd2d7419c2e35abb2999462559698b36940000000e65f1abf4ae2335748b2a19709ea9042c92a2b1dfa698c43934e5e7f525613db3c73f100c2690af7df5ba3e4ba00c199a6ba6dd206a071ac8d215ce777bca7a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2132	2784	iexplore.exe	18
PID 2784 wrote to memory of 2132	2784	iexplore.exe	18
PID 2784 wrote to memory of 2132	2784	iexplore.exe	18
PID 2784 wrote to memory of 2132	2784	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e14f88fe9f8e6244eb7923194f39673e

SHA1
9f3c00ab97110a1d7fb8ec7ea85ad34274551cfc

SHA256
4c696fb0145908ff1aa6f75954cd349b5afdc38b4f1d177c65819cd7771f89d2

SHA512
2ecc93d9a2a99cf70c388ec884796d16327af647be7300e77b62d0951f1cd3da17e022d2c2c5252484a88fce3d9f57748035084f0c24f1378b69fd76c6dd19c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab7796909c8f01ebc1a94c73af28bd6

SHA1
cc296ea31ffa8fc5be22b6be256556acf618dc20

SHA256
00631caebad9c13e89a17ff12a76b14ae8b6190b45c04902ce4551873004652a

SHA512
881cd22b64d349614f45dfa2fd57ae377aa4b889551e425450272e6a7fc55c921d91f1c5690bc18da745026e89bc6c2b753649415898eed5064044b636d78f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a944438f4a4a1042faa19b8532b101

SHA1
4fee4ed58b53e3e1555e531fcae89b1ec24c642e

SHA256
6e53fe5090f946bf52712fa30f55504788eba8a3081d7cc8d754f53fdd847aae

SHA512
21fd352cd92b5a8104f398a67799d60818a86371dcdd03658e870e1bba36afd4808442ef3b8f4683b281c82f3e440258c0497e56174666b2ed366aed8aa930ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dea29f629077bc1d1350d92b8e41cc1a

SHA1
4a6f7633241d673d3d5f34fada7f45adefacb096

SHA256
fbc869dfc244be96a3fcb22602df37ca2b1fe752880365127bca091a7b08a5c6

SHA512
9de2235593749c3aba3949cce4479e0d4ee4c1b35311143a220e2b7b186df052b574ab8b0700529ed4a00923a347073a8b4bdc3be7175c8d6f178b979f8f1d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd2a3b3ce7140e8c8091d1d813b99f0

SHA1
40e0367266e425ebe487e4bbf742177e5f8e7cb5

SHA256
740836f89e2299078dfdf487ce4a3dc3d18803dad65d678f6668cd4755fa4d40

SHA512
6f12d98ef5ac620f45d63643aa1d3ea3d7d4c7482d3626e72b58909828d04577549b34c33de1ec6a152f0e6c30d5d2a660162d73f9491d5ba725f0c02b9e4761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07a7a8bb632db9cb83f9ecb14e433be4

SHA1
8d7aca8c0d34a7d24d8d2ccdbd8a39cc2caf6507

SHA256
00af8ae05177b0dcd5d712c86ecd5cb27b48f58c4f8b08eee60ce11a7bf3b202

SHA512
248ea323eedf9c87c8a9aa8e3c07055d68fcf5625b06fcaa2e99e29213844994aba26654c54d98bc5162372625355f114466131f61d14ccd0f8d70c01a860513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b790e05c92e2da16eaa6fefdc556cfea

SHA1
c0af9a16199cca863f77d62bec09a44173ac1df0

SHA256
68a0a24e9d93ff59fba1462aeb7c52e6283a0bb8ed79ef595f31fe915eb82051

SHA512
9345b02c2f53e5fde75caec91a859226a682af94d29008b771c52b6e3d0dd6575b140421bdda28217cef53c71f0c0352723b57c8d15c524cc0d6331cc32c9fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d35a04d589d61130789a6d00568cffa

SHA1
cdace2eef22f53515549ea5eecd37105b015f423

SHA256
fd8ca174383d0cc4fb7879b7e807984a480355218a7555cfc5336fa64979f07c

SHA512
70d5d51d07b8bf42edeeb4d0f579beefc152a283b3e8738d37e87fcf045d47036599994cb9c869066b6941a15b8873a8f6de5bdacddc43a08c48f66a16f6fe5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6788bf10b770e68655ae6d63b3cd7b3

SHA1
ee1d626718a60368309a614104535c18ebea1e6f

SHA256
4135218fc9463c5d71060511639400a194fba31fd4f4fe9ca7433893da1b926f

SHA512
ffca3bd5acca2b2ca8ee13d9bd09f63ef48adcfcbb15cb8e7b883d824c176a9f4b82f5248d3f5ef924eab912d1d14429906f18c9f685ce6dd0ae7f5397d020e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a07468f64a6a5984017a6ad135dfff7

SHA1
98b541e9170118f576431d11830d85d76844c722

SHA256
1f9b011e4c408d2f7e9b9a8c72c8d9ae14d974d88de732fff8671243b89f0f40

SHA512
0b35715e7a4e0738f4841331248d2c3bff1e91db4800e651722efbc1c2b4916d62f7752205d30041ce274b02ba3b46375602c5219a25821b092f6f5f4daf44e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aa5ce9ee3cd0ec4aad0fa8b6d356059

SHA1
533001ffcf06e9799ac92bb0f98f3eb4008ae39a

SHA256
edabeaa302ad44d25746173f27c044d4ce97660f76e55888012e1d55f5cafa22

SHA512
28cc2cbb07437d295f94c9deed0320a2511a270fc896cf56af91584d972dfc9d8e142112f6cdefcc471b7c1a96878ebd39de7f73f3194253f5824c1fb04829f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
524f78cb377dbb47522578f7487bf75a

SHA1
b6c6e9c2403486fa4cde9985e17a36c0d149a084

SHA256
e2ea96905eadb8040b800ba9946aee6269227771a724e24aa4228ba6d6a73f06

SHA512
0b46de0a7665732b0ddfc7141d1fb433f2af5af6742c0f3c3b6d7f20f7a36a6ff263d9b926f17792670084bf508490c4fd3148ce00d6c60f3f3451c61253c607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c36167e0e3412fc4a2cc279e5d08fd

SHA1
5dd82c693323a41bd1a8fef90b10656d03d27b32

SHA256
e5a94c030b55f6816673356e739fab0270022f98ccfd5081d87ea0470bc6be59

SHA512
55bed5519f0158a4a89adc9fa6036d8f27e9abff47336f6f7d0863978ded63a2a0f1a0c1f073e80f49d1133aed25b758242b330f3c2d8261aca0ec0bbd230cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92a829f05bfc1c4b9cae3dd8332837e5

SHA1
15f0aebf7774178966acbd637bfdec60b0841e3b

SHA256
be4bad25554cd2771108319114567ace481554116e96aebc4483a6c837db726e

SHA512
10e6d338a53b41737f16ac23f028b9ceb64a0ab038dcf4218fd12a6477c9805d24a52566a579cdf9c652ecaeda3aa1f2ee8fcf9e29746e2e12572616d8352dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7985fc331d88a30cfe190683bfb1ac85

SHA1
bf0ba8b3e8ff04f9b1ec10763439e31de6a97ed4

SHA256
0406c807978d19b0e1fc4121579bc77d35858670434cef8d00515bf6227be6dd

SHA512
918e035bb99995f7b5030c92cb3af85876a042a01fccbaf2a47d4deed9fea4c123f019fbb6897ffb8c1b71c2d008d8086fe830e30d34a2be680dea63f99b94af

Download Submit