3f1b6fd9d5537b90e1d6e6376c3266d97383fa7103316eeaf287e2f244e0c86b

Analysis

max time kernel
144s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

27KB
MD5

46493f198fdedf49c1ac312cf94d7a9a
SHA1

0f949417684299b8cec022f3b1a92c0eda1a0f1f
SHA256

7bb45d84ea584a7ff5e62b5da6aef77c857358efed67683cb97c34c6439f91dc
SHA512

7640166a5cae6a1023fc51d47b22a10e4c0be03c29a59c3b8ba94a056f69c886edfc2a2377beec2424274b891f46a9175d02f53767f17d29e7d9864e45a65314
SSDEEP

384:SIUFpv1km+i+Pj0DMrbuMrnyO1fcP4Gw1IQ/1RFRvMotdvu3hl:SH9myf4Gw1IOM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20643879d83dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001a0d138a628e54da8fd94b1a3726d4aa67567edc5a075515cf746a7d84caaac0000000000e8000000002000020000000ddadff1a185b16cf19e9505bc73fe780df531a5875d56a09b19847ee5cfc260d90000000fec89c1f5c318cfd41cfac10befb3a73cde27d9d6712a95285843623cfbfdc53ba57ecc0976fc5d1201777ecd9821580882aedce2ec9d832b1ad1e64b009a9bea18d253835753478cf887b784dcc6ca33ce43b9c4e285debb888cac3092734bd2c3fc83652169acebc456754794ab5196a9b5f65a0d414e1b6b5632e810afd3662319b925240b7372ec4da8e8d46de964000000061a66bb122326aa1d6e6ec14aa9585328deeb4177c3d79dd4da74cb08f3101bfe366244a173bab3657753f5303d94686d74b3b79ad694ff8a0f53123804b34d2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410402112"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000021e9b7afcdc0316d629c0bc4b2192ae3e8876564bb92d776739b2ad1162aea03000000000e800000000200002000000094d4daaaeb256e01593f95179f540cb55dca11180d11282e8a7d2b625f310e122000000097d03083172861791281d91b110ee5fc1e43932c659cd310d226d165cac3dc1240000000d5a659cd3a764245bb9b4b7a345dc5960d0bb5852ddb2aaf0ed9a55264c7f04219bceeb99edc074d2fb6a8b11aca844285617da1a512bda9387af56c5f348a92	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{955430D1-A9CB-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28
PID 2040 wrote to memory of 1768	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fcde4b3502ef756a8efa97fe92c4b71

SHA1
1ea2fd24ee2a55716ef5ffcfe9d98458be3c56a6

SHA256
0a415485b3b768599fac954e63312c314442fe5438fe748e682c94cdf7a7f921

SHA512
adb016585ca85ff14ff97895a22c703d42e4357a646735fbfe4b68f93f814845b1330590648125672528fd0dbd27c60a9b55d611634c8266999a3da278e202fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
424e0a2a8d04a4cd3ed129d353e0c2cd

SHA1
a8977cde0b769585643c3d8779965ffb2770f54b

SHA256
c4ac9e18062c442c7c9409957b2a1bc3bc2345655ddbd7611ac9271966a271cc

SHA512
9de9747e81888df91a9cd41505cc2ee42ae5dfb718e7b7a2325048456bbcea6aba4479bdb42a4274b825670a07855541a599001f320ead3d9fe61cfc47b5031e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
109cf9c3081b03d962295f62934330d9

SHA1
3dc832382b0f90d86820fa3f0324329265defbd0

SHA256
e819d41f721b6737871ec2e51ddba0261673713bf3db30d8b6b1bce960c24b30

SHA512
7073f298c97acbbdc766b6d7e114fa8da112082f22596c4f4641fe009ac6619702683199bf5b5799653337a2f21c2b4f81cbc7dab4224bcd8fe0372c10859056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5388b264a457dc7d62cf28a7d59d6ac

SHA1
c6cc95848b7dcf6213f98a25564a734fb27a80e0

SHA256
e5b7e69d4388e941612184433e8a67e961694d098fa1edf338ba3b1328864390

SHA512
c39c9e43a63fd773ea661bc0b2dbd8905f77828d095c94a6d8132f5eab76bda09f8cde51cf2a6c9b5ee05120af08d10ab97e72da40edd0701f59215ca9a179a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c77c05ac567aed25ff0a2d1afe26778

SHA1
24a62aa5977a588ebbf8674bfb1735ae26d0193b

SHA256
4bfd94fc7a5faa90bf414c0e18c8f67653971ff52dcc8afdae50845afe768807

SHA512
298ab3f035266d51d6d040f8e5249228099a68db7a7e259ad7aeaf11f53927be2836064444939f8e92e13f85688c0e948c9d23caf24f7a36c746c1f8c01ec8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de42dfbe7cfc80337a92a4691f1e3e51

SHA1
9880e6ed750a76293af423a3c815863f38f2cf13

SHA256
f53565036b74f5d5133b9a7d45ff4a89ce6ed00135d2d6e5a274c18bca3ba1b2

SHA512
3cc22ddaa2a3ead89e5f9f4668d86210bd111e0e27ddcfffd6d43c4e4859194b1f55e3e6064276b3dea1fd3f46a55c692a361894ec297091170c93fd3e503d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e04bee9ccb1f883bf2cb2fd70357057

SHA1
fcfe6c3e4148b8e62732bc1a674815d3c25c41df

SHA256
7e03aaff537fd3d6bb2c9f654660f8d85b5e773a0c9e09bec629cdb2a4515a36

SHA512
9107eef46415b3e3de0be2152c9775fa5dbf3e800820590ab7d065e0a9b6abd6a0ae6f00bce180897847673d2c0d98c8c9a27cc5a46ff2414ac4e735b272605b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ba4f63de7d99e10f680ccada3b3c059

SHA1
30f423470dbcb77eeb8ea3fa8f90d7907c6c91f1

SHA256
26e56fa473654d85048e32a508ecff912de02ad8e21950d18b4b6c94cb856d25

SHA512
29a1b40d098163c3e483949e27cb34db089abf308a59d6f5872aa8b4db24412a3608cd00367d248bfaf13422c1851c2647746d3069fcc92b60fb8493c11e0431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e59d4edb5f4f5edf13bc00921101b3d3

SHA1
442b3d6043cd0ef1cf1a423142e20eeb0e52bbee

SHA256
8db20cb4042dc625de60997e8bc6c09efd70e8c9d008f04da67467b3f8647bb2

SHA512
dad168d486c361f3dbdb326dc594a17b27d3a2416e7190eb55668f84b7aee44495e6006702469229cfb8e8d56b141d7ddfc0ac13c9a0348c4c37ed816d12841d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b73f12072beab946999f4d1fcf2733b

SHA1
92128242fb6c44888d0a048847bdb7c3eeb7e50c

SHA256
e11333f6ea6b28ef8ce4dc316213e976c7a177be7f0e6eba1c470d2dcd17ac17

SHA512
7f53e920911bbcf2acd634cba79a505596fb05ddab9d7319d8c3bdd36d21327d34da34f0bde997bbb0cd30c2134a56c978a87a065c677da6f8bdf3fde73bebc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2462504b6fb50bd3fa991db1cca34ef6

SHA1
6d608fbefcfa3ca78b78f5bf3fdbb26ec472c684

SHA256
8c9ff49554eea502712def05c6f6f6882f7ea6f56aee55b54e2cb878f13fdbc9

SHA512
11953f0b07a778ad9e362432a0d445cf8d95d33ba7c29d9dcda7aa37d8fc531e99a66d493061966e141f48d1756fcc649c5c0532091645ddd883a5ea97778fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a35150c0979cdecf49d6c200a00def0

SHA1
2ab04964251d6e37dba921f1bb8977a0c50d3891

SHA256
dfa16653fb8927e59684d978117ba3ab4a93149463c42a36a201bc638f165e50

SHA512
4c50b3c116b4087a8bfff4dd1facd95f095902d694d0b978437dff953ee981ff8b225e7c0887981accc76249932afa594c830992c87708919e68e8caf8579f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9771.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97D2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit