42c3f4b8b9ab7594dff46d9f633534ee69b41bcee7ee2a1d9ef4096532fca3f4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

15KB
MD5

a33cd54902fe71e86b15b861aaa424b7
SHA1

488589272e3ddda2951eb6fb0c0d9faf5ff9edbb
SHA256

8c61b4587690f8f35b372ffb91592b066a8ebb60dae6f2211f99b4f58259513b
SHA512

3c94dd13e6561ff36fb777f3354f7107c7a64c428f3b3b183c0b83d7e5e00328032b822f719a874ea5a6994a94f6184049d5771237565a314e54a7d581f9197a
SSDEEP

192:MlslHlNUltF9xZjw96a1i1GdpgS6kwiafxAVXrEqWRRq47C3+coxddAnEVnnzUT7:MluFNmtPnGVX4vRUOcohAnOnnhIU4es/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA783DB1-A7E1-11EE-BC40-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008504caee3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410191747"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004810f8be7dd0fc56a1c46813a941f8b2ade2ac5234cb054746506157dd281600000000000e80000000020000200000009ab67417aa0f9bef36e59281e7b4cbb0ec2040da0e1a729ef58671b91ce02b1190000000443ab4d512dbd1332d26e5442480f1771a1bcad04f88716c5540e32e6be208d8ccf97323951e8f271156a7d5977e34826ebe81bd13b551b20d16613e57a58b959d831cd551883df03fc0f7900b87c6ac59e8c123efcacb2f04d603b21b4eedfca047a27dc894f410de59927fe66d09df1deacf0c2d4a0266e8190b089a9d8c98550ccedee3248eb37111c71c6095cba14000000021e746eab47174f991a535d3d60a1425d2331fbdcd94f6e366c1d8685ee280966414409f560433ebede4de6bbb80b561a8fa191bcca0279307345651b07803ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000827827b80510f835557a53b0bda99a9fb9fe5af06eb1598d0211e2ebc91f332f000000000e800000000200002000000088d56b56b56d0ffdf78864e9de35578bc60719164df05146c4518f47e416f7812000000062338c16e7b25484726c68dfde4afdbbdcd409d20d603bea6f6de9b8db866e76400000007cc545cd1abed6b337b042e9ae741f90fa59c51af08ca76222a720afc3ff3539ec3f4034e83b1ebffcf57d00f05931ef659a9036513ce8bb4160476a13f0a10d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2064	2432	iexplore.exe	28
PID 2432 wrote to memory of 2064	2432	iexplore.exe	28
PID 2432 wrote to memory of 2064	2432	iexplore.exe	28
PID 2432 wrote to memory of 2064	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef638533873f06900ae00639135142c

SHA1
f451dec4d18dbf27546713b3ac7d7fb762884401

SHA256
1c27835b358ba4aa7464e55bbced09174b9298cece770d68a3d1778b589bbd0c

SHA512
65a957ce5cbb5b06cd1fd39abebd309c6fd5f2f304a022523a08769c312e66fc45d82c829017c8566d53daf50af68af1bbc4673cfe3e69b4c40d476d0fe603c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de7941d3119be7b7e0048e237f8819f

SHA1
501d2bb464abe853b30a642078348fd8fd16a249

SHA256
7895b92770ae3c126ca48ebed4ed083c84c9fbc89354d559101f42907167210e

SHA512
2eb411d78bc9d59c54a55218b518c87ee713351fba79db98bca5e661557681832c17c057779315c8817d97490313d88fcfb58091239f337b06dfb4acce976761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf9a14e20e6df2e2982540d5bc233e0

SHA1
009693b9d0286a47837bdcc6a87be6a2733c7250

SHA256
7d68c17390595757423bcc9fedb954f71559a77cafa6711211a7d2fba775f5a2

SHA512
a869f66890cc8352cb3393d1b11f1be375bb9594b222bce057c358154a12ce6e33d030649124edd1b39c20b84ee41df97512d0af383e951a66ca207a043aec05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e2cda3fb482b31a39d2ea1cc2487c55

SHA1
cc8dd1e2460a7c32b5839d0768ec47b246f3da11

SHA256
72f869da347696fc3706d099f02be864d3f58d738f1b58b67bfb86d1a7246902

SHA512
4a31be8b57387a1875acb6c95eb48fbd0631ab0000659eec744b2efb1d851e81b40003bf130682a08b215e965818cdb2bf5e27042b4cd771700a988a87d39e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
012424cf1d064998dc577737dca79d75

SHA1
277242626ebdb098a14eaee11ca5f036898bc043

SHA256
42454ed5f76ce0b1e09587cc608cd49d9789ea23e3257d49c1a36858ad1a6615

SHA512
dc121dc43746867b78c66fdffcb28a00a467a2124b6bd21083770a141a99174afc89dd588c7082c0396b67c33869158c03b21b8e290b6234132c28511f89172e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe438ce9bf1044d5ae1d1320bd6b411b

SHA1
2d011ec3fee30d0fae8042949e391aef3190bdbf

SHA256
ef111ce863468120e3e91442a97885a481352c432ef031fc8f382ae693d9d5e6

SHA512
6c77647e1b80a54ca2db1a4875d48d1d7d97ea5ae502ff596128f4f873a4eff4dd592456dcf015ebbd9ffeed6b8fd06c49f2551c882f7677a8fad0548f719c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
167314246f75a080ffbef6e1ed1f77b3

SHA1
b1aa00969340fdf5ff86d6ebdeb5444063841333

SHA256
064f10f3e43852514cb265bbf98061855ca823c9787f90bbc2a89474cdac2ab1

SHA512
cfc55d2be053848fed802a4faeff955cb944d9bc4be77565f713b371f1fa2a7bcbfdc19d81e7eceeb29629bbc8680337bf83c898ae89677265ddf1f7ad7413a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ca1a61866ce1a2d8ec6ac20b3ced5ee

SHA1
71aff636e5cd7866a848f524cfac31979778cf3a

SHA256
dc9cf2e2fe2a246048299af1a76975b4c7d218f8c5bc6cdff61fae2809dee8e4

SHA512
c06684628f092cf2a4e12d1f363a2fb3e93e90c9158bb7b64162247b3e38d064b9651492aaec579392f2a1e128c5fc334df96cd7efe94b4051655605c2f1934f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c492c19912f6814ade246ef43823071

SHA1
98a9791f03dbcab1b794b877556a7f0b7a818646

SHA256
80faa330ded163cc5fc88a369a773ad4d13f14697d0b40730453446fb0c352fd

SHA512
213e179100df2add2350672d90e75f0ed97fda3ff954e542132e4b8ff5b33f02b7e40e72ca6b3ab9c4d0b0ace5d583a88cede6fdee0a1a499a61b0f7fb156f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02436d49a4ba153b152cd87e8904d988

SHA1
d91b271108a1dbec62e5de4639f66656bf386871

SHA256
9fd414ed5257fe5ba1b96641f4c4ab5231ed2a2f7c399653d79b79fcf897ca5f

SHA512
3157f7e7f560c89ec29c5139c008e6afb3d42b6c0bd769b3e769fa031481151d07819468373f353be19da97e8a508b0799a4aedf42aa889245e502938c8884aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b93b62c2241f22ac49872239a1e6acc2

SHA1
3b9cbe470b058b77d9dd2a00d3651faf453dec1d

SHA256
17c050de707dd88374b5374d8d108412537d504c63e48788775b8c61da03c07c

SHA512
973b8c3c29dcec8411a641a18e462a30a1543c7d64dc68fd5ce6a91c8c4e6687b4f9928f3e36b3655062072ca3923298eed3f37632482ab1f64d36e3f1288376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80d4519455ae6911d8a715ddc2a56baf

SHA1
72b172cf87ec7361d826cf5fad1808ffb3e45376

SHA256
4dccf301fca797f68d79da198ea6a61cacd40a3bc049305816acdaed8105355e

SHA512
cb546e12de802e663ac3198c941e75ed3fd377fd02db2b9814ed77055de802bbc63e8c4901bb35a430ee0916c4f1df7876603693bab0677023f95e0c1eb40666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fd1fdecfb4cd04984c2e4ab3b78eb54

SHA1
f8ad8053817bcf427c2332e6fda30e66da78fdcb

SHA256
4ae5cfac23ef7ea1cda5cd72042fb36d3f8721b638faabed0b1d5f4e23df7d5b

SHA512
5c45727c20e1ee01238ef96e50d9366a55e97cbd5aa8e5ce3dc77173f2c5298a5045899cd21b08d88270fe3518c093b48f750a8155e76ce864a56d710ef29304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fb6912ca8a03ea870085a8bb891b3e3

SHA1
30b36e2f3f6e1f00a6e3baf042790dbc8e7caf2c

SHA256
22e6896086d51698229111934ccdd4b7e3b86521a4d3fb0f6c7f7c7d3433490e

SHA512
12ec62190e6c4eccf65b981c1ffea76ffdd924c47086102b026d325cad3987d380fb27d5461ab8685bb03bb6bc0be3bcb413b2b7d09487f1a1b66ebf20ed6d7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17785682cd89f688453f0d8ccf254b51

SHA1
8751848118527e206103fd06ab654676118da3f4

SHA256
8545f231a3dffb16b16b64ea2a122aef11652197baee76e42610e0549251a276

SHA512
edca2477f9a8c5d1fc60316882f4d78b4f196a569b5bb572762ca561d95709a4d118615c406c69413423d997b3ceb69c4adcf0745615ace36205b5eae3e84272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0830e767c3919ed72fe5a52f6f62bfba

SHA1
5ab1f72507844d851406a4a693ac8d3da09c29ca

SHA256
2b712da35d54c184cde38f2a5c69e782305d4fbe20acb4dc0411a65fee8f4df6

SHA512
f37015bb73647e5f0ca768283c55bc0d2e4579a82179e82aa7dbfe52874baf6226e8a473483b470ba36d36631cc98f8530d487f41b921a8ab579036abf279f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8a5b4e28db47b9155e92bee6afa831c

SHA1
ee41b5afbb7a7892344af0a1c46ac0a83a2fbda0

SHA256
5069911c15c6743546d1cf55322ebd1f0edc982bafbd7c090315b4ef8f480d34

SHA512
4310a1f6a4b5f2f10100122ccffa767dd29b8ef8a62895f14006279f5563bc4c2b23c11334aec1d9f139d14b88abd08a11ef7337c148eff0d3fa77befe484bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB9FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBABC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit