47d7f7760a8d94a89b410f10d5b2041ef156bb996cb884b4e653b509503952da

Analysis

max time kernel
157s
max time network
222s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

26KB
MD5

e57a687bd814bf37268ea5e13533e96e
SHA1

f9e9937ddc0c4c1333f07b7926509724d61e07a7
SHA256

bcd5be7b08290276e8769473841b528d069eaf706777ec3f2f0af38e5dc6cfb0
SHA512

10f0637c9a2e7c6393316a73f420814cab48b6e4e1001e27b090dae23be83350f8ba37e5c398bb1bac2f8f6e8ed615c86f00bad20d6e0125c25f13e8d231ff6b
SSDEEP

384:SI2Fpv1KFCWJTI42bSz+T0o60iyW2FtSE/1RFEvMotdvu3hl:S193bSza0o60iyW2FtSxM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000003e35c5d1d5cea02491394c076c997830a88e8b37e34689ea2330d6b2581c313b000000000e800000000200002000000086b7f845bf2968517fcae8a3a773254afd556cce40550511f483ca3bb38970e09000000068e04d008af1ddc74b9eb2c7b39e1ba08be4af997d0060ec0b4a7e45423021e9c45cc105c908c1bbccbb7b49d0ed14abe110ea989aa8e9abb7afae5b64bdb53ed7dc0b9e63309e16373b622574c58890bfdc44d1e6103789a4820c71761f6c112f9c922ba296ff4e609a9c2322aed8dac4885dbd8a80e3a6cad0a157ce555ae228046f698447411023d03fcf7687ee5e40000000c3802849f4c163110630ceafbe42fe24038d738162b99cc1745326baaf85596dd2346a7edc278756d416a6e52dd397f12f5b9195ee631aa77ab80c9f30f4db02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000002f9c9692d56d19dfaf4283a0e578c48751fcb7065bc6545af93ba750f0fb0f19000000000e8000000002000020000000cab708faa4e4113d88c52d615e84b143ff3044d9490354397c1d3ef77d4336ea2000000039da8a716cdbdc77910c023d6a6d0a08587097bc21bf4d662ba52f725d14d4ee40000000f0f131b593cef862627eea86fa8acb2ecf89bc2dc55ecc9f46fed00ef695d735204446e8930f2b3c9d36151309a83094eb30d711c36895e82143192dc20b15f3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e008da912b3fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410547760"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7093881-AB1E-11EE-8575-62DD1C0ECF51} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
476	IEXPLORE.EXE
476	IEXPLORE.EXE
476	IEXPLORE.EXE
476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 476	2648	iexplore.exe	29
PID 2648 wrote to memory of 476	2648	iexplore.exe	29
PID 2648 wrote to memory of 476	2648	iexplore.exe	29
PID 2648 wrote to memory of 476	2648	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a60fa64208e09fbb3146fbf8e06503ea

SHA1
b7974c77542acf424790bf3c170f63d29487c3e1

SHA256
100e5190e6f5b1787da13cd730db24df74051d24d9428fe64009778ee2b99b7d

SHA512
bbc26d7404d5463d8999b34d6ec858e1710102d1d21d2cb8eb263322268dca373671276501a4de8cb73c0f0ded1559d33c549789ffdb0a37944511e3b3680aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ad4a59accb4fd74eb7968590a09bb68

SHA1
051a7ec2abf0319b5e93284ab861207901dc16f1

SHA256
a1fd309456b6e3b7f69b9fe57cb9ec21a0984eeef299691346d12cf6d9082ded

SHA512
13f0e0c2fe459e3353b3880820264f11217cb3742b79bc6581cfffe399d671d8d7952a4550c244eb19273403bfe11eb412a371a5bef843036ff8b5567233b3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae37283f072b5d043c5cbbcb9abef60

SHA1
04c9a1696714d29bcca5d0c15c94ee014e65eb61

SHA256
7e865d6fb3db3c116068e6f2bba0594c2331b7584a8e068c5af31852c1367d7a

SHA512
808163784481c0b6fc3c4fa4e0d9fd2e04ef287990035464d08472bae5569349c376c3ac7bacf6c623cd4b7c75d5e7ee5b4757dceab92c2cc60bfe4ec7a47951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
120f57a3e576d527ddbbbb982c01c8e0

SHA1
a4098a3be6ad676082cce663c90026416bc5faa6

SHA256
e3ff3cf62c60d920766782f4ac8b7c2d93e9bcecf896565bd1f64afe1449cbf2

SHA512
abc1009c09976116db519c4d8aa0af00a5addcf48a56ae291934709e1afd2d4c9a30570e4304de7f771ac9a45d8a5f5550ccd75ad7438b507fb7a8ac2b5b93e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7b1b91e66394f0c84fb0b789fa08f2

SHA1
4cba370bb0a383036b823a0587d2cefd88f0bdaa

SHA256
e8e292754be28e4ce86fd46e7d7093e744249a8dbcaf52e9fdaed2b8fbe9e861

SHA512
63b2338a305d6904a01f30ad306cbc1801e8d019ed1740d1df698d7d86c90fce16cd55480a9b82205d0ff7abc233babed5090050172b3343945a43d7ddbac7d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f887cb281c86029dac0b87ae218de548

SHA1
61cbd9d7b85b200670a8340fd38e6a415cb898dd

SHA256
62c9b85dd7934a818050ce579c17b2ffc6f8ea1d4f0bb7db826075d65106d06d

SHA512
53a6bd04f1de8930015494e13ae28ad84582079f8242ff5ac92bbac46de56f832ac070a42fcd698e4097222d81c14fcd22f6ad932d1d687ce67a7d195faa1dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
833cc9f20857cf38c2c60bc1a259c1e6

SHA1
6982d17af6448d178604ae60b26c65a8f2ba7af3

SHA256
1bcd080cb9ae12bf81243de30abb7ecde181fa2874ce8fb3b34ccf4b86be0804

SHA512
28522e833f69fa32cc75d2fdfe01016c69cdc499a2896751ad88d1047ccb6f0fbdbb50cf8508cb15ef41adafff567799ec4e33aae9e27a47aeaed7c734acb22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61d19419431808eceafed1f2993e997b

SHA1
e598b4064d89348c699101f92b6edec8cdf13693

SHA256
0942b88fe999892c9260d1af93d318b136c613275a6cac1e7a4b379891a827b3

SHA512
6b2bdb7232feef8449e64ca8cbfea2ac6455b334fdc10f47f488f970199a2fe3137d9c2c2c20eee328fab06f2db90a7a010c56d4d9ff4b7e23f743614585645b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e85ac02e3dc1509fd61e81a3745dfdd

SHA1
be3e5d2ab0cff4b8501031fc2ba183b6538727a4

SHA256
3fbec4e4fc5a672f795138b9847f68e57546244711a138195b81ffc2292f3ff4

SHA512
1d8f1e88bc25b095a7e9576a07124e3dc1a7e3a0a9357befb51a8c0621d62f9dbe81952f24e546330e8c8486bedf12803be44648c6eacaa0d8cce1c2b4360278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05f11f5bcf7b67a81e5a929c04d30a4e

SHA1
181b57b8b0d84076a76c74d1017a28f77d74ebfe

SHA256
0b2a36da7b091dc68bd6e4567aa398c265f09d66c9bfe6ab181343bd0c709a2f

SHA512
41f878d408c00833380da584336af018da799574d4bf65754d6ce19b7da3936415f62afb88181003396cc674d05d8213858989de9e1c8542dc4b7bb6639bbc7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63a541bcfc9a43be469600a152e5cf96

SHA1
6af9a6def4d6b4d5d496ddb18756db7350badf52

SHA256
0b7948dd01a6011804c07d1ad93b0d70b7bdde6a7d9d7bf22d7122723f14ff28

SHA512
4d6e7ef08b41f537e3ab40a8ca1f4f43fd44e90756696fecec3516819b092e6ba1444d595a5816df8a7db819cdd50a85c8c54ce697c25bd634f7023bcced0b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58fc3b64743c40e5caafa836452d0ffc

SHA1
00deaf9a5218c497d5e6c34a8500d6e388bf2d96

SHA256
d4a39557005fc18d77a213dbef04873b38b3c69c7016699c5cdc74fe7ba957ef

SHA512
e9a7fe19b32c4d0c3bbf2d17bd3044b87fda800e8041cbce0fcc1e40853685e12770d6431e7d0baca61a1acf75c04d42a2c4ababaf1ec79fef1e09bb31270cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17fe1f0baa278df93c6bb40aa2246964

SHA1
ba75a34b36e1853e93b53cb87520de853087bbb8

SHA256
540300770c5bc871ebb72a12f4272d94a3e6fd17a0c8fea8f20a9624db4a592f

SHA512
d2c2cfcbfaa3850f25a6bbde72ae96fd2df05d47b2ba1dbc48f979457087163db9a4cf985acb77562db1db2cad0756150520c63de29d4ad70fae21480ac1f498

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC229.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4CA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit