54ea8b18146bc5f81027f7f0247097aee37146d6287c31e5b15fdd0f7a64e73c

Analysis

max time kernel
135s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

21KB
MD5

6004bbdb88fa9ce87e008bd1000829f9
SHA1

4093bc1f51b7becc61d2d0971f24b577e9f8ba01
SHA256

40f01d554839e8e230fb46005fdb985c3e0c4852ef5edaa6d72bbcc8a0633752
SHA512

740325795155858c2951379debcff05650f41b4a4dc8ed66b4f6ecdf5a5e075d3e4acf85d87a62ff28451ae951d6163f885293d2bea989c4377406971e3a8388
SSDEEP

384:FSFpvs4udrrCygoLl7v8bqXN/1RFXvMotdvu3hl:Fo9x4uygoLl7v8bqXTM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000911ad241c4d6b70976c03574582b2d493e38d38f93e71f912117275403b39bbf000000000e80000000020000200000009dc9736059d73b9cd37971bb87156365c059fd5fb99135e22853cf02e336be3520000000dc9464ef00a60ed1a2657c4baabb218962dca2e2c7cce418869d73a4afad726540000000f634a9d7b2f0ca9bd3fb04f7675bf371c1a355002cabb6f4fdcb5dba52e7fb55e248d1cf78ce82f2920d697e3060f2de1dbe8bbdc545cdedccb1105cf230db78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410103043"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4130F201-A713-11EE-91F8-4AE60EE50717} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00647f21203bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000008ade51be9f40edea7fc0515e73dcfd7e7d0519c1ee7a62a189499954095a74f7000000000e80000000020000200000008f5730c79e4dfc84147a88405a8092e870f003ba3a58894f5f61aa095962ef3b90000000e14677d0cf35cd42d1bb20b5f6eafab6267bfb0db33d91149694ec4ed28d58790fff9c3dcca012ac48e13aca14c413a1024a192a7f7cb4c55c3276c6dfd0471605c3fb545e347affc27d8c3052156f50364fa2927ceb1e9ae065ea7382ebbb8ff248cd5357c32ae1831fa8108c99554f9f99c5b1d83b5930eba2d4a0a2eb3f23feac26b222d532ba50a21f46c6b0c4f340000000d3e7f6b890766c4f0db2b8cff687b0998e7a063416ca1a1034fcdc8c45983f2bff0df3b37e5ac4fa0d5b28a327e17c238d88f3c5cd7b4010e58f3e34cdeae957	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2536	2468	iexplore.exe	28
PID 2468 wrote to memory of 2536	2468	iexplore.exe	28
PID 2468 wrote to memory of 2536	2468	iexplore.exe	28
PID 2468 wrote to memory of 2536	2468	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38065bd338b1b813278a72a306b0a0bc

SHA1
aa277b24c4e3c65924d993f4c200a830b9d39d59

SHA256
2227b34f4ef936c1c3c68cd1856710415c6db29e5b09a3a3ab61aeb97f2aca31

SHA512
8234562c36f361ba680fded21338726f630300d9b08268a649e99c81d5ac26f2e7209c5e329903aeb6477140539ec1644d3ac16ec0ee7b06d3cfd4f6271afd82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4a12083def1329104f684125143c840

SHA1
62ad85b21245e4ec733fb613a001beea5ad61b5f

SHA256
91633c0bcf48eacd873955e39cd61641af8ec6fa22b74bc9a43fe404c50cb165

SHA512
45fe9ef16b56f0fb30e1244f95f394146b1ad213eb38d870d688579098420ab453d14ac2d69db675824177b63c8b68fe193b3f751aaeee5d32754e73c5bd5ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09c480c28364ea772c0167242662128b

SHA1
9b8132918a28418e88e7f9829c6a2d6b38c23b83

SHA256
4b5f54251ac8db1c7c748e1819402986156dbd32b92a2b19aca3b0b817b0934a

SHA512
ee63e00a55213fd289f2053a4315234d8d4bb86daa89fe22659040f486d75ee1ff769ecc38760e1953cca9de9a0f8e32cf68b3f153ea0419feebb7caab7a9f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98660b5c50bcdfc08c98eb46ea10ffb3

SHA1
c1b2b545a5c70bf7c313ae47478b3a1b29cda46e

SHA256
f3467bfdda4f26499f87f4246b07a3251ac5f41c3e6b6391fe7929404d610faf

SHA512
552500fbd13fb0efef67d6e0f1409379b5a995a33d991f45c347336a835a4b4a1e0c768440b56638ef3435963db5f9f99a9583d669597a22d5c78408452910e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a10ab6d1d1e1b94bd066e81c55100a7d

SHA1
9e71655f28fdc896c5f03f7e36ff9c048533ed7d

SHA256
78f61a211eb80c4bb71f2281d0bd04ee84199fa09458e95e85ff1863123da97d

SHA512
6008c639edfd4d6d3f19776fb607f8c55bb60e0483a127005005a627353238ccad37cced3ee9056f7f5ffd3959e3e3a4125d3d45e4b52dcff203fd5b51019c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae996ca4585aeb9dca749018507c14c

SHA1
3169fa8eb6a663cc0c39d5f6440543bc6b9ac0a6

SHA256
606b431863a53f127a6cbb55a53f794fb23acb4a15a735ce4ac68134cdf7a185

SHA512
0e21d05051da33831cff23106fc114ca8185a4aa4d759626679d773e63288ff20a22692303dc86c0336748046fc8bfa858d27f74d9bd586e759c82b8852ce660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9570f61a2abfa22faf24575d76304ae5

SHA1
6970369e006825a645529db2546bfd4a850ce9f2

SHA256
2b20e0c8895c87d264a545ebde6a3d7eb77544f47c492465cf1664ae5bd34d54

SHA512
9a3bf78ca86df320ed662ec75343e85b13db7136f3747300ed602fd48c040f948e9cb8f7c6f029ac5f866d234c6959b265f3cb5f93bd5d8d8651caa8a01d190a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356412f45cccef9fd70260ffc2a1abd8

SHA1
c3adf3492f1ee4623b6e5c239e85ac80f4c3e1b7

SHA256
f023dadc459faceb273e8fc88f60e6e0824c258f15d956e4164e0bfb3136f950

SHA512
7e0f735a4257caf1697806efd32192ce5ee95675d1d63259d7b77e8b6a2c494c5bff47bab382399cd6b98a44a454d1f649b96c03d6d2b946a8a0d3452e62173f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83b37ffe94a0cc1fc52f928f6116e8b6

SHA1
9727bd8fd1837dd70b289e57e2fb50b85a817442

SHA256
8eaa2e297b1083756a57248009f47b8559042f57b7d455de14a9859f552859e3

SHA512
4788720391e2d029c31a7e071752730ae7b49762c19886695fd1d1a97df812613e1924aa76453bfdd0c5ee82bb721aa2c6575f591be1b0fc66113405e86d2ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabe9cd9409bc91cb0c6477c07611ec6

SHA1
1cc47b978a23551ef41748b1ca6a362ad2368fdd

SHA256
a64d250dfdad161ad3961648d7b970b23ed01bd9a2a539e57fd8e4b45474a31a

SHA512
855a8f5134c227ca9522d2f2737b7b11a08f903da7ea9ee0931c95016d3ec654a360e5987bc949bd2bd8f16e48599428981f70cf144d7906c4c6719a159660a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff2947718314da4c9fb5897d3ec73f16

SHA1
38a7b6f91601c8accdc7b8da9e97b364765ad10e

SHA256
baeb5a546c2f0dd8807b8a31ece6c8e1bb5dd2a3627be3084422064316825c5a

SHA512
9106c781fe6f2762eacea8f5f8c15b4616414b31ffd9fe9c5445e93373758351720aaf5aa46b305dc111f07e63a4e8a160cc2131dfaf8d39cd63ed18f2aa79fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d663ec8e7a42910cd25537d5acbbd1c2

SHA1
89bd9b32ba9feffd5ba6e17ce46a27b05ea99fa8

SHA256
fe5e093e9e5a07d3bedf1006a96692307409507ad85ad4afd5be07a4af9ef1be

SHA512
5685e7b44cd7ba96faaaec7a11722fe641588527c5ffd023a23e1815dc9ae54a5ba44f6d2ac142fa57eea44fe613329d5170ddd99df5820efd0fc556dd1d5fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67fefde0758beea0b9a7eb06db537712

SHA1
8ec2cac53d0988d3dceea237455b9c9da347979b

SHA256
69c9519a1397481034c1de8bfa2ee38781b71b5b4407e208134c83f8c67a62d1

SHA512
34d3243876b2b53951f4495903423bc2ebb593ce68f86feeaadb9152d7ac8e76ef637d6437d77f193ce25d1df1879a4301fe3dbb0d11b1b09595591cc6c9e543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
452f77fd9ca1f42cd1b56dae510f4bc8

SHA1
e7483e4dd98758eeb0f01c0f8f21964e37466a6c

SHA256
3c59199df49aeee0b013784332bf36428c11072f0ad65d39772a994064d149a1

SHA512
15842c6ba8db58010a22edb5d13021f9a0e0793ca1e886a4ff6e281c4aeeace6a1b8b2246b47640d8c1f7b3c147e1d078f068909cde629ae5b005cfb6d673c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56BA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B2F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit