e31e2499cfe63c939cd337bfb7511cb8e134400016749274dba5c8ea951622ca

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

20KB
MD5

2946c8b28ad1a227efdc0f3072935b89
SHA1

2714dd6cb044150359d1ec75fa08ec3a0670d236
SHA256

54c5d0aa8a78148a69cd6c57fc315c0c2b0116bdc2a507e52e62e541960b29ef
SHA512

08d0890ea245db89baa82fa07cc9d0efc29f19a8b36fb6a652f774841d460d251bc14c7f77687501aeb66ebc6ea5218bb848b33f7baf38475aebec1f9883f97a
SSDEEP

384:mSSFpvsFu9gCK9s67Unjts//nbwC022/1RFuvMotdvu3hl:To9U6K9s67Unjta/nbwIM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{624FAA31-A76D-11EE-AEE7-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b9413c7a3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000032ec0d78c0e703c7f0a919fc992f53da8167d062baf032da30d671c97f4aaa3d000000000e800000000200002000000043ee2595b55fa41c9a50584b611801abc69928ef7e1f912f5baabb51d43bd8222000000073fe72f63a6690ca1faab364910409f64b8b4b41b59fc4e3e96021bba307b37840000000f94de217858e6cd295083e2bf6db84cd6f56ddb04d4f504d3f75ebfe5e08bf876d31dcdfb31c1ae248712053ecf3d9b1842cc5e44bcafd86187e12a598ec43ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410141742"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000677462b8d4886083274194802309e275dda809b5b52e673feb05ef2c773622be000000000e800000000200002000000021fb421ca816d1ebdb1d5523662ab96f8be716f11fee8ff166c195bbfa88f1c990000000c4414e59fc271498e5971da732aaf40739084f023e879a0ec762823928e42287cb504c05a663453fbaf885fd3bf41511c1a003cb068a31d41b5b2155144467262fb2ef3d801d800556a7fdf529d678a69ae20ce202b4739dac0d202fdeca9acfc4def5b3b953d236b2e6babd53ee7ccf843814c48a66f94ece3411ffdefe799dad9de372f4af349f74cff733126c965640000000e1383785357d57e300dfa184309e7bc6a1269d6e2e2773312f884c9b96bad970a603c184d675e03cb19c55c342a0581fa50fb06dafec89a37e90c78b83934c28	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2900	840	iexplore.exe	28
PID 840 wrote to memory of 2900	840	iexplore.exe	28
PID 840 wrote to memory of 2900	840	iexplore.exe	28
PID 840 wrote to memory of 2900	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a247031240406c91f1ce7e24343af070

SHA1
0dcd0e7b5ca31a9c65732f4880344d97c781ea63

SHA256
76030a3e92b8800353f4675475a65d012f23942bf699cb10a18f9acd2b7ecddd

SHA512
609841c5f4aab00334951e494aadd0c5201bc9e00706722237366a7d2a691a426843cb99ac744ee726ca3910dc0c7f75959605b6cf50f707ba065fa2f00cb2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7195b37677e29e9620009d08b975a59e

SHA1
6462ba35ec63ce701787e7a69baebf73cbe01821

SHA256
e73fe072b469046d3c2a86ec0134cf669a051051d73170e7f405eb861fd64b87

SHA512
7318b1f5206b7380e6e83a946e4bb6c4422612601929d4b089a9866dd89b50faf7445887525c1eb089885fc34dbbbe03966619ee9d85f2259dad77035e996729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd6853671ed806fe9dfa72ab78cbf416

SHA1
93fd17a1ae6f489e7961204fe5a844587a631a87

SHA256
1e23db95c03b54074d8d48e7817bda59f825afcef10084bad49e541d5c7dd3e9

SHA512
6a2bb64c13035699b3e295f22d1bcdb9b45e481b96b2eb8effd43afa7c957a9ddc3eb6fc86a0670e6b613abc62505ab0d5f04f4c2218110fc44157159940640b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abc9d0f4ece6c6d77c688f60fb5d82ba

SHA1
7b4798298679ae55c56ccf3559bfe0e49f205fb2

SHA256
6c3294c46a16ef7b496db777bc80dec8220b589e7a8a24b59d6e14cbe142edd1

SHA512
b15a9f47858a9edba1b6e496a5d5f0d836f08f71066ef811b1eea69019b659cc84189a32fce7ae847b476ba7ac511c0f1be70c0bcceee0f389251616c8d26561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1fa48ee980f52ce139140195d270bd8

SHA1
4d7b1cc16cad814c9fb0c721317a6e2772c0d43a

SHA256
3938f42b86c217017bd438a5cf0c93778addb438fd8c6b08c5c9dc1d1a872ad0

SHA512
e64e80740f0e1a0b4e957f6662df548c9ce910a17efb7bbe452b1569bb873c648c4badd33b79baa6274aecea8574e6117b5f6d7aa98f42be311e5731fb512913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65872ce5d803c016be7f036e0b66cf45

SHA1
d4b16f6d409e9a83b689da60c7fcd5d9cdc897f3

SHA256
33b4b49e590c57f99202e0a6f4ee4d59f3741761baa65945a343e48804d7de90

SHA512
c2cb5cae9bb37f64e48f97160b5a13716978dd00e774f6ef447e14c74300b1105f279a1e1c2b84f35bc84a6da167c32d07d785b3af519662787f53fdf4f1ae10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2104b247fd3f40332b4bc0b5364d4aa0

SHA1
c55118e66a00cdc9e24cd7be07bc6cd1874a5389

SHA256
d194ad7b319f03fcb513c72aca407f4128d7a8625a01d0904305f444f22dbcfb

SHA512
99e75a51a4e5bccd88f85ff57ce4e3310479da50a65b972249b03e87f9020917a0e1192c2f057a54dd16e46a4189dd39a9b59b8a67186395a90311b81f967346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c5b45f351d872c8e56523b2a231b5a

SHA1
cf42ce454c35838f53cd244f32af9a833b88328d

SHA256
f2424e53cd7c298769eccf5ffd207129cc233f3cc2b975ad8a91b56d3ab306c6

SHA512
1b0498393bad4f572616d8aafbd92c62c0f10795113374c386072ae135ff83bb30ac0f7f4ef4e5a09db19ec36d7b2ddf1bddb8f5377743fa911ce96dc94c8c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21af37f8eae666a508138a19e8d436c3

SHA1
5bc3c1745f814205426b458addd8db87ff0eb3f9

SHA256
4064fa1697d443995ab05f9a9022ad5c98727409bf3aee845d87d8ceb03ab972

SHA512
b9b5068736fd1c73c86864f70adb04e43658b206c8cf397a50445d7d893b567b47f7c575c786986daf977aa362cdddb91705016e1b5b45af9caac6949606d017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
984ac97109c8c7bbea1ae8cce843d539

SHA1
bc8c6b1c6e8ceb93cf05d37797ee8424101fedf2

SHA256
bbb65bc3b712b077a16dc00e5821e2b368d81d20d988e4e972b3cbbc206d9b5f

SHA512
18af450bf35533cc3aaa458ef64935140f65a182bcbe9b9b3cce4d62c1d1b770cf241892a8cbcf5c109d8be1fe5731b19b496770ae3ade463dce374a7d800116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c4e557aa6f5c92c03998d19a90f51da

SHA1
58f73f57626e97ea7d384fc4f6e9990ac7982ef7

SHA256
ade016b9619cb73cffbf1276caccbc77a139ee73d85f60de59116351fd49e18a

SHA512
824e85d43935c0b8acdd68727854568a33a67f2177852754ee75484be9f5c08fd8dcbd96c1b2f6ab8069665fde7a4da7f7d21a636bda5fcc0ee8c61f136c890c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af4a02472d4bc6cd450feffa41cf96c4

SHA1
20dc3ecbae674c363c9e4de1552eb8a18a24e2d4

SHA256
8c401c954536584508bff8e7b16048540802da23e57a8fcbe30c3b4eb64724a9

SHA512
688c9a8cd22bf2213931022cbc2f42da39321e220f36fdb8f13efaee20558634b1e2897078510e61c06c43e6eb314d80f902faa52a1e00ae54018d3951f24415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4f7732b1e8dc5d4d27fe446de5f8a63

SHA1
6c2eefeb7202f7c5373245c8df673b64c34a3516

SHA256
921cfaa13a52d8ef01564fb5b6db7c236471c1372219e34ba9eb363d184cda0f

SHA512
d9be803a5ac852787368eb3a049f25fd399ebc0b14a2dfcbd3316480f7aa900f82a32e0df39e40bedd131082a4270c971748943aa334c8ba77463be5b3a9840e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2817a94fb10f28cdde93a41f3d316b63

SHA1
abc3cfad54ece60c310de118f634278d33d0fb07

SHA256
1a83038f750c944c97f95d734cff6b33e47e563c5f50a9e2b8821b1f0fa5a844

SHA512
1ea876b0e03d363e82764a0245538b7c6c7adf536f9805d3c2b0e3942ebcd94d95028ba2b09e4d315cd6fb2edd4585dd0874d3c917b7b5e4971fb0e3491d4e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c5459bf0ac11884556aae4686abdf72

SHA1
cbd58f7c1c1e363349dfa412356365ed8aa0886e

SHA256
ce7e63d83323d5a83302858802dcadbb12888f6efe954c96e894349c93a4f6e4

SHA512
19f32c81f2d78a47931695e28933b5b58282937c4e3ca80dd0c72244737353ef8a4cff252f58924831a278edebd0937fad0af78d1c53931037658f31cb119fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab676C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BBA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit