5453d844b49826de8427eeff5f7a84eb9e3793c639c584fd789c8f256f8f08f2

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

22KB
MD5

48efb846684eee5ea715a8884ceb46f3
SHA1

0a54699e6ca543a8453f4eacdb022697a6c0a58f
SHA256

64d3fe039a451222f6303741f8c263579403e685a11814507415a419988ac119
SHA512

68e44494d8488e6ce7e0f368875dc8159f4a40b498096a794134a9fafab02b3b4bf7236ec9c8f2b8fc961725169cdd4f86245cf4605878adafc99f2b02272f49
SSDEEP

384:oSFpvshhGOGCQLrwRM9OcgQw1CvSN5Hx/1RFavMotdvu3hl:oo9cN/QLrwRM9OH51CvSN5HYM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000799590b844af965c3dbdc48027d2f0e6579d883e4cebc4f2bbecde52cf82fa6c000000000e8000000002000020000000057b5e60585588eda45fec52f49fd63c2411066d5dac5d4d3d1d69165b9e85b720000000a848ef8756f6c32da00b164d87fe14a60d3b55ae8bf9ed8d1e942dcd1dd9e41d40000000b28852b29dd9996807dc2c7938aa48c723a83ec039b276c506b0c6e1f8c41acb2e06bf2852a21cd5d16d0049f452d898160b97096bcdbe0330db333479d985ea	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05f9bca883cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000749519f6fb042a767ace21dc93e1ec53c9a735b6b507285d5943f84388582242000000000e8000000002000020000000b600bf822133d347817cef89bf53a8fb5566c3a2800958107b81a9a78b61518d90000000d20039698e23e6ab4ac8f459bc5a815c650a9e5bfcaceb99a6428553858cdf25b530411034b321c7810c8719dbd2a9015174be65a9a41ea08626fbcda43739388915ccf82a0d55d1e93c653c28f78fe0b9a05b043b75b72bf610460abd255f2511af65769017189daa35114d1b60cc92aa105c0c5a454545f64a528f968d01d8dfe418b22cbd86332c25f560465c241340000000c5e3b70b94393a7bec28e0644df88eebb96ac60a9e9cc9c1af2f74711bc1318fbcf1b5441260298855df0d0afb1ac1856bdeefef6309817ed503c08e779a6242	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E51B2FC1-A87B-11EE-B9A1-EE87AAC3DDB6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410257955"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 3004	2232	iexplore.exe	28
PID 2232 wrote to memory of 3004	2232	iexplore.exe	28
PID 2232 wrote to memory of 3004	2232	iexplore.exe	28
PID 2232 wrote to memory of 3004	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e2145ffcc90b0de07d11572dc2bc8160

SHA1
f2c803be97f119b1d1edb7e9fd244752d38871f1

SHA256
0f493d17315d416b35e57e111218ca84a0da744652288005becb037b01ea77d4

SHA512
c04a9405c503cc7b5bee8149ee90b2852184905b55de241c69d64cade6d7213dd5cc215d9347a098bfa4e58f746bef89715037adfa114efa7e67700c29ac0483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a9c5f9f016d84e61b0b2f51eb476594

SHA1
8c6319fcb49ce3abf0f9aa63890a74d539878b15

SHA256
039236b6288cb05ab7f12e38eb0dbbc2f77d2d40987175bad26872468edfed66

SHA512
93aadc2b0f571b1489d6cbd0afbf5b39ecf0d003aa16854c9f647fd4e8b034d9004c0615a2a2ec5eb7b241543293b9439965a78dc9f005b08a9f1740ed84d245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa75966b32c5d5878552e94773f2b9e2

SHA1
9a6adf59fb5fd1f5232ebb45b757fee9e430b7c6

SHA256
7650371a8b2d8bbeafd08e73a39894068a7ca264ff3f3e6562a32e86f1fbe2c0

SHA512
f38deb8638dc40a5f0ed5a52c4ff03c73cb17506ca47eb2868bfee5fc385119093c028687bdbd6f488a5f2cd68e026eb80ddf2f3439a5a37d4e15c0fdd46c1c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca456cb79b6e59358071c972006eaae

SHA1
12bb3077b8d3d43d0dc033c177b7bbadc5dc0226

SHA256
c3428c1969096e7a1e2987eedd456bf2cfda9c0b0af5caa244d2eef8c3dc9c48

SHA512
e34bdef617488fca544dfe03c569717b3040cc10342dd1eb79fa0bb7b7a0cfd614a24a961905e2c969eca18cf287c3f8be240bf07da9c9c542414a913cce0a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68536876d0958648dbaf18c6f35b59b8

SHA1
2d8f1c3bbdb9efc5f26b231fb9d4006a75c4e748

SHA256
14fe3058be9540dfc0ce4f7331ba11446e3ee3f55d2a44d1db8dfd3f3231677f

SHA512
6edba80c112d21cfc9ce512e11f144210a1c1d8d0038c10e5651d94b78684955f28f2d33ba60efd350c7735749d6034f45e41641df97066396755a55e9f8540c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ef66cf7891e3a0b60ef213e0edb2344

SHA1
43709c705487d129a3bc2ddc63d8e822475a44e0

SHA256
c591b519b3ad34ad40496b108f7b04691a5cf045355db8a4e1e3ba12946aacf5

SHA512
15740418ac27e23bc3b38390bcad74fc3b67566825e013053961d52f1e93dd92e0bbf802072dcede9fee8925cd8d01113acce78a85223d96ad497f32180edd03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c6fcf97001a40ab7a2fc83f6230fd80

SHA1
05250792fb67c6959427b57a0ef889d2784a1743

SHA256
5efe6568bc94134d6632f58617491c36f29b1c753c7ad878f80f60dec5dd352b

SHA512
49dc57aaf72542b83842d9177445115dc842987b60ce9f2405ca3f57fc558d0fdb09bcfa4e3a2f1b4ee59d5f152adfbe1282b99a8eba023e1b8bffb4596f0b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68723848f0814701b0ea7069fa3c464b

SHA1
da065319d4193e8c8f819b5b49bdcbe80f39a624

SHA256
707247e0096a68033870934ef8bdeca9e4dc2e183eabbf0671a7dda6624984b0

SHA512
f02d07cf0483dbcfc9d590a3f4ab9021122fd58ace5f62c04e2cf75ff9ceaaaa1b9a2a4c1d97f2c7a5b2bc6325f82af1a0b8663b885e21a7d54a159f33e7b8be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0578dafc55db81337af43aa513ad37a1

SHA1
7f42f3df571e0d70c85cb2d0be2bf63994983efa

SHA256
4381807f17252eb5360d226a6ae6352bb5d8c82daa37e9d79fb2d021c4129d7f

SHA512
0a160a397ee0c1903ac13c476d72050b92743975fe1dd02ec56c71c7d0d8d71d95d230621919ace8eab9fef58b4b7c24518a67cec66959144d63cd0798b084bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fa2e12e98b890702ad443a74017a606

SHA1
866352c13cc7231f25bdb1738f6026cf101e0722

SHA256
3114efe1c09d1c1d3335e9214a5b39c49802319f346515bc194973104b70141b

SHA512
d0bce49d9a5ee025b2c1175de0018042e3190d36cf88e8f1d61f9f800754399652defbeff84faae0e3840be8ac5142cc34f2826edc3f5490119ee5922916bbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d6b9bf5b20d2b65b3ac071df6036e1

SHA1
aa5f261bd9ab8fb66187d83d17a1838f9cd9b3f2

SHA256
034eacd364778eb984df1f028be8d83a0d06a9488706b9a07e264fbaa9e34d32

SHA512
f686e6b691033820ea845e5ac1784c6e02a671439797ededf35c3edce5a14cf5b698957beb55d1b3fcb2501c9f0af0405572b2cab5df69a1a93c92d34d59ae5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f2596e6eec2380403ab983a0cbbef3

SHA1
ce0773f7d7f59aaf1e20638b7ad1d4f9c07f261e

SHA256
e1afe818d75650078499bff56c54bb044f35d9c506f9b84a80146790c771ff7c

SHA512
fd2334d5b873a0c8d066514e74b4b85506e9dfca3f84398f64d87b6c53c89da9e8542daf9d7a730daaaf6785968dea7d0ea7321fc40ffb211c0e89d414e66843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dbcf29dc6027950cf1cde9eebed57882

SHA1
6d24dba0a42bec49bba404ca2a41fbf7c319bdf2

SHA256
b54fd1e03bc6f3b6a9be3a9fd8b08ed6c43ed149e352800602d2b5c841df59ae

SHA512
ac9d32b6edca440066bed6f879d467cdc0ff61caa42d0391980bda219db5b915af73bcce2258dacb0f1218fd78a02f9b4d405b0e5ea2130780b2d5a6c6b60d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27D1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit