e241f9b7fa92607fc2ee96d8a2a34fbc20d0a08c3a101780293bdaef7b48ba2a

Analysis

max time kernel
147s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

28KB
MD5

081a80075804351459848491850e7e01
SHA1

e8a35b051de4118fd0a6f2a0bd640507329169c7
SHA256

b8319bb1e1bb5713ebe7e259b41f6b58cba3eec02953d5eb4137fc2bf667b682
SHA512

e7747c96303b06817ccefa92de06ddb837e14862742900d74479fb78bb8ef77426ff3f460653766c04940e3e3159d23122165b05f366f828fb96d677a4b84a28
SSDEEP

384:SIsFpv1YdtJiFL1GlB/1RFhvMotdvu3hy:ST9idtJiFLQJM+dvahy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05d29930a3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8A84B91-A8FD-11EE-A3E1-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410313664"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a79a5be829f8426a02495fd8ec761cc0b51864bc04f73c9f43ad3cf357be5269000000000e8000000002000020000000f10023c49b2a4abfc60146cea08efc8cd0cb8b825a1a0233773ef35042a3749a200000005fa9407189f94a96297c8f77fd3eeaa1a378ec1f775c3b3fbc24be34dd3d457f4000000085ddf5d4dde7bf72ed5d4bd36193bac09d3f22d81567675ce2c52b9bb26b5c231560516eeadd0d2b8976ca13c053af1aec0b0b6cfe83d0f0e49bccd5763acd1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000bdbfa227201e88c96f32111125f3307b614e74f7f75f74d0a86c3947792bacdb000000000e800000000200002000000092d55cc6edb797a4c2115b301d18475b001dd6b385255ac779b0ae3cc46165f79000000045b5f385fdc2bfe38395d91d570360fa07eb0864f2437cf3f631eef9816816984502fa80592804b78bb27e933dded3c41b81ee0a1d1766cd7e3cbfe65a04e106c2723b4647d944e4a76f629d6053d900f49449f83865e95a47ba5f3b30e5105b0f1704228d06b2d2424795c6edba4b260f32b260f15da86f44f5d77439b737fd60c164abd042a9e63cbfb7a1e19db9c8400000009dc8751cdbcc8c33a646ac453f011cf812afbe98bab872f8cdc763bc0f229d90c8d5743dd6ffd2064235e2f3b9da2d1c51170fd97972c7d72fa1e9e3683fa418	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2764	2336	iexplore.exe	21
PID 2336 wrote to memory of 2764	2336	iexplore.exe	21
PID 2336 wrote to memory of 2764	2336	iexplore.exe	21
PID 2336 wrote to memory of 2764	2336	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56de9aac4f6a90dd1658f69a91dde892

SHA1
c3da9255007e0fac00c8663518c0dcefd6a2f754

SHA256
ec2cbd39303aa833f16b56ec4aa9c362c80a49cc7f9a87224b3b30754fcfa1de

SHA512
2fcc2a1f6cdbdecea2372ee3e1666970ea5d5de70c16727095f6bf6da137a090fef645b9135c278e20cf8c0161003bd7fd3ff7bff7b605140f7323764b0b2803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30ce6c36383edc23c99b7ff901737b25

SHA1
fc9c257d5ab6973cfb6b19a1d63d1bedb6cab2bb

SHA256
5e04f17bb55d9e7aa956b5a1ded0b25b7e136e395d3105839946b992617403b6

SHA512
129c52c984eefc38b74dfae9233227252e943610b24e11facf41d1603547eb44b9015f4c3775380101f05cd8fb32359fb1cc43bc39dfd259b81c57cbfddbddab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa2db5025afe41c1fb8a26ab91a5c50

SHA1
b764761d2fc4d14a0a915ef2cd2371887b32f2eb

SHA256
561a1f4a4f83f6667e82473c0e67209c41d4630047e059e9ab884f9968d3e7e7

SHA512
66417a0bbf52ac691baaa9649bd5143ecbbeb79b55d8c2baf831396a2fcb36bdf3432af6ae8e502a51fac08ac681d27c16dde419c2da73f41c8dab0e0409a8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e629bc5b9645d513b82aff699e84b9

SHA1
0f75f2f202eef5880de9152f798278ff4402a271

SHA256
42eb1a6149c5449958c650a1dee89fa569546ac6b7b9aa7d523d594141a5603f

SHA512
e385ad2ed24493a87e830dd6bbce7477d8860e7f912906a980fea3b907af9b053bd4f074f883cb9a6339203ced8cb34b5adb017c6935a82488ff72c521ca5829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b43bb026e44131c75dbe65484a26ed91

SHA1
1f6d3e7584f98065ae08be20d7b812454263a2bc

SHA256
f345babbcde50d1ec28f92c47a5757d4b319052f5a23c0a642ea2acce69dac96

SHA512
c03c3c0ef1c92e185af744d0b3b71438ee2ec39c089042784410118cde00db909ab29270938b6f01158857214e2fdafc33f190a17473ed359de2c22dc9835ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
548f94ead5bc7726c56d04bfa67a2a0f

SHA1
355d29d58562809208af70f0a7cf4c9ac8c458bc

SHA256
dafd6c784c5d9578a3a9369e65225bdab27a5f2ebda65150a0199efcc347ca93

SHA512
3857fdd6cfe8aba5aff10b33adc9d6e8405ffaf937964930d985e89001ca3e1687783caeed18dbbd218f01e050302678fdf007e42895768cf48472db5d829a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92cd776d964b985c9a35426e5f3ff6d4

SHA1
63c864de0fbc439efdae3d657cdbdc677c184d5f

SHA256
ec2bbdbcf20fa751cd8ef0c8af4a2366ef63cba7bbc7e03566acf193a687919b

SHA512
98aabc86448850abb420f631cd845ca21b870a7620246e1138bfb9367d5a29616106368e893e1987d85945dbea58dfa5ecc76d5615ea34ba49f0d1a8a88dfbec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a5c4126c64c8c50ce2e42f51f809f02

SHA1
d54f3b39fc7a3e9e1af1b1b1fb6d391db42d0863

SHA256
6270820dc27b0a8ae0461e1e105267213386ca184d439da81065345b7658c7d8

SHA512
ad63b3483096b47d17659e25343d78f6bcfdcb821b3bac2b588af589a416169776c71e231cdc5307cbe6ca23fd82bbfd63595201f3b924fd9f529b203b031c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ae6bfd66b4dc16f6529ce93045612a8

SHA1
cce36faabfa807b3c54fc322d648890fc3574227

SHA256
c5ef035b2ccd956317438d9892ed8329bdebfb373d5ece1145765af2cb0befc7

SHA512
63b94a9201d2b522ba53b17d55e90c63d7ade8a9a175de419036e9f2359c078c6e00987f332e90fd3d5b436dfcb5afbd4885c244d6fdcf6f4610e5b72cdf52f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
757f2874e6490333d6acd0c1fb3de85b

SHA1
c43a6fbf811ee4918e76da96f38c4e4fa4fd806a

SHA256
3eff6d5b6e23c1da2df5218ddc56919ea223b821e8fb79c9e364631a5a229402

SHA512
079cf75892e98c0a5ac02767e0dc00fa5a9a69b9db524b69c977b70cfdb8ecb7a2ecff984a9fcbb2e6fea88f20aa86d435b83fd2223d2d8027053b306c207eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0E1.tmp

Filesize
18KB

MD5
a4429735405674c17c0afe3f2b561c65

SHA1
f0c4c39fa0c24df81a5f9c4b69c15e283f22ebdc

SHA256
81663cd42a14dee634d606891bbe264c1e9f870d045b2e0d4b65a7e42868a8ff

SHA512
3e0135596f55054a3a0fa4c92bbdf63cfc31ce7feed20aef3a9d5544be969028d10f3ebaaa9e42e89b1204f82db396e9a3af3d8a56419ff38a278096f165e5ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC8D0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit