e11c513556266892a453c783cf940f89b8dfe3e19063e4ffe11bc25d4a5f9f9c

Analysis

max time kernel
70s
max time network
161s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

21KB
MD5

51d4e4f1e87c35d59563be6af1a02bbf
SHA1

01c3712567b75de1e46d46393e0ee233fdd9ffaa
SHA256

cefb83b62f63a0ed62e87744dba24f4470e19a6ac5e8e1d549059da3fdb43002
SHA512

a23b70230d36648a08e10bc9defe52cac159d3b4935459749b0fa58847382062c477cdf6c729e10e0d482bff1505355f7775702509976205e557a45adbb86a75
SSDEEP

384:bSFpvsguC6CWf8+M9O36p/rPt907eFnoukWt/1RF1vMotdvu3hl:bo9n9Wk+M9O36p/rPt907eFnouLM+dv8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002829aeeecafaa81de074c07dee74ac8249ace67f5af6ad1e78d5beb9d61d196e000000000e8000000002000020000000016d94da4b470fabf6ead53f07f3a8ec34bb074939116a4782b1b61a7e30de9b200000007e5523d28ed75aa16dc483f314ef8df2170f7794a23077a7a84955ba0695bab240000000e4636717a0ade45e6bac0ca8aa50b64133a1d7b24a89a16820acfaf8c58b90a09299fe12df9785efaf0b33a64b28fed2e4be69620be59c82bd57d63bb4f9cc2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1093c1ad0b3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB6167B1-A8FE-11EE-B2BF-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c4a3833a5526efd1335e76d705f10007f8f06d7b74a3023631200da989783521000000000e8000000002000020000000b9be47102d2a841bd32837d0f5fdd6fd15e7d0592d4f1de1742ef7baa5577f7690000000d29164ea1762dc29e0add314aca2b95bd5812d8e189de42abf635821da71d356e714e8ccdc57692aff09580ae827e7182d7a7f7c90a4ee61d1b01c88f623826de6d1032a9aa1039e3684758ab07eca95651ddf5f87f1366c28e23c2296cc15bf865cfd9f1dda9073053febc987ca66abacdd908de7b1456e60a15ac3c2c4f18740dc40a713a5782bd63dc498d90a86c740000000af2f53f414d8476371007d11e289cc9f75807736638d82f3d47a4cc90faf5e7fa1b808fdec18542cc47882efda30adb00a432e817db0453d096fa64e218f81dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1672	2984	iexplore.exe	15
PID 2984 wrote to memory of 1672	2984	iexplore.exe	15
PID 2984 wrote to memory of 1672	2984	iexplore.exe	15
PID 2984 wrote to memory of 1672	2984	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
267e704f8c3c67d5c14b7e1091a33bf9

SHA1
b9356a7183e4a57ae00fa34980853f8318db0d6e

SHA256
b0334c0c98f0b9af3e2f286d7bd625e9c284fb11c3f68dabcf2bd68a2614e079

SHA512
c54b06795feb76ed2f2e234e4223814b5f9fc5b7a4e44a3cf17ea916453e2597d642f2be6df99b01567d0c3d4d12afc1680e206a0b867eebedb91cc7e85f04b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eed404f445018618f9e7bbf16560770e

SHA1
22644c4b715d05e6b6d1e3256faa92ddc86d762b

SHA256
3223c4627e445515bc7123e6a86705f7e7716656fae13e2bc7588eda5b87ba09

SHA512
b36762f68c1879cad15b6caa7ca31e332001f83b2799e820aee73c5d9333ef07b90cb03257d887a5fad2108cf1bd5630e424142b457239dc1a00e9662ea43e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c569d6822b24ba80c363d1706c01f74b

SHA1
1f4fa9935f4a4826439e737a4798cb9d9bc1816c

SHA256
093b193ebe14640c8d48994f8fe07fd0654bb418b9b293b46fdb612cc6e19f0c

SHA512
24232549574d477c20260a570b1dbb582a262c6e6959d5129804be9edd41706a529939e20c8e249354493eda12c27ac46c240819058e9ccc717468b5cdaea820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
befc917723c0367e3319089e6b6b9993

SHA1
326686e08338b3dd25348df5dc47f4d34780693f

SHA256
d7b10fc35d2b7fd3c072d3eb8043ea129d09370f7418e039ceb0f88661953c26

SHA512
c8f6f6dfb7980e7e3dbd8d605e10d1fdbafb58a9ac5945697d8dc70a781e76dbbb411b8b64668eb5926b09920715ff73d7a575bddcd776c8dc422d3e6b0681ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bf74fd675e8a1c5a828162b87cc66ed

SHA1
ef39aa826e8c57ecf739c98b76c201c744c2d9ad

SHA256
1f31fd2f2e913b1bd52a1697cc53c0cb1a4ef92aa865e875aa2b0ee6be776e01

SHA512
9ac124e9df2d2bce6c3a3a2ac5411a20e34037c93a2f9858e12156eaa6e7a8149013bb961dd7f798513b52bacf865d0e9be0f6aeaba68ce68604cce36d7ae6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f47e4037549a053b380669411373b1f

SHA1
cc8e8b58e7aeb81a9b1f16b6d6eec50cb4f9628a

SHA256
272b111be6d7905b606602444e58fd25ed85725fadb54478eece84f6e4ac9f90

SHA512
966d53b95c066488825b9d4d5748caab07afc5387ebea5ba43c140c200beff6cea90ee4092e01f234d481ac516630abeaa3e6aeb9bb73583c15a8bad902c811b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec85361d9dbece55e0a005c6a2c5eacb

SHA1
829569fe1cd6d4c9dafd8f548d2112207e51999b

SHA256
1a4cb40bda012ea75088cb878b6013b37125166ed1d83264b0c456c57b8874a9

SHA512
89b28a98ac3453067cdf4e88fa4c88375559c0e6bb840fa912f3f194eb312b7bd4cea6e9ec4bf169a8011548c193b5738a30983067b2724f157ae36dd9c9be9c

Download Submit