66fc27df268afa1fbb12259379895b3462a70146abcf8506950bc2f137548d1d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

21KB
MD5

7f3fa55ce19513dd03c85d223579c540
SHA1

a757a24aad2b3175e2c3f1dd4ba58b8741479223
SHA256

869fa8c05dabd5720e929711f7172f0ae39f80da29692f6257d39fb595020a53
SHA512

07cc251006cfa7887d4602ef859187158c82175ec1d58be1f3f20218dca2e0847ae9b146ea6b7e0829a42d9d9cdda15588f977b32b1ffe37ea2fb763dec199e6
SSDEEP

384:KSFpvs6upZCY2pqSqRsFR80Vd0Lpgr/H2shYjd/1RFQvMotdvu3hl:Ko9bDY2pqSqRX0Vd0Lpgr/H2shYjKM+G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000000e4ca80ab1f590d2b91f0a64d66a81d401d48af4f581a6a0a550a8315458bd77000000000e80000000020000200000009810a908f674686668b3ae49058d207a5f9430e58a97743deffea30482044c14900000004fd3418bcf8bcb31911025752826a7c1567600da03def23944e51331d0b2768d03d6ece5720928250077eff05dc936bfdd36c683f98cd369ed159e5258276327d7aa6fb527260b8b056ba3f833a41e0c9fcc62dcdcd80e858eb243a39654a01a34f78f8ecd95ba3816d2ff116547dd701b60a3787522170ad1150c12dacdfed09588d9768c03ad3b559d210d84021d1940000000098f88bcb8eeb810b82a13c4b120a22ecac7596d72bac278815ccc2ec092331acf9dfa075c0b349f3a539657235079a3b882eb87dd1fd2c8fb1380413477cbac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c1d236313fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c21506fd30bb382847102c9564a3022ef98726b2a82d48564a534fd14af204e6000000000e8000000002000020000000302a0720ca6bbc19fba76a93e7fae79e5105f414d47423f2c99be9fc277e2c862000000012723eb27f611501db1e26565e1b4cb22096900a36e3e506c9edf6869d762ed640000000b1829f6fc72552278de00e02293830f3544cf6d3a7c69669b5a292011c6a2580a538b7f8a820a5e57106a78bbde1e813edd31e94bcdc29ef4403550a1618f184	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CEB1841-AB24-11EE-8D71-5ABF6C2465D5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410550165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3024	2900	iexplore.exe	28
PID 2900 wrote to memory of 3024	2900	iexplore.exe	28
PID 2900 wrote to memory of 3024	2900	iexplore.exe	28
PID 2900 wrote to memory of 3024	2900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c34c97ae6e6036f414e0b6dd32f1976a

SHA1
497175c8caa0ea073a884e4c14b0792130884291

SHA256
666fc8d47d6206c028e1267734774ef7914ccb4dc93cea386545b2b97c9a9d20

SHA512
dd773278038b2fb27f4e265f316963fdae85656a727ce7a1007ff01a5f33d7cd9d868ec0eb6026d4c2169ad10108225ab0a6c6eabf51ead315cd8a3d8937d669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80466edb47c3eabb16a49114d89725fb

SHA1
22fbbf00f64a8f2416a5f8851dba4f7921044e81

SHA256
dea4973895185d9c0a83e74ed9f7cd8529fd003028be78cc67999fefa64a17cd

SHA512
ddbdc9aac7d45b2498d4bec1689d2e524f8f1e7808405689ef0d1570f8b46a156ce53cbf5f21de8d32d64bbca4455d8eca42916c381f16390683c1419c3cab76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5317c0fdd78d37212f2e4a5cc7c176

SHA1
c4c98879de5ac2b03a80453519d4f508e9f3ea10

SHA256
623a7f0a5239bcae00208276942c3b4844c3959d8ac26cd7edd9d0593c6bbfea

SHA512
ccedd8c6bc16a14ec4c01eed4c3c21b22a920ea23e048012664a693b3fc6f4dc178dd30fd571e0b62d980f136c4bb964b02ccb4550030666e267fe0d5a354045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814fcd11bbd249b9645c6c9f67f367f2

SHA1
2f369177f93615921e15d2368f2b5eb4adda445b

SHA256
ee69ea68028d33e4c487c18c53e2239e5362434ab4de31fb645b8c43f2e33f54

SHA512
da7445f5faacd2207d574730e37407e67ad9f7b29d19d17412e2a94e0b069c83eab781a31c0c103418957d3e1c60fed22c750d9cf796ce56638af45e7c3696e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67ecfa790c610fba9354e129001641be

SHA1
24b6a43c87e8e18c0c59b30160789e098a5201ac

SHA256
9e0a6f562153c7a664d4e61697422032cacfcebc8765f7ac6b3b3f9966f63bf7

SHA512
e3e37cd146967b26831a840a7df1ebfa7c9a7d97220a395a215c523cc491f03cb300e842e27b6a96e4ced2a6544015fb7f81b9a39c9caaf8efeac02f4b98c421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf8e641902af7c3ae680a81e905e4b8

SHA1
72a20b778608380fce7073e9e85639f45041cf07

SHA256
3706eaf689b5e374713d6b34eb6e1c2b4f2b4d26945ea9254d6795fb90577d16

SHA512
592520e8407e270b7741e0d33d81dcfc2ffd399bf4cdd1c9fd17a14e20a98ee5574f5900a34d9f770e0de985c51d0ee5b150e00bb3677847962b6cce10bb3c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
909ddbe74d726c5fd1c09a4518568c98

SHA1
b4736ef42dd2eff2dcba30388d46de5aaee101ef

SHA256
91a9fee538e11c2f53b03b546675a73829d71412ac82a226c576b01d13c71cff

SHA512
6638cde508b7b4084a9a10d1877c028e1eff0bd8fc62099382e9f8c1740ef8e6d652a10da093c7d4f27a59720267e6272299507239b0ebe493022e7b9e43ae92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d2676b758de215d0b2be1452e077ceb

SHA1
9dc119440574ba19b30d04787c140ba5d3443ecb

SHA256
0e1cfd730d8fe4bf81e11f97cef0b07254bd9b8704f9741b6671282a55e395fc

SHA512
5d67afdaad7de6fe0c5f22a58d80ffee3b3f99f4b7d209055fb034fe1f26ee37bcd5775b2eac2cbd40253d28487d64fcbbb033c0ad6e798651abff36d2c12966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43a4c53852610df086dc4800c8ae352c

SHA1
35685729e76ea507416952e331aeae2d7e2aedbd

SHA256
0d4c1b78d41c821cd32f0636f5f4da81ebbdff839dfe25ac51a233b1609d5bea

SHA512
c81dcadde6b2c421b895c906a94ed22f3413d818471241e4d91111f413b5c40d504cc8a40732ac7a77893a865a2fdf0a79fcf5b9338088546eb56d4f6780b506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21fd15a58047d33b7f1d3ad22fa60842

SHA1
48729b791cd502e7ac47127c60fb8cb7c2bef299

SHA256
1b8f516ebd426d134189e714308179894a4d07e3cb4fb6ebf97b88a3841647c4

SHA512
42dc10aa68a4ffe3cfd6b8e600705dbac936c29acbb392ade02431028399c80e20d7b29f2f919aeb5af25075e6fafeba7de879043d09f51b44f90add6b4bae0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e8e9abb8905b6d2c2a992caf4dfad67

SHA1
71d95c6877e986eeccf287452ed179f413a9aa5f

SHA256
6fff4b5570d8496955738d13a36d11ab7b8be456853b7a2f65d676277bb5782c

SHA512
5e0d10c5a0ba5a021fedf43ba60558246ddfeec857a61647a7f75f652e97b5885a36ddd7f5a02f29ca6f0d5a98fa95fe1882df0c6801887baf77c7102bcbe787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
08647f22de05bc204be699f2cffee466

SHA1
88369a3497be3bba5ac655345ae580c2c98d5ec0

SHA256
378d9de8996cca2a33bcd6ceaacb7812a91eec796140703e90d382b0785aeca9

SHA512
89511747b817bf4fc1a6cc735f43f880733f364035e3a5ab28c1fc783da6d8387b679207d5eee259c35bc469048b8c6a493d85817019a65b89a4e9d0b85ace1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar631B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit