50c0f4b00e966d85395f5c99df68f113dbb61f8e608cbe09fe624e3d9c7f7ea6

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

23KB
MD5

c3bc1ea8ea759727d7277b9b4c46ffd5
SHA1

1a40814c10fa36ebbeb39d4499e46203dcdacb6c
SHA256

931e577d423154daa364764b69552dc5e5b3808f4c81c55fd7c7a49bbacb55b0
SHA512

6a15819201d614ea9de360aa557b6318b0634949f9ae6fb0e4f0a56fff72c996d99aceb4e0936f6c667f1e016b92ae96779a83024302afe826a5efd5bd26a78d
SSDEEP

384:uSFpvs2h4MnC68gt5WQ/NHH4FFF/1RFOvMotdvu3hl:uo97NC68gt5WQ/NHYFFQM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000005bb7ea347f2de26d9add504d07c0ca4a74de21e442b4b2775d258108afcdff9a000000000e80000000020000200000002db166fc2377f08660f7e729b8d4e228c198add620a74805b2e5a75517336aaa90000000cd903f711046d265fbdecaab318c7a200a79f3e92576a7cdc44fbeadd64af5dfb4812114d46d4cb27c40eb53b3a91d8705630806b76483a71ffa4ec02cf3f161c3bcc4df4a42087823418b0dbd7633d772188f7b05a209d79c50e5dd55aa7d1c3d056a2cdc9f29f0d8851e6c28bb2b8e6f0c28a121970e00dfc9ffbcf928197f3843836252c4afa558401d0d8708d00c40000000ef060b13d4455c6aaa792793c9d326e69ffb05a31d0914df2279d22dd388d83e25866040994252fa6fd3410f0c7a0862b13c5e78ac9af6aa9738ec402dcbdaa1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1D35731-A90E-11EE-930F-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a5a43566afc3763c6f3dd9f04c120dc28f1a67cf3fdf65bdf477951a098f5a60000000000e8000000002000020000000244b90cc3af53c0ee32667cb2b37470d5c1d5f73beebe5d64e82fbf777124c80200000008dca156e5de4daf1b98e70a21be2768b9e3eb9889c5c8cb7ceb0c0f0050e598040000000d4cfa5023bff8970a3e63dfc825a9e39b1757baa22bd6a517da6620c0578082d1bac583065830a82fa35fceec3ad0de2856def104079e6bd3a062cebfa6638ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e1828c1b3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410320981"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2264	1752	iexplore.exe	14
PID 1752 wrote to memory of 2264	1752	iexplore.exe	14
PID 1752 wrote to memory of 2264	1752	iexplore.exe	14
PID 1752 wrote to memory of 2264	1752	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ba04e9553f3ba58b7f96ce140371123

SHA1
f17c326c457afe133a2f4cdf3cc19e2dd15112a1

SHA256
0637d3bb5c23638e518550a78d2113458d86696f6c6d4c0b8a7e519cabbcaee7

SHA512
dd40f7a5b0c0e775a9341d61978d9cf02d54e11a90a685caf2c0b4be2430ce9ff263ae72198457c00cf73ec0bac0cb56d33ead93aadcf67aa31fa326c501b91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2107403fe1e0debac8f6d43fbad91d9

SHA1
39f6047d45dd1593ea85a09b297ca73965b90c4c

SHA256
dda7bf2652315806d5876875f99b06a1a0c250fce80b719db6fd812352bec056

SHA512
fa9c51c6d23b5a47f6f0027db07eea99e33e5948826a13b75bcdb24dea83b27e0b21a8e1e0612561353db3ea6e34fb05b49b52028d9d40af41534e40e5fca526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68123c75cf6b305310e1b1d2e41975fe

SHA1
298704b047e3e2a17c792f042b78a66d49393961

SHA256
6bb552c72b2cb52d894ce1d648d7469d0c9bc244b8714d3782a7265f1d7bf2bf

SHA512
b5b6861b0b301f89e9aa337785a139903913243f4020da3aa9e659581efd36070ff7f984db679fb977c23c735b6940a33c3bfbf62aa589110eb300d1a08c79e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
500f883058b62586695b3232d1f2e0ce

SHA1
05fef71acc5f152b3e3be85b9d1fb13cd0806147

SHA256
0757cb925f981bc9f4a19a880a01b3e5563ac6f08176c85af5bf13e4a55f79f1

SHA512
5e8fc6d155eaa844ec3436f0c5314a3d6f9ed06636eed6e14f74266384716c1067933d2aa3cf59feb040f3e9370d5ff9120d6f01531dae394aa3dc493e58da72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72201898f6e93c36bbf5760cebaba1a0

SHA1
3873766933d5979035dddf111992007c62c48e0c

SHA256
b13c03ee7da9ef738be061f5f4603d0c295f782cebd07a11d7c6f796680f6f89

SHA512
1ad52cceb14cad43e9696f92abd20abeb1fa5f76aac162f96a149c75d517b75d4d62533a9c0bf42ccfc27da20f71d10b7d4edf271ea809c0c56bf3579f1cd2b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e98fe0031dacfd6843f459796545df6a

SHA1
5e3ac7d5a45671819434a15d40167b7c7676b9b6

SHA256
b3b7a1c993166cb6c01113fb174f2bef19659e291cc13eb2873abe452c97f8d3

SHA512
ba6d5934909e348860e93af2223f182b88887ab4f7fa0db88f4da2eb75fa194673603964efd28b1e54bb17cd4e479533d93b9e32626a6b6ead2802842718062b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88a1e0dbefa586c269296564f87dcebb

SHA1
59178584f3d392cb15b31e7d77aae6042db666b0

SHA256
bc8d1bb9fc7580f12bf8d13acd52f4bb045a94043285a46ad2a2bb852dd13976

SHA512
4324b0453b42ba6d606860e3d1b2f09ab132f385a9e8fb2e7074792bb1a85e5cc7517d65b5979310f2ca180a6dd32a056a9f2ee529b2329a6befa200b79456c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cbb9b747a3383f78d0fa3b73c3ed0ed

SHA1
7c1355e212508ea0745a8d4a2d29623c4d6fc301

SHA256
e81fdb6a4faad8dfb6bf0ede2c36035d5467c2ae60a2b138f8e75e9ca6ba45a1

SHA512
3ea269f59b568235fbe428756863073ac476d76ecac12ea14e412bb1df3270f0f08a8b6abe7e0d07419cca167850f4cac79e833f5edbcade9e4cf0b1ee4783a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
700c379b2c0a066c53b9c5961ab049cc

SHA1
c8a4fe3e691485cecebef5e9c50a3589b5fbd108

SHA256
35c8897dee3b11b4c1705e1b0b566cdeba252de736dcf181ff52e54cac35b2c1

SHA512
db9cb975894a8a9dd9228e415c5cf8315bd737c443159e18641e008d909cadce91fe1d720eaa1198ffa8818134003865bb0d4c2e0b8c298dc362df4cfd4f2c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a2bcef951b629c2f32455f40722b0f8

SHA1
5f07d486fad0ea52e718bc28d629b33334692593

SHA256
c1736447f82349c9d61f8ce9b368a83d099fdab59a2548182c3f94b806cfa8f7

SHA512
718a31b2e6679b8463a7e0a024aec8e6bf27a2b0f0764cfa122a59ae11b142da8fa8a245b15b6262798a685ac0b1fad07bcc5798b31d0cbbfe220041acff16b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
264ed7effec6c34a5b48c6253ca2a91d

SHA1
f0c1f1db76d11044765912ebf8a4d6836b1edaff

SHA256
b372f5b7d95e8e56296d3cf31415f3c9f67ab615fb27dfc7eda39a1f60a1a708

SHA512
43d3eadd95d188b0745555b8a5946e7dba9b82da9d2eb8b01482ab3fda3c980df4be424a141dd77b0f1994c4b87789afa85349ca186515998fffeff411faa1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E24.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E37.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit