51775cf3d383e4d456fa88e999cacaf5a198834c1a28e2ddecd111f38728b103

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

21KB
MD5

0c39f6d72f50b6eb113f013a1419350b
SHA1

ba111d50a5a2790d3424a16da1e85b95fa0422f2
SHA256

e1024fbecb44291edfe969fed729eb4fdc6c39531dfe73d57d64bbcb0594d4f9
SHA512

a2f6592e8e53107a524623741d7b1339b5c896a0a17161916d2819e51be37e6209ebe368f098781ae0726953338de2a1fbd7d0d05025ef1fe5a953cc9e0e041c
SSDEEP

384:qSFpvsvucPCPJ7AFNXTpqSMMZl/1RFSvMotdvu3hl:qo9QKPJ7AFNXTpqSMMZkM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ea5105aa3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410382162"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002ec48751156185062c75bbe413e7aefd7d1bf627b3ecf38437afdc6df1d8fa0e000000000e8000000002000020000000427de24e6f1abb993c7e1039a19687b0d4b235578219badcd8eac2fc095e42a820000000bded8b25bf5269de31f37cc42c41c8b977fd46757e0b1d1e3dd69b85a7d5babb40000000fd08bde203ba44f64c6301d6aa01829b0f7a1901f59cd1cbe99a0e1e8bd2b87653ebd53ac1c2fff939f9462950fbc09903fc0a806f08bda59c1e175e667554a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F986241-A99D-11EE-9AF4-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000f99c45de88dbef8d813b9f39bb675a43e983e74a60b56a1dc859b34c321de2f000000000e80000000020000200000003ec52b6792da12b5f2306bd21acfbc8983ed995c18ec205aec50a432c67147a290000000c22bcef24765d9322649c6933f7aa623ec113db41036aec1699387294057f6c1da3ed73eb02e8a73a558e939201a6c122659ca31a4cf8181f22a4a54e0b4e4dac124af7ddf93e9c99d46eb82864ead53de16682125a6bb3e640e15d3c62dfc318b934cad93825279099bcabaa928ec1885ebad0a35ef2139a1b4c4d45fd609addb22a406e4f7a5c75bf211dee6c4d11040000000fdc5b6f537cfa8e9c5ac721ca628d11fb6583bf0b54a0b53b84a7242878b92b96d34ec7a30275f0c60583a92a76e45e98afdc87091652306a7321293571578ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1340	iexplore.exe
1340	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2144	1340	iexplore.exe	28
PID 1340 wrote to memory of 2144	1340	iexplore.exe	28
PID 1340 wrote to memory of 2144	1340	iexplore.exe	28
PID 1340 wrote to memory of 2144	1340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fbfbb7da749a102a506a5f23b99e06a

SHA1
d764f78b853368e11df937b821a7bf33bf21652f

SHA256
0797ed991cfb4e4797d0933d0932ff429e4eef5403ce10ae1016d47bf37deef2

SHA512
e61d61ba36889fbb3a9875448dab954d267d27535f0475518528d77c37f719d6a79831fa7f20a35470527bf8f48b56eefcaf0abd899df07284fb0b2b9d197768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eddedbf012782cb8e9c980ba194b5394

SHA1
7c8f57a3f1e94e7f390b80424d034be28b2bf3e1

SHA256
52191b705be92e8baefab4cabfc7e0bc56c30b219582ca7bee979c03d44e09e1

SHA512
fdaf9c65632e61666a6c5c57e5cadd7695e9c1ae6be14db5405e88fb712d15234aeb4601839a32b45d816eff687c05ae7e9cf9b26fa11ae716130e0ae1b0b830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89f144984ee41a3b4658673a80934039

SHA1
5d7f50c855d368fed46247cbf5afc257925995f4

SHA256
019a88e8eeaddbf5d3bb7b8d14522f636dd90f378f58cecd8e45b90f1692a126

SHA512
729d2884edf41cbdd2a3bfdffa46c76f898d1ba9970bfe681a7957d5644a63602d38ae52354c7fc3dfa3adcf8ef0da08ef03af43fe5b44ee622176912ee98431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba9f952ed81160ad9fbb767de98b22b

SHA1
5fc7c3428e32eb798dfdbe5c87e529605dc44869

SHA256
a777ac6123c6a0ce04ef93c9396e58ab84142b703c8f3a0dca434121dc9ae115

SHA512
0988bf73aefba2f76e775d82009ac634b41d440d0afc430b35f9726260d010a8b04a1821ca3f60268de9c61dd6e221b1c84331e2982f865184cc15391c81d874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbde52942dec91b69c77621ffe820edd

SHA1
de238d99aaced107c30071c012861a13d0020825

SHA256
b9b364c44f0843f19f6b6d26866a9a225c7aff13753574249397c346eb4fd06b

SHA512
11573cedd49d7612d94a6695f974467121204aa647a7634eb7ad9cbf13c6fdc509dc116814c9f4eb43adbf35832abd8ac24dc08bad4cb88ce892e2cdcfb56a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd46781a1c4a5f664834617de90e9418

SHA1
cebb3ca8a13a4a610f8d79ccecbc23dcbceb0f3c

SHA256
6037d9b715ab51e85e82ab2111fe51e2340143af9bcbce4e8ea8346a55ef4853

SHA512
b13e940ba3c1a0ce6f487ba41708700cd72e1a8fa502eaac228d0b9dfb8a6f0de9596a0fa4f473191236fa9ded500590ee9cccefcdbd475000a03d44cc6c1199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63fd76389bafbff9f3c8c6edd4ac2603

SHA1
013463f5c567698cd65dc987ff4856a0330125b8

SHA256
038025b7898decfb9a960d16b5df44444e0d24974332fd7e7f6a03ae7de21d60

SHA512
99ccb6ce40c29d8d42454bb1a8ec715aafa56e093666f11c01c1576e73da6404b9b4f94616c2273c509f567ea56e0ebcacb46575969f31373b8236eecaa40a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
912a4949b2b212bfbeb374db1c8094fe

SHA1
b319c4fd0c1fbf483720d2e51c28eb6a80179b5e

SHA256
9544cef321605e99abb3cfec6980d75fcc1955b2c69c06fcc0bbee637af18afc

SHA512
1f1ac96bf6a1e6aad8ac6c695a1b5128cd3c298991e133ad02234fc4109458c9bc551253fc2c1375d9f5657c8489bb3835c963bd2a522496e525814cbc622f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b55f2ec8b27441d93560f466cf4c23da

SHA1
8bcb2516e9b7010662a71fa550c9278a88e20139

SHA256
cb09e92dd4561127d488b59b70fa25113335cfc061c1615bb13cf2005211b0ad

SHA512
51f6f3020647df56deed54bcb66cb898cbc87e886a84855049be07310cb40d5f95ced8bd89510b8d94b032d5edd961098d6ecfea4cd91a16ef160e2ccfd6cb4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97c889bb789ab5ce864f0034345ba2b0

SHA1
56ef097c1ad57d8f10eec9844bbdf65fc7dbea34

SHA256
de038113dbc18ad336307ae9318e13e07fd85a8bf3f8d74a6dbcc59c871776a6

SHA512
5c046d0d56410d9058f02bc07cf8f2e0b5a330827ae3d0b02335cc383aec6f889c607680de9454347a818777f4a03ee65ae94456c4e1fab942adb438f4e64f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bac95eae2ee06b738cac8214cebf6bee

SHA1
6f3eb1eb58eed285925b0be0dadc144ed93a8d31

SHA256
82a07b126f53a8b9925e7e73b1c527126263adde90fe7c1b055afd410ad81fe3

SHA512
a4ab4dce15f1e12f67896d62451186b3766516825c2c176bc7f28cb320ae7370dda70575ceaada2ebef95eec356a01f22264dedd5a60c480c0776d634ddefc79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89f2b16d428571dedc8861c14f66c28a

SHA1
7bcd244018a8a50f0f058bada764619e1b239d5d

SHA256
05df38d37f43928eba500e2f61c5fd1f0938aeb75664aa0ca9a1b83e8e7e4da9

SHA512
fef091fe071df43550620c7621b168e60afc407931c7b204534c45b07f76d48965ca63d1ce70a4261ed7a44155bd043e0d2536f7fd829374fc7c3512e2310b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c8719aa1ededcb430399112fa650f4d

SHA1
127988423f3989396455553afb05f5a12948382f

SHA256
9889251359a1c55e9f3b8ac29066aaa1a8304e69319dc38adb2f79772cc45816

SHA512
1cddf98a43e2d3c14dbf32b3976a7cd6125f834d33df505e58718842baf8fc6ea80d9bf218ba00bf45065de9ee35e1a7374160f5c4ca9fc829a548cbda4e3164

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC25.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8E5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit