797f66dd4a059462bfe3777ca0098778319c33ba53ab7def04ee75f7ed5206f1

Analysis

max time kernel
157s
max time network
177s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

23KB
MD5

9c7164adb26eb52e5ab494bab5c1917d
SHA1

535ca141c079e3fe06c14261239f8835646ad45a
SHA256

10438a1fa688020d7c3ac2135c61f77f0c211267418cfc02a9afcdc8d341318c
SHA512

9c511d6e8912d5bcbbd10e0f65856092b92ace0a2e749f127e8a6e664a1e301c60ff06f8233968834daf0f4770f981e8d4ef61148ec61610b39ced9f373ec8f2
SSDEEP

384:bSFpvsJhrY8CwtVHgu5/It2yKHedx24/1RFtvMotdvu3hl:bo9k+dwtVAu5/It2yKHeVM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCD598F1-AF01-11EE-8301-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504bffb90e43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410975196"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e730b0d56a602d69f89cd1b19d56b0388b2f30c8b0e51bda3a7665c79c3c167c000000000e800000000200002000000027815b207ccb3c07742d66afefaea182830ea3d784253592537de493296647bb90000000bdad2faedbfbdf7b84e0bc7f3112f7c4a805196b8d6d12a8f2b76b84a0c42de7d1fa843ac448d52d8855972f410db30b84bb024a1bdf1907e667af02a3bb49df3ff95d295e1adc8faf844eaf57b0ea42fe45a616697ec92b57250f4f04dd2ef8a37e29744c536e6228f71a52397e1cfacb079d3314d97cbff1cefe9af786891cedaf391783c76e0ed4fcc389c575514640000000bdcf3c7030431642a7fea8f2d0c02236882daae4df441ebf459af1cf16108786e2f98067255a51d0d9e231f6ce3ec4857f90048efe5e4c81d9e101e79261853a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000060a086dae36d5c992cd8a27686944e98d77fbf03aae55032366e8b1c079905000000000e80000000020000200000003ee11e7a47542fd8e823764227eaf4db7119839cf39590bc49c5c6f9b8401249200000008227c4b5b81b64a7b6b9a6734b540a355df40ee4850846ccad93a61b3d61499740000000ef99b80fd877660e2053996604bab180a985fd623dfb3df280549cd95a3a9e8761a421d77a7ced1ccc613d2013f348a30f4ed7f24c8b9edf41a40749490bf95d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2712	2024	iexplore.exe	21
PID 2024 wrote to memory of 2712	2024	iexplore.exe	21
PID 2024 wrote to memory of 2712	2024	iexplore.exe	21
PID 2024 wrote to memory of 2712	2024	iexplore.exe	21

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56e2650d51005884d2d00763682e5c0b

SHA1
bfa864d319a9d8d2b89a71e91a159dc35e0043f6

SHA256
627e61cc907ccf764c9194915fe8fcb2bb05fe5f7959981cec2a84484c678248

SHA512
3a527bd3e00ce2e356b48cc1553dfe174cea944ccc0954744299a7c63ad5c8d8111c745cf91f3d7d2d52f4739fb3465cc2ac3b09446cc5d87a67f6cf26350eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb792644f23d0051df633a1797d836a6

SHA1
aea67b429fc44f3d7359015e8de30d35cc3b9134

SHA256
2bd1a2f96e3339a9414f1d5e60e89db98b92c8af02dca11393bc1ead57b10640

SHA512
33cf594b0f449f53daad19a511881b0dddfa9a2b8af55b7985f5b23ddb28d562779e10107f6c46d8c44c2f95ba47133a3e561fab76c59c4afda7210e98b030f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b20b8601f3da115bf7bdc105419df75

SHA1
17a9c41c39d23cddfedf3a7fcbe123cacb5a297f

SHA256
85f434163c46e3b9099a5c6a13e94ad46b5b5074b66b91adcef14583943e77ee

SHA512
a4e98362bda2b03a547a40207b51df0c5db80e9f43db2d4908ea00f183206c31bb064df7eb8dd02b0b89405d313786bee4ff7b85202c5ac217ff4d3b66c63f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1e7bb5e1ddf5c630358ce51497771a

SHA1
c1292f4277820eac5be33392e64a1406614ff262

SHA256
18147d80b2aeb2a144cc57da3a0a260ee44c4c270084b41110d0fef81e69b0d6

SHA512
8e62ec2a0c80f066c67da7011954a4871b261f2fbc9eb8f246c734ac25ca337cd571d752a14a2ab906d3d4c5ca8c537240c01191712a054e0688d112a6cf087f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc6e59a70a42bc259b82902e4cdc6ea

SHA1
77b6ff904a4d61a867078762d0458cdce5d9d4bf

SHA256
b4fbb3e2fa632a9d6d0922524ae25c759fb3e60dc23f4db727a06d9f5b99b825

SHA512
3989552ff2dd629d6a4b5b6ef053fb6d3dd565569c6288a4659fbda64e79fd4f41a6906ba31b2d53b1768e0893ab376fd7af89603708a0b69d541a658a21d626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0687a323cb1a2bcbb41380f523f84679

SHA1
1ad161002bbe716c630f33846c445a247aeae6d0

SHA256
3007bd05a430c30199105f753e66fbe9540f5d572386346a579e5e930744d527

SHA512
4b0af21229173f55168565fc6a03a1bf60d3d34f7eb8ba95910440d8037b83b887c341a61c1219704538beedc0a538a490870b27436e1280dad122cc0f8d4171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6025fcc47303d64b4e993cff6219d7fd

SHA1
0b851eb10d57c751e67265d69cf1758c718326f4

SHA256
7cf163cb7837c7c0e5a107665d235292ba8fe361a79ef2582e98458bfc4fff7f

SHA512
3ebe14757327e63d7a7a975c7c07507dc6d27bab3f7b4e130a3ab07c2685c5b160d48053b897e1740f737288df5b4f1d3b4c5475b395b1d9442e83f27270a995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8eb54e4c9f62ac4067a02f9ccb32b4a

SHA1
3f682cd8a7c5a9036bfcab995402292f4266ed2f

SHA256
403785df30f67480d7f809c3ceab1c408748e6d7bc619a0d038c52b90062746e

SHA512
424264e7b2ddd4d06270aa3da8edb1c0676d29c4d68062a0ec0d2a774fafdad2e4dce572353efa6abb706ec5c866680de0fc6a1cde4c7f5bb2e24329eddab21c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee58ddae485152c91b51231d29621098

SHA1
c74ea5f0552929ca699f2afe95e6860317ab0bbb

SHA256
46f6448dcf38bd88e613ef6777de83fe0218ebbebdc6c17142d40c856b93ba5b

SHA512
11cdc03472b5973ddc9f1a49b2f1923598cd77f4ed140adf8e7b78314c0ae6a093674dfb2609f4c4739655b9bcbb49ad69b39de6ddbd70bb5e506fdf300f2a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2965b91d7012cd22265f608a1f919344

SHA1
2cdbeca160e2ae1e148f23c876e712f643c2e870

SHA256
d1c83a26741744bca6802261932b9e41a0cc577dc0c6305a357e89e5f7215826

SHA512
4653cca1c01f1285f61c2919a50684ad73fc1b874dc7820ec895edbc90af5b545a94ee28f2b07e95bc8bdcd202b34a7a29c791976607fa438235ba4eb1e33d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE39D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4EF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit