72dd5c918ddefe12fa7a56eab813fb0c7383a6ed4613895940588386f59a58fc

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

20KB
MD5

717987740ebb1060b4d21123444a72f1
SHA1

c045fb4fb35353e1b20eeed3d1fcb3c38e5b6920
SHA256

ed2032d0ac13b7f7a1c55ca3a1b3c780f1b66c3f9d818b9209165ed33f125982
SHA512

4fec3e4d606e99e904aad100c60269d472caf00ba4ad77f0e2a61c01e77e028ac42eb80c0a625a0886e7b1b42fdfb41289df9adf958671143952b2c69fa91594
SSDEEP

384:FSFpvsDuT9Ck94cUseHMNcClCgCtH/1RFlvMotdvu3hl:Fo9G3k94cUseHMNpwtt/M+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000092e35fdeb286e0720d5d0757ebadc4f0101a2d6f3990936c917cbba946d4cb8f000000000e800000000200002000000044a56e3315978ea80e68ac8fa1dc53c18a85dc24756b00fd226b12efb26812732000000083f2dd1bb85fc67cd848353f36d7e0982fdec9c7a44aeafe1be117c6483f357f4000000049072b9bdec90c2d3d7f99ccd6ee451bef363378455dd88b62974e23bba1cdc2dc35f0b070f388e18c34e775c2d73f8f33fad3e71685bba555439e5c8626e7a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411036452"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600d9b5d9d43da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000285c50556a0cfe146ffeeb7be3d0b2fc3160359b3878f4c55f37685c4598a743000000000e80000000020000200000005641ae0ba0d9b63d2949d75fad6622bea426e7c5f3944b08034879f198564dab9000000059f2dcfacf19ff68005e33348a9cc95cea3512b42d8bd163126f055d049aea20816b95c4da8a42c3cfd512766b706762a3b79919bfcf9ca0dae72d89d4945c9369f20fd066c725fc3ec3eadba64a042a7f8f9d21167258c990d5ec32e2f03a107d18a05a42e80a8e9f89864884b702941219548d4ac2eac10dbe9dc7cfeb914c47a3e8a7ae94628f88f0d07799ef443e40000000320f01f3fe2e5f891ab3b26b034a4330bedf01eaec2bf2aec2eae29a6d083ae6c84973f3db9c6b714a3df892d911c77d4d15d4019695efb85949208632def929	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8712BE41-AF90-11EE-A7E3-F2B23B8A8DD7} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2868	1628	iexplore.exe	28
PID 1628 wrote to memory of 2868	1628	iexplore.exe	28
PID 1628 wrote to memory of 2868	1628	iexplore.exe	28
PID 1628 wrote to memory of 2868	1628	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40872c4fc65d1ae4065b9b4fe79c57cc

SHA1
3763077a30807e0f6f3689784f76e899dff7a1cd

SHA256
32b730810d82f4def165c89a7118bb61ad0a8135721e7b2b423643a69345fff6

SHA512
611a496aafc1c47affacdef94a59f7d9fb4ab3ff5666319e6fcc1520f9ff76bfe7427651e4231a6389057248358461f92ea5db45affd46f96b45631dfaa11bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7df490aab0504e4111e16ffb86bd6c1d

SHA1
54f0866d2ce6f13f202d3fe577b3f8792a52b787

SHA256
0f5b05d777fcdda0facd26a6998475df7958573f6ff9fe10e6f5ac6a5e7ead6c

SHA512
7eba81f0ce69975379ce7c8ff9d08310a8adb8a3f26e49774e02a4dc780eaf8d17bf386da53abb5a0e655a17c329e4a92b2e21758277d0b1ece38b2a45e63fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c72154dbccec8a49ce3fde4dcf0ce21a

SHA1
f5aace1dfbf9220eb61701739fc28f5fabae904f

SHA256
166d0715b262bf2df94be4eef6a9700088b3123556d0cda71722f3c68aed6eff

SHA512
89b8ee4e96081bba666531301a231eba76f9958af2fc4836c0f5a767e6af119b7d7e3ff9ca73413545e3638c07875f76df8fd7b6899000c4aca2d225b0179064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ae7852ec6c3c4177e6bb624014e5688

SHA1
b4560afb38dd85c71da23d19bfdaec30be6697fa

SHA256
60c4e6bd4fc01b09a54da0ffc52988fcafa4f9e5bd851c91f9b9b7154dd56a8b

SHA512
955cd180ab99bb65f2a32f6271a2f2c3c19b97b52e85100d364a316000e8bda64f38d7164c1fc2dc589dbeae4dff88fd7df2e3ba046a6b15a1859e74659b7f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de0e7eb61ba0108326df87019d22e715

SHA1
fe9923e60843a9c69a15da01db2a15592eb474da

SHA256
9986eeced0906e13ea9c88a795b6246d65a58b24a0f682c562d4b1c3b7648552

SHA512
d5c152c383bae0d6526f0c518a1a00ded47ebb7f95b5b7ee833d32ed2af932950af40e3ea695d41509b66c3de51fc06d33b5d4dee3f7d3473e08383f4fcc60fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97e6ad936282a3d8bfa3a026d645a0da

SHA1
ed7a676dc0b02c3ab05bc16009571199d281b318

SHA256
3d4420731e09e466aeb150a96b0263fa16696d4580ccd29484bf8699a46cac52

SHA512
92291bd1d94cbed10089602b6713bd4191745d9ae64ff3180b0d96cbf8a6cf02afbeedb879de7a3a14fc75cde8c7cfecce2610ffd31b24020f3a11b7bab63408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebaaff9fb31338061c0e87dcc8c39f36

SHA1
f7e592d62a83c7488199b9011ace6c7984df2da8

SHA256
ae7c55ed7504eee33d18fa70acc4154bcfd3c18f5473f63df07287f0be3e2ff5

SHA512
c9b19ffe52340f75a35d7d574c7aa18a6e984d4b8a00e5898558e99721eab13612e927df427e62f502305b1f3f0a461639473d7bea321ff377da98e0a6b3495d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a07d9e0dea79a467b15c2814ee383d90

SHA1
fe6c0a640bd445570747c7bcfdd0b0bd426d873a

SHA256
c5a4ea3e361c7bc5980d7c780cac5716388f071cf3d1e76c7bc201bddd92c243

SHA512
d4a1b08b25735f3124e42d4446a5126a38fc1e5b3faa9d353e3d0338e5f7cc437dc300f5b7ca87cc965bb34dd31df0fa41605f52a761b25da994950fa392e439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f702b3a0401a055b8221e397743571

SHA1
fc2373c5bdd80354db6e7194cc39f8ce0c89f82e

SHA256
82d107998a06f04adaa00a799c2de29ec74babaf179fae88e17d3ee5e442becc

SHA512
1ab73ca884eff5f3276ff0847fbc5948f54652622988083acccc8fa6b37c0f486912559817dced845d43255a6d5fe315a85c52f903b417d404044c7afe92ebc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a684381bf0e1f9be41d6c865833b003

SHA1
2c0e05e289f6f709366a9de2a6e034790382b0c0

SHA256
6bc14fed18f8fc52df44903a0ce12159449f885a8b1d443328ed864064a1de37

SHA512
860f7008bc934d5e68dbb6ebf910bbead8aca137c80a5c8c71f16fa447b068cd5db12e1e655626be6bf8ccaac59d57f17f34f85dab746906a98144ab433ddc99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74da3500d86bbd49ee662e2cdde5b94d

SHA1
3c64b9fa25b11526c844a48c5ae09a78e979555c

SHA256
96b50547cec7777fa4ef4f2a1c390dd70cadbdafaf74a8f5a983f373b9be4a28

SHA512
2c3c7f8e456aa0cb47412b1ce5d6620e8a2575747b2d2755cade7a6c6741fb8fdf36688d35966ea0b83eed28a902935e15e0fc0bd2e126fb8869b2731e5ad571

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab517C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51DD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit