aebd79c19fef5d3628a21f279b83331e8fbd90d357025919eff49846aabb63ab

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

87KB
MD5

c291a233ad6d7487a9f8e57bc47c234e
SHA1

3190bf83a27623fef706f78a2a7b626383f37e6a
SHA256

aebd79c19fef5d3628a21f279b83331e8fbd90d357025919eff49846aabb63ab
SHA512

2f39c201f4adc8d1573d2729fceecfae8d3b4434bb96c78d759cfaa056ea268be529b0b7c20255b30d48f01d763b362c33802ae34607eabb429fb86b2e633800
SSDEEP

1536:p6khcqO11cxfH/h+jhGXi3ox++CC7oKMUqX7Rhs6Aa:Vfd3Y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002b03e8b92f89fb24d519aee88b56337e57474e9f3e1d0218303bf867740d28af000000000e8000000002000020000000e3b7f4df1f96fe58f160e020f3fdf920a9415027790e646485248c6270debd79200000009e9a33648cdb9dc83465d23d9f71d0fc8b6b945cebb69870278bfbde32cd26af4000000028c1ee536cdfd242e3aa399b19c51ecc4b6b27f8d7e36268e5f8f1abe44b65dd1544c73228a94327d7c5389143aca8c1290c32d8464e6896d9ebf33700245e18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000f9769fa64da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414704825"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A40DBB71-D0ED-11EE-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000a7b87b17c6063fbaf84229621e8dc75a61b14496c7b6a19e3c6b0d43737806e9000000000e8000000002000020000000c7b1371f315f95b4fe64d584d216f273bb24ef612faa0c7a810aa3e02d2e582a900000005805e46f84fc23386166339f66dcf1d399f967d26f470b927bf38ae29fe6179d789b8b9091d91ba3ee9f1fcebf4a48900753367a815517dcadb2b80b6dcd17bb751392c1825a0b33523d28361a4ea3d462f5e88bdbd9b5cd365b1f420cf1c900d1f93d9f45e714038f58edb26fb812e1f35bcd5f076345b9d00266c05e889078011060ee7005da3fcad7cbf9739984c740000000c96c18581dc4955d6d383e5036a091120e9c6f1ed06cfb5ad812375b77c832e4f2be6762c5bbab11692c61cdc2b798bee13a9cd57303b538fb5563a0c93160ee	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2636	2348	iexplore.exe	28
PID 2348 wrote to memory of 2636	2348	iexplore.exe	28
PID 2348 wrote to memory of 2636	2348	iexplore.exe	28
PID 2348 wrote to memory of 2636	2348	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2ecd15be95a4438de274d9e763992b0

SHA1
8a15df98617d117caae9bbdba489bd181ff60898

SHA256
06e8b27cb64aca74c93b825ec66d096ef08eeb6d3a325ee761ed8831c1c1919b

SHA512
876a6da05570517031e7b5b58148efe66b7ab3f78ed25884c4c5a17b50119b337baeeda578b9f0a6fbd82148f5be54e85b46972441547ba9384cd102df24c78d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc4305360b7f7377b14f143a72625c50

SHA1
5d4be39d6be156a94a5350d042a22a4d7a5a9637

SHA256
a9e2c0b7a3b1400fe9e1c5f31920391cb0215df6a034327be50d6c1a61401d68

SHA512
30102204108b2d1091051a28ed25d6287e66dd7519cbd520de5e6386ddc621f5e9a8f90b40c885ce76b5840166c12382e35718952f26399770f90c2fe674a1a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9fa9cb19bf000da1851d35b98bb2759

SHA1
33f725752a9a728dd8251acb1edcc44d756c1dd1

SHA256
66b79608d3fda007cd06b910e24a47c6a2bd0e011cd6039afa85f63e46748d22

SHA512
25e934dc8012535c679644086ffef492835dec74021c006aa40a28468d0c976f8898b40eaf849d5cf4f82a4c5399cd201892602ce6bbb1478375b23b59cb1518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49017762e45c612f50d58ed819020f70

SHA1
d024a8e41e93894df8322630593e8babcc0340e3

SHA256
9465f41febba74f51f92c6bf0157d3717a5584ab7728287a529e374f05af5c49

SHA512
b55161650c5674926bf35c80195d79578e73e64022b45c634991165a6d5cd2ccb8a4a2c14a269a1eab1cbc100d8d212ad0fa61b83b877f4d5362f8b734cc18cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4c61f945a5511b2bb0d5427e7eb711f

SHA1
a0414b6399264a22aa51bb2a1ad921706f6ab503

SHA256
00b140c93c1ae2019bd9af46004ed215a9b25b7ab3805bc423b6eb3703505c25

SHA512
9bf922a9febe5f5b835f5742aa275d14bf6f2a4f854baf4ea2533abc77eb786fc7796229419f26a7cc0e1eee28d80b6ab2dbd3b5631e8d553f6af392ead49de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a075ff04d025e077f65ae4ce7a8517a

SHA1
1d2cd00c99f26d605f74a27137cffa74ffcd803a

SHA256
67496d062ac19a95425b20377253967f843473860002a8d8688fd975e2918eb3

SHA512
6b8d99847cf7b28bbdb2bf93681dcc3b6343f1027b4bad45bfe5691f9cad17f0d0255e73d4aa01960d39ba40bf03b987527cc28358bd35ece74f9d5924ea5852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bce6734b977a450afb30883227de106

SHA1
92d11704e00b7703926b078ad701a865b91a705d

SHA256
84309bd5f6228f80da6841f811b310cf79792fb2b9e1dbe645cf41a8602fca2a

SHA512
7a0a07ade0a83f357a1e1e6f8325763ccad7955479d5ed7239b733fd62da22e792d834e1a488e99b1beda2dce9d550ce8b1c1763897203f7b94a223aff693d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4ba68321347107ce2ca814627412f2

SHA1
86739408766af661af89372d18a66fc868d54140

SHA256
b2881cd7c38c3e35c9eac7de101cd50cc00e8258db57c77f37163a85b984cb4e

SHA512
a4ab5d4701d1ed768177d180400df898ae8d5ed7522d72a1ca838dc5147c5ed0c43ea372d91462bde431e597084e1306903698594aea7f2ad8db296724296406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a3c3d1c5f7dfc3b5ee74e4020a7a3df

SHA1
e43085d0d97b21dd3fd578727878cb5cf8e22f1e

SHA256
d3a263f471a286e7d645a1d66f08ddeb11cb57a33d443517424d5a293b512a58

SHA512
b1a4b7e31c6d65edca9e04e94c92e8c09b6f6b7a9cf7b7183aa94895d116834a1bfcd9a15e19fa4f56be6b49d809b406471afe06a56beb88c96d5beb1d39ad78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85ab7b821a9fbb4d97bf8036f5ddb2a2

SHA1
9b0cf3224f72ca680106927beec769872c310080

SHA256
10847657a8a41cc981039f72816dd476fcf1348b6a7aac85f0a25e34be6d6f8d

SHA512
28790eb4143ccc95290a9e900f1b60fe1de163600c77ccbcc462eccb6ca254438f7cc853a106b42d2b367d52aee381696076568b3df892914e6bc593c5b81d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c33e835c61e072d56982f4fb100cc8

SHA1
36df12b39e368ba5cac1da482e6f630a61580d66

SHA256
9fdf4c2f2c36996c7a94ae021548136a08b43f23c50af0f423e0ffcee8738232

SHA512
0802f427b5c09d20b150afd464bd1f3072486f9929ac86f383e43462f6237543013d18801b85a5438e9bc02592c02ec335f0b3f7def402c6304c7b4680daf4ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3db8aaf2ead6286ab0310a622fd14102

SHA1
1ba01d8096050ec7d5eb2b96d64e85ad24a7d5b5

SHA256
3bfeeaab6f55eb1970b26d9eb23577e062db664486fb9d110f641746037691d6

SHA512
a9d7e8425482af7fc972b6b553cf39bdd92f964a9dd7af96fa31d709983d0b4efe214a6b4b152064f5c39792c4b3bd4583fd9b492dba228225d091d64efc976b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10045e782aa79f363b8f8c6f89251183

SHA1
fd9c8ae1447b5d7974d347f170e770955a124a70

SHA256
55580da8a98f0aec9d435de0305ef761b44352c49528df6a2150db5d9bbefd75

SHA512
7419ec60d0ce797a1ca34ab8220a1538f6e9c08db7efcc4de2cb356e56f7d4aff620a338c5a9ed5a3637e5419acd247850712f76bc8a3585a7c0f282b823e0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2996b838627663972c7542aef27f1a8

SHA1
c8b926dbffebb4f899c15b1e681c616a1aa88659

SHA256
db85191ddc5afb3f9e54ac761e46e3291084a0134497b5d2d53f206a86575dcb

SHA512
567ed875e9f7e22eb3e76e48ab8d6b16d6be05844de1480a3b2510a742c9d86885cd757aadffdd52ab932906840be47c388fc136ccb5ab23047c0da28c08d7b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8a69482be6acdba375fdcf4f42bc68

SHA1
e407678d8c8cea5b71fc8e04e9704c5a229682f1

SHA256
77806ed77e0375b45831cad3f3300b9e7a68317b19516b25c2058fe009aba350

SHA512
e7e5d3ef947a0a8ae689e03fa71151ebc991e21d74f0228342dfbd9c97c0909a9524627228fa994e8d196efb8262d4ed992b81eda81bfe202d2ee2d269ab3a40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2272.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2311.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit