b5571af81c16b3ee63e6710ba8bbc51ae4af0edb556e578e0f0a94f5208fd8f2

Analysis

max time kernel
31s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

14KB
MD5

c91c632855a9ed649914181f7fa55869
SHA1

eb0054165f7cbe8445f23ae79fad431f3d04cde5
SHA256

b5571af81c16b3ee63e6710ba8bbc51ae4af0edb556e578e0f0a94f5208fd8f2
SHA512

bd61bd60ab712b2a42106de9c9a586e0e5caeaa4cbaf29a3773ddc4116e1cbcd6ba142d6331a985b01f89872aa074a9b9b05ae6b9100096afd3f8b470b6d724e
SSDEEP

192:PNx5Ssv99qXoqTJkNr423hZsdh6RwRfIpINrJz2gVBey3N:5Ssl9qYoJkN0uZsbpjFzLBZN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DD5A9D1-D66C-11EE-B7A3-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000093613b266b5ff9cc8560dfc9432298325281e9f2791ea4fa00e6a14c6f441a60000000000e8000000002000020000000b6ede964ebee77354752ffb6bfda31e4e98725345ab560abcc50bf1770cac3cf200000006fa13cbf7ae9171e721736736423a774efa96c6b35a1e32356c5afd7fb27cba04000000049e6286728632194a280917af9f0388d8e4fdd7f6bff1fc4f60645d5988e28ce9ebdc78d5d5af379f11e0c009f8ac8e488db7446e20a3b79380bdf829b989913	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000006968a8aaeb654c858011ebb2c76396ca1fbba5d51253d6153aa8150673c123d6000000000e8000000002000020000000528b20bce84bb34dabd7a66cb62070e997ca99ceae227e54e6a44106813a389a9000000088bfb9a9e2ca544e0e3ca413692b1a2da094619e5342bfcdb200ddc429f137ef7c582a102ed7db4d4554eba6d1bff22f6ff4ec16146168f53899babc9421abc58b9778b04bc0ab61472a9d48427596846d5f9ade73b0044edab4ba9d9e21f9f9f8a9114d920449e66b0bf0a38209ce6ac4c088f73e191a848965cb1c7c0d66f47cf930f085b4180156ac03bf3329d37e40000000ae4e98dc24915a8bd3e00b15abfa58ba5be2693637e4999b27366020c2abc8a9d03ca6f0acbe323f2d9b348e4bd24d1e4b5ed2b92a4a78cc76915b9891cc9a46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a067b4f2786ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2656	2180	iexplore.exe	28
PID 2180 wrote to memory of 2656	2180	iexplore.exe	28
PID 2180 wrote to memory of 2656	2180	iexplore.exe	28
PID 2180 wrote to memory of 2656	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ac234564cbad2937aebc6956fc5a726

SHA1
efc14349bb37803e9e5093453af109ebcb4d0425

SHA256
fdd8798b0bb7f80792badb163eb7ef15daa6c671fb440aa7a466bd5f1fc96639

SHA512
b798f256cc418a6f04485bf954effa052c3789fb0f0dfc50d07fefa4afdeb1930fe66c51930edbd6ba31b24f1951f7a1e54338da88a922b9975e5591662632a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c1c57d03d53d1688a3eeedf04c24f3

SHA1
2d1f595dc6bdc6e95e58b140696fa7672b0d98b9

SHA256
a59d97874e4e80c7ef0f1045b0217573f42809128df7aa9e5041e09f400e70df

SHA512
75d6b808134d75ae7483344f10148c62ced4741f0f9d63bc7fb54389627d7989ad2ae3bdab9a6e6c7f80051da366f5805013451b0a6a432637b6c9b93e426cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f0064e0bf3ee879e19dca7c83f5a381

SHA1
a4a47e48812d836d543834b7314a0b05e19bb9b3

SHA256
992684507ad5b2b3261ea1cda48eee16011d2b6cb86ff1496fe279311738bb35

SHA512
1090094b144a0f7530da34899cddaf9cab9ed9a5343ebf7437a435672363b88e384c0258f78744f777d6428005d73f5c395c9a4378d4a6ab431355353119c8b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9afed525d60f25d8e4a9d8ff0a90b874

SHA1
a24a4d21b0ba9261620682f3c810c34a6b8d8c1b

SHA256
8fb2d98494a996600a128f0882176f5ecab61fb23af762368daf0d7160e62057

SHA512
603deaedc9fac75557fab0408e99b0c732901e5e1e30717632d97d60cbe0752b8ab2514ec9b03f3e82cdc397ca6ab274d0db3da575b22dc5120689383f853545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e20750af2d01542495754945677f0f2

SHA1
9a275efa052f4107808341672be1a51d072cd577

SHA256
4581992b53b83a46ad528109bd15deb2e362c63f9de9483c2dde72c9d3ac91b5

SHA512
045e2db50357c0a1a2ec5b6fffbb14d4a67ec1ce0bc156b25f6b006fbb8a61f732151cd33f3e66084c62b7cb2329f849c8f91be419967049af0979f82bea0772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ccc8b10e6c9aa926e4ab8b62a450324

SHA1
f9427675402eb9f0b168bda05bdc97d617dd9525

SHA256
1fc73861e3e5b95f2508fba54c8c9f285fa26a7cd7531c5a6afd568b46d7efe2

SHA512
b0f3b4cad592ff3e6921a63ae8a5ab3a2a950e59ef88d7e82f32b20cfaeb4c97759bc85e62de7919733483cf68a2f669a23b8789da27dd8572a74fddb2423bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83d869faeaba533eca72e258d1121aaf

SHA1
ac5348319d7b12ce136f55a4c9e4340386ff9da4

SHA256
d4344c121edea2b9f4768830ca353bbe6e8e14fd1b6d54f5864635ba3ce37b3e

SHA512
2c7323d848cbab0507a8957c799d6f08b62adb8140dc1aaef888ec92368d060dcf1d5e4a59701983da0e7af66a03037ca5396c87e1ff835099d2e7b34a4414ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90fe4f2e4e548bae68ad0ec4b855de2

SHA1
020f6d8bff84360b5ba3ad77481e2d3bad1a18ab

SHA256
d9e0c607e4b33aa71a749cf914f036c773ce5834520cbef87ace62625c65e36d

SHA512
0eb00fb61f50222f2952b3defff81d9a5c8ee02864c6d9e0d76419c42d46a887ad65d7bf66afaead7ed5066929f423c18912a3647be1a466373dfbc9104ac27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ae937742f92bd6fd170b9cbc48008a

SHA1
fcb6d3e0c029128010ec9b544153ff3987956f61

SHA256
3ad415cd4b7143330cf75d3a8b6a138ed642115e42387bb517f5c56ca2357051

SHA512
daeb1f5840406f08112a928225d4782922b14fa771561a83373681692d3de5a27a2f9de8e38b877a1f05283378e5f376c3a2cf373b83f6fbc61011965d91a167

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AA7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BA9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit