a61b09275f99aa7f268cee19530ee2515a179a7886d72dae3e901aa2c2af8cd0

Analysis

max time kernel
1558s
max time network
1559s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

17KB
MD5

9706df3dec9007e366f42218bc0b9f4c
SHA1

fa51aad86aa7962a79ed7e713a2deaff9b2d9d93
SHA256

a61b09275f99aa7f268cee19530ee2515a179a7886d72dae3e901aa2c2af8cd0
SHA512

c42b80c1484b5a8e7c4da166fb85f74b18a7c95b49f4e8528a5c5ecad314db1f64c9c6d9af960ba2b217945af46ae86b4a71bd55df35aa8a1389926fb22b1783
SSDEEP

384:rQygDpmReVoOs4TN9ylKeGM/UhHhhb+Di7No2pGvMLVJCBXQL:rTgBVoOs4TryI1MkBhbckIwJQQL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000ac692d2d55471c9e5be02a0ee77ad9ccf2f478af01ca200614abcd12c1bc4093000000000e800000000200002000000089211d3bca018fadfe5049b51230eb098dd8e9545e0d96b954d64ce7ec7511f3900000009d3893e84f0cda77b01e7335b5ab229532806af1d6e6985a93158d3f5bfacacf2cd9318f38424e27a0c6cbf10c0c55ebd16216bc91d424b143d227e085826f45219ec04c9c85c23cdbf8506554efeee49f795d44b66823433b9c591e29825c46be9f17a59e1f262d5447d324704cf2a5fa96ac10405b39dad58ab4fe7e8142c2dbdb033f5d585e062dc018f91dc8a1794000000093d7700ab55ea932c7e5fa85ad7f4411855c02ec17fd0cebe6b7aa928f14f260b6e021c6fb9f0d99a840bd8a3069892a5d9eef188eabf87ca48db2492558b12f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002df3277877da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008f5154a4f3546760458f624a2cb77de027eb901ce0b49073e89ddf5153da3dbb000000000e80000000020000200000002bb0bed40d0b236c90469a6ccd92389d3674baf1e47846713b27c8ced338a161200000001e49b1dad9c2567b72adbc084a01833de94015402f907cb0d7895f4343c050334000000097ad88f46e2b8a39ca71412b62e7cdde0dbd850609f485289b8f7010055426270e946e619a47f6a1d8afab91e403234aa51b4438453acd4f4b2321ba1b4aefe3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416737927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{535A3A61-E36B-11EE-A635-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2304	iexplore.exe
2304	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2172	2304	iexplore.exe	28
PID 2304 wrote to memory of 2172	2304	iexplore.exe	28
PID 2304 wrote to memory of 2172	2304	iexplore.exe	28
PID 2304 wrote to memory of 2172	2304	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c229fe8c4d69315bc4435858245aa1d5

SHA1
bb3d1eeab721b0d458038b07ee6537b2c166442e

SHA256
1eca966014f6a039bfb26c00a3dc04f8f6eb7a3794e81140071febcba455531b

SHA512
bf3b2a67cfc57db41fc6481b6e41530054be6ea1fb31520dc11bfbdf550eb8f7065b94b57193a17130a08a30b07c8fd2fe89d7b43d7fa50d159c1adfc620fadc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b022e0e83476f1f3d1935f3c4ad20580

SHA1
0a4018153861d5ef5c43c2970d7e44f312e2ddb2

SHA256
370957e4e35c01190db9f3561d0938dbe468512d73fbc913ffc7ad5c96aa1838

SHA512
e1a97795ab4e7541cae7f310d73ed6ff616c5535e2a5784c0dae8608525f8599d6553cc9f4346665ef2de8db8ce99491c6ab7fe4052615e88a1db3f4511c20db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05e57ff2fd19c469cab854cc54c92584

SHA1
ef3250c9e7954b8c26dad64278b3c7068b8114c2

SHA256
c85b1829b2a930cf45996863b9c1878e25a8587b61b56da2c16bb351407311aa

SHA512
f93e96791d16ce8f8e97730a839da49aa181329ad4463cd5cdcab1e49431f2cf3c1ff0b0380725c97024317cc5c22b32141a736691dce23162ab82f260e4421c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843fa24fcf2e5225b0acf6e184cf5b90

SHA1
c7e8ffed9e2f50e02d14d80719354c751b26978e

SHA256
9410af7a0a15e8c3ecec432b6c2ff27dc18b873f574875acd67bb5b3b48daa3c

SHA512
5f4e59ed2409ffdc80fc06fc208374cf7403a205db97bbe4debb59f4818fe0e46a868a955d0a32fa108c1cda0dd94fbbb4ba8030c86a56be2b09fc90962c61db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0dea0fc165b23b0afcc93ebb5f0034a

SHA1
2b7ae179da8a24c76de2e120bb57fa1e0141c6c0

SHA256
06489501525382a15350bc907304959154316ad8a3e7f23de9ed7bfc5b756d72

SHA512
c7567e335230bee9664da62f21273dc733032b2573e48f9af42c156446bd89b4d7af5c014700af0c694750c3d0dbdc351b7cb9f836252a4889b8395c668e7d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01e977f33ed5ebd935e7893a4a0fe09f

SHA1
b21cc63d7f8c396f96c2be7f19b8acd4acede124

SHA256
fafbdd2b5153239cc15381db791fd378cd01e147114829898d7b794d51f8957c

SHA512
a0f914e060f3664bfd814e172732eeb8d6edfb9b24c461c2b5d70789ced063e76a79fdc1559877ceee63060c71fb4e8a03ef9a62c75bba3da3d600df09df87a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f25c18f979e699889653367a9c6d79

SHA1
a8f1a59756fbd0d2616189c46bcd4703885c4ff4

SHA256
54e2b2eebd75cae76a39b6cefe3421b8a3e7c38327d6f7bd4ea7dee879daa602

SHA512
320bab25a9661531a442abe45b91ae5a0ce1d7aacf7528c3bf70bb066d10dff24e573331c2abc9d1fe6483e9867e97de089e0f88493f9850e909e304226c8778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ecbb35f502e37e4b162a9176ffcb4d0

SHA1
c87f35c3e84b1e18bcdf465faa90fa66843c624e

SHA256
6d7aa4972369b316e148a75375e187f40fc71b00222aa4de4e92122b39aa8014

SHA512
d709f8df7f0e818f8ba23a1013f0cdc9e5c5a06de56ef624629f690be449dd132b39b1da6540158c9440e4d1834d0f2ba742beaeaa07c8dd807c6e025c5b3fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
246ae2599f4d85b977f38a341a36b20d

SHA1
4c8acdcd65696d00c1466d13ce0913cc843cf9f3

SHA256
19c1e848745e21deb727407132c8665f2c6150d7e97f2cd9e6b4f0ae388e6af0

SHA512
7bc9822f49d4e97e286e46cf9e067bb15556143358ceda0489f34e62b648cfd1e0d437010152f6d86beb68ef8dca96872b9ebba3a56feddd6899dfba1a1cc77c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5da5fa13e6379ae9ee5a615bd477f16c

SHA1
656d942287fee37278f0f33713eaebd32f775010

SHA256
30709b2b58ef1d80184e5ee70171d83b590f2e76e158419ca243e8cc2e795d5e

SHA512
5d18b1b1ae75986e7f4641aaa18d4312cbccb11a972d14bd9f9f0e83198bfe17a272d0cea26dfb3a2951034dcf9dcaaaade31c4e2bceb09654cd4512b8a26066

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BBC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F1D.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit