fc89aa48aaba890e48cd0c4f17a668dc35960e442f657bc86f3a0bb245b2e93e

Analysis

max time kernel
1561s
max time network
1565s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

53KB
MD5

4bc19372cf3679f2c408b8331b971074
SHA1

d65ceea04889bdcbaa441e64186930124ffa82a5
SHA256

fc89aa48aaba890e48cd0c4f17a668dc35960e442f657bc86f3a0bb245b2e93e
SHA512

7ea1801e21c9027b4ee2d0d0ba12557d9c036e01edf647e35c00cdc05bf330a608184dcb2250ec7f97f229f2229ca5ff12bcbb0e7fff73c70499a5f485998b4e
SSDEEP

768:x1qNCsw7+rM7oOxKDgHYnow1Qlg2B+3XasYqytcaaUw+7WaNG8mEyn5DIyOYMYRn:5sgyokex+3XaHtcoryn5DIyT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd000000000200000000001066000000010000200000004efad7730222bb0e4ebfde47562c33268d1ceaf56dc0aa8c22fb09f803f4c6c6000000000e8000000002000020000000f15eedc227a425c4154f614de7c5a41ca1248c4f04bd3103a307620f811cd916200000005af6b7098e1d645afaf5883d069bb26934cc288228193cad47f3592df377e61f40000000099d0abe4e663d73754fd6cf8b572e29d5996a7964b16c486d5b1934c8ab11fc0b9b90a68e8ee49fe6b73dd2f69739a3d2a30530604149847902b80450bf0df3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{192A42D1-E39E-11EE-9288-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416759737"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd0000000002000000000010660000000100002000000092a2533240b0a049f0cdccbc592134f8f2353477aa5e6c6b635c43fc47dd15aa000000000e8000000002000020000000ae14cadef20562b785fe235d1073e4c607c5e36bd17690383222a10cb8797b9390000000c317f630976409dc9e5c27283b73b3ee9abe9b6c0c62ff755aac2cc312b5be9d2aec49123e4e19e59b33e36cf9c84d9a619c17ef55ad304617babe656207a77ea9349430490dd78a831590474058a2eceb5d57d41f4abadbfbd895a4992bdde74f77e87200a620b677e2f778b930349a13365f7d4707e8e9fd0c03b0767e252a22cf69c4f6295865a5c4867af82f778a400000009d4483dff0fd16f5fa153b395f6617c2a1a3d366a3f2b636b5bf626cf046ea4f8ff9e7d782b0dc719a3d23988612f38962ef09c02cce560d71068f09bcb7c7f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04cbdeeaa77da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1884	1948	iexplore.exe	28
PID 1948 wrote to memory of 1884	1948	iexplore.exe	28
PID 1948 wrote to memory of 1884	1948	iexplore.exe	28
PID 1948 wrote to memory of 1884	1948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4a9d1cd8b9f95e222ea43aa520587d8

SHA1
0861f09dbc46742a8c28d9cf47b4b68fd9f2237c

SHA256
8dfb6531b376f5f425740fe527856b39f4e532b765de55bddb641da97cad203c

SHA512
3bedeeeb83d9ac63106103182337fc470932e215ba4fd2fdb3ab12ef78dcdbd3ea5fffba04c4057924f54bd6cfd7255e26ced990d32ba400638d791092466f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddb88e71efdd66cf7d041a8a12778cb7

SHA1
6eb948073c67f5f10e80fdbb37f5b73f3367506f

SHA256
17ee57a4a0c0fd899ad16c466f0d3da527f964f8b3ce9b30eb8add61f492c0f0

SHA512
fd144bedcaa88705d387c6289dc408a2b2744ca4065ef4f3e4315a283b3fcf9e68b9545a01745cf2718ba4a9b4050df3eb566691c7f54cbd95de3ad3854e6e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa889452a10e418b30597b166e627d03

SHA1
eb95b3340f150b55a8c02d7756f2db944803822c

SHA256
532180ad71db5ebdf5e70e082ab3ed80a40f160893e1af1506be93ef545de994

SHA512
72c753665c5b84bf72b64fe3aef10e122efbcdd2547fca5043dfef09abf22e5e666962053095d0f96b1272bca8af8c398e9d27dc7c969e7a005aee0bb5fc6db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
202187b274b5bee81ec2f03aaf1f2784

SHA1
816a73a2818153b35cb26cdac43cb0ceba2a53f7

SHA256
3a2aca1bdcbba8499c51a9a98658ed53e5b8f73daee0176572493871cf97cdae

SHA512
440235727a92a597aa30a9bde42711798fd1e5ba9c6f94786bf50b2624fdc4c87322ea912fd2b7b86d825828359a6959b097c05ad52769a7db50caacf2ade76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ac77413075391bf11982c0c3400b08

SHA1
0f5a0c28afcf9456d4e072cfe62efaebb0e2189c

SHA256
43b3ffb41081b24416f21b1593a524f080a404a54abf50b7694c945048dfe26a

SHA512
d945a995fc89f075f174a67518d0e26620ed2795a39bea8adacea80986a5b700454b3dbe60d1a38adf847fc995d29c5e9c532c7ca2222d76fa5c3c5a2f146ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fd20e1428b40da1abb83d25509fae42

SHA1
b586bee79fda8eb8d444ee2ba9dd8fc3d7c6aa85

SHA256
1f7fb86a89c3db07136595af153e8778341c3cc8d4d36f7b04c558f72c5ba5bf

SHA512
7f62103687121105f3c22c13d0f14dc4dac94e12fdab54d097eec99a068ceb6122e2b9a163dc0cfdadd2ead68a9e042252d0f34c3b23428642ab7022eace94da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
462a032ed33ecd98365e68eae73831de

SHA1
d8e5cbefb8724a5b507abbdf7813058436a69a22

SHA256
ba44ce8f8facf09586fe9a0ce12aec5fc49b133d690b0444a603a9637e0321fa

SHA512
36c9101085663822fb8d66d67328cb80dc5927a1f6e1284dfb321399995533c04166e6e64f9c06f853899fc964994227b1bbaea2329c80937820b5dfe935684e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar773B.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit