cdea3f40ff14e31e8afc0810ea6dfea48d79f5d30dbf2b66673aa89546f40cdb

Resubmissions

19-03-2024 09:13

240319-k6zvxsgf6x 10

19-03-2024 09:08

240319-k38cwsge7z 1

Analysis

max time kernel
118s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

88KB
MD5

fa1f40ef09d084500e63cec86333d59c
SHA1

cfcb60bb7ddb345bdcb6505b0eedca58f7e93518
SHA256

cdea3f40ff14e31e8afc0810ea6dfea48d79f5d30dbf2b66673aa89546f40cdb
SHA512

e23475b0d98d736ad84555c6c475d239bee6e6619ead4350b94c1ef60ad02b264d95a5cc48221519984972477ec6be984ea1f9e8f7e2571e2712a2a4620c83cc
SSDEEP

1536:ybQBKbTtHnD3A0vuhGyUfjsfzf04PAPlPkpyXIQkvukuyOct:qHnD3AeuUyUfgfzfNPAPlPkpyXINGY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000b5b14495da8483649e7b88c2d350c0d3f91f969da880894d429bcaf052bf48ec000000000e800000000200002000000075c2be26c587403c0b79ef86346c5f19021f3cc3337b9ab723df2ac88cded68a200000005a1297345bd2c71d0f9b08fa571b6a690a2c237c120abbb6622255302b055198400000009bf71dd0dba6486e5f04c237f4ba3e22845195e5e2ebfa98ab5e422c9c708b5fe029b94f2c45dffe77b07c2989207d72a830e4ca776c8694ef79ff382295c05a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD626B61-E5D0-11EE-9EA9-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417001495"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80eb50d3dd79da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000050bd8b5c9583b79a5a4ddc01211d98d5b6337f027d5fbb64404d62b8ca65b630000000000e8000000002000020000000efc7cfa0d6cdb86ff374df54742261e9c10c86e8ab0aae24594d54860c2eda7990000000f7be95861af06c3f375d6e9cae742c265fbbe9171b2808a77f3bf7bedaeac30d87ab7634d874733d57ade1bb0be89f047fcab1f800f83882e3b9738383d912a2f915ceb6f82e8bdf015d1162ea69edf7a16e8c36e7600f7437de8107a9200355bc0dc81aa39b5d1ad63a83273b4d14ad4f9d4c2f13ba98b347cdd657806dade2cbde4400036b1f7a0db148d6b77310c54000000011f528af32591a98fc2d1b2017fe7fb2e36d1d01bd1b88555e662202589c2edd43b2853270e36a04cdaf2b817ef499ca7c07872adbc83c6392a2407a17adaa38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2968 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2968 iexplore.exe
2968 iexplore.exe
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE
3068 IEXPLORE.EXE

pid	process
2968	iexplore.exe

pid	process
2968	iexplore.exe
2968	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2968 wrote to memory of 3068	2968	iexplore.exe	IEXPLORE.EXE
PID 2968 wrote to memory of 3068	2968	iexplore.exe	IEXPLORE.EXE
PID 2968 wrote to memory of 3068	2968	iexplore.exe	IEXPLORE.EXE
PID 2968 wrote to memory of 3068	2968	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
125debf89fc0bf84dac484c6f25c2f2d

SHA1
3e27ef08c8280b03f219f2aef2847c90c6ffce8e

SHA256
ab37d154c5f5ff1d4bf1668fd7956822b934b608e8d52a4bb36cf59cf604e159

SHA512
35ad53a1cffaed59970a7dae9734cb0036c9028d88c4b4dee576267e12589016fa5c2d02623bd7a36e707dc5d4b6a87a93156a9de594e3d4c177524f32b90841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9e09746ab4a26b8e3ba28aded5dada2e

SHA1
3c39efd56e05d1ae8865b47a28e0d0fce5aaa402

SHA256
676c430de8df57cb9beef5426d2102cf63fcf41ce056f1829315e4bee63b2b62

SHA512
d3634aa12d9645f8796b02bb41e5901a3dbda7c2be426b636a2597423b3049ac0ade98c8bb4187b8f61325167a9da47a26b23d9cc163132b8ebe5f5927294067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
06c474151ad2c24386d38e0f2c8ed8c7

SHA1
74cd8c9bec17ef625d8be54964e84c7218896e93

SHA256
2f8fbf3fe1e57ad66f3d53c83c929bcedc5534f656d306326cddef3e91723318

SHA512
30b734e53eef7465ae8e399d1bee81fedd4b49b3301339e39a8a77546caabf5da89b5d9f7f94a1e0229b19d9d51e6e3ede1fa24d457bea989b54dd653793348e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
526f8502eefef0e11f1662355378aaef

SHA1
fdb1118555ec4879ffa3b50098e794ed4210a6f2

SHA256
aa60259bed573ad79ee7f8f54223e6a04492570cdef4aaf59f0329fc59a2891c

SHA512
27f97a1d64e44904c658b0701b1371365274d20e44a1b37fd87d482d1b292176cce80c81ecc840867689b8c722d7a95cb3b25b56d3d3933f1017523617df6eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0c0927b6f3c82560aa88f5bd32947d00

SHA1
2f641f21ff5f11fb82c3a88e27642a6033b34372

SHA256
f156c48700843db0d4323ff4d0609af69ec296fd249def2dd267675905b7fd26

SHA512
014a34898009b86b8b891b416aec53935fcdf1e7709979482a7da08490f8a5b9fe32d516c836deb56d276d62764807fd03b0fc8fffe0cbc60d9ac051ed9b4056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b813b543bec9ce37f534751a0897889f

SHA1
e57ec6d00c9155b6164afa30f9056ebe1e31d7eb

SHA256
33bf4ba3dc7edf68e3f6a8cb2f1024f748cf19fdea3c3070c386a206453deb76

SHA512
79f1332fc40253be0a71c41d347f6b6cfac3dafb046a98691ee2eab64a1d62b3aa174533ed58c2d42e54d9f0ae781b7c334f429d1972f793c6dd92e9c6a5c254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
232526c28ac2924ecc0de428f1b04b09

SHA1
79b04cedf91c4a672973ce51a10eff4a77789343

SHA256
18ec56302cb6176283bc172e4972f4578dc2b2ac14a7e0f708e0728832421632

SHA512
d332e86f31e469bce1dcd8ce1b021a1b51f60e061e41794e109880af814073129358b375fd78e8e6ca7f1e3faa50ccbbe4f9fac64a58bfe73ed61e5190d57ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4d56e1b81503cd0f5fbe278cc90eae38

SHA1
6fbc456bfad0999899cb6c9c875657feb89ac661

SHA256
d35dfb2c5c4e7180ff6455bc37d619da20c3bf1a465bfe00e7bc9847cd1f6aea

SHA512
4ffe016405b2e2fb8ceaacb663492e027ad3ab4782b03c923c7e909f9cac73a45cc82b6f7a7416225361166a56527f87ea249a50686e14b0e1f84c44370c7168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fd992b2917b41dfa3c253b0d8299be06

SHA1
7b62b05136ccb6011970b917cd1693373b78bd03

SHA256
cc4beac2ccf6bf04aa5a4f2df3f053e49caa65120616c0d52ebfa8f69df18d59

SHA512
4e232e48477bde1bb97581624000926671483c137007c48d78bb9dc6cc4864d6882dc3281b57d0b6400a4a28b78dd86594e14dad2bcc872263bd1f6382d3e113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a9be9b0b9cdb42a4e25c095937dfa49c

SHA1
32d7d07013ae2ade2eb3fa49f51e124fb2d29113

SHA256
4f1538a8dc8160eebbc10ae989b6a420bc6427ef4e1ec96f00f5395b219e3fd8

SHA512
60567208d41969d4d78254da56c8391fdf89c193e1153fa688f60f81dd0f2fa9ca74c4bba9efd878b9fbdae79464c6a7dfd258b4eda0692fb63ac45f62b40c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d766f6a6460e6361f68a30add0cdd5db

SHA1
7f7f3eb5c9814299f7ac4ec15f44f53d10d19e8a

SHA256
b2228a0150ce378ec07a1fc778c3d4d926f4d991faba892cb9642b810273dcdc

SHA512
099cd431692de3229bc74cb75fe2b63eb717ad7a6446686a449d8e2b70125535fb804e33eba277bef320ffa60b0aebd91f32f984084a28d54ab8043d1c691188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a73551b76742c000668ce3ec82c60dd5

SHA1
d7051469fc2dd5d53cf56e211fb2fa6a7e2a9c74

SHA256
48d5ad3362f477d034eeb8560e63a53e5712339216c23ee9e5fb39da1575eeeb

SHA512
0274b7a352ecfc2ab52f0b9777dd56a217c3bfe5d76e4e9295cf9bf2f96705c712b211c3cf1ba8b5227c81be99c1daf9ea20ec3c03337522ed3224392471455d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9c789b519fdddac329620a46f6d5437c

SHA1
166a87d0fc3818ed8169b3bb99412a914a34eb2e

SHA256
55bbc10352fd3a3735ebdc6bd54451705f38e96a45e4ccccb3d650c19e32b96e

SHA512
f22ae0112b7cbd52b6779389236c85151909938cf41d1be8543aabfea8063593e44f68df687c4a2a2ee73199feaa5b9891b4515351e7032b7aff115123261a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6902.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6904.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A90.tmp
Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit