26d45a00ef35702104a153b544f03bea5182b6c4ab120d5d50fe1ec4e297ff6a

Analysis

max time kernel
1559s
max time network
1560s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

56KB
MD5

081670a4f1524ef81680f7499b86be0d
SHA1

81066751eb2458a409bf168676241cfe563bd9e2
SHA256

26d45a00ef35702104a153b544f03bea5182b6c4ab120d5d50fe1ec4e297ff6a
SHA512

6ed7d9332ccaad7bce5f0a36ccd8082b2073f83deeac579377e1ded17729a9a4ea5d95264029cbffa971929794b87b9a3d517833f138e52f7fd5e4207dd5e5e4
SSDEEP

768:a3yvV72MqMZRfmzOt26Ws/g36Or9v96AgtWLyvV72MqgZRfZtWL/g36Or9v96AGt:a3akfxDeHfxk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff95000000450000001b050000aa020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009dc1b15febb4f4e1e2c3a38bb8ccf5bd18def760bd23faebba0b213aedc7ae37000000000e8000000002000020000000aca1a4e49de2db5b7c7a8b534c0909eee59bd4aa7c31b0a10202b25eed49853420000000b730072b745026ab2a1df6eb81c577bc300bd5c38364fabbe2928b0509b53d86400000008f597b0e47f29a36b4bd96923abf1ad42f5489eb5b1b31abe412d3e1032250f0530e9cf2a31921fb1117701610dc3baa7ec7407012f084e420b5e9373d9bcee1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{335C1E51-0C9B-11EF-A6AA-4E798A8644E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507ef507a8a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005f3a047aa80de7853ecbae17ec3d35ca87ce2c9963265277d0c90d39a73013bf000000000e800000000200002000000077bceeeaa3ea88532da8224c90059ace51dd994aa85137d21f102e7a8d9aebdc900000006bc986af1c3df142d3eca582d2ee33d930b5f177e58cec1de58937db3fbf9fe301e943993b005f2f4b4a1c4e7b1d5321365dd9b7829f972587f6fc0cdd7e60655a688d46a8da74c873c3123e0bd6281a0d083c261accff026be3762fde32f5f9e315058e83e97530007a17a13b96954244f7d0605882f4ae5a265428eb569e1389a52a9e329e7550aa3c9ae5ea8192fe400000008e239e119bcc215b1dcc6da5dfeaec7eb11eec54b35d68d2c81bcd1f59a1572c020dfb0813478314575320816e95fcb9b55e805eebcfb4682c177f2597ec916e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
844	iexplore.exe
844	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
844	iexplore.exe
844	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
844	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3048	844	iexplore.exe	28
PID 844 wrote to memory of 3048	844	iexplore.exe	28
PID 844 wrote to memory of 3048	844	iexplore.exe	28
PID 844 wrote to memory of 3048	844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c42d1ba45afedda76a0005fad699905

SHA1
2d4b024a06a9769da93555bc33c259b0b5e48515

SHA256
85ce6b12e96f50a116f82e7b290da1bb59ad47b79bf43658ee4f881654734ff3

SHA512
203b8886453114842a8fea28e2354a30b1a3828fc2a2e64aec6698c3b21f9edbe474f9c6c1178cf64509776c6e026e8229850e762ccbc3e60964402966113afc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65eb132da81d776ed3d5c00dacafeb1d

SHA1
1d898070884f0b10f4f346987c9f08249387c7bd

SHA256
05f872b654706b742aafc2950b46a137d43b1a2175a9d21be89affaab5f20310

SHA512
08cfbfe6ce8bd9d20b6a43c52c2f6dd08a8d1154f8c80b3b0e734ae2ed319cc1ecc230c36195fec3ca639d282049fbc48c1dbc407fd62b2fadffe1bbd785a111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee5f0a7a2f1ddf3a566213d658b5b3e1

SHA1
8dadcbcf9931f212467e5213dd2a690fc2eb926e

SHA256
2f9493eb651605bf8c0af5c7b0064d414f6e2ccb0e6bc2d42fc2dee838e5b0df

SHA512
a5df892f6daee5719b07042ff8b880adeecae679f0a3be05d37279a2d9088d53e4511cefc537c12ef4f516b7d8d1d96886d6146950cba45814a89e2935927e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50009eb2cff0c2f6418e7d1f409b16af

SHA1
282cbf18d12cbc8ffe8eb78a91af226523f625cb

SHA256
90f3e7b28d1b0d6dd5047abd3d594fe8fe2135870c48d1e88083683f26f5a59c

SHA512
e62294e9b4518f02a116e0adb8f3c0717d6da747767e36f3af6496560ebae37755df8dcee007ab7d598aaf8bfc15498878cf4bdc72259aeb03a31acaeacfce2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20a131a54d6b8120d245f0718bc0be9e

SHA1
357c2f9daaf9ab256ff47d53205fbe1a42c24d39

SHA256
9e39c6ce6bf68405f2b61f8fe06936fc6016bc258b42bedfc2622e2bd2c3a62e

SHA512
b099b5a1e0d9df3b103fd2c9bf39e8d97a8f4e7229dbd8794e6144e292bdaf4c470cd287542f4ac4458961f8d3489bd50d75e21115da5682a72ddbf0fb09147c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e786fb11a9a5ca9382a3ecc79a3e3847

SHA1
8d06224678c327571e0da9f884542bc936497cf9

SHA256
2efd2c023c7d9ca62743636e8cd02e200ed73dc6f4f109fd2b75ef6554b7b4a6

SHA512
f1a3692f06090a60a202b882a2b703dbd531022cd97622368803ea1cb0f6d441f18876dff0893c911b93148db26861ee91e6dfb97900b9fb94846a290719e64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebce1d6364babca4a3891859764daa05

SHA1
5ccc484e5d117a97ffda80e4545e825a3b4b00dc

SHA256
1d6a94a7d0d20a5f27c471cff06196ce32e3bdf673b52b184be535acaa8d63d8

SHA512
d40d47dd0f80323ace919176b7fdd229bade151522e394a5567d2ff6bac43c3a75ac19054aa386c73fe779331acd38641dcc34353a8a9ef8e733ce44a03ba019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0f088aaa5c2e16aa3dbd687b3b6feca

SHA1
ef305ba9a7d37d4bccd8c3917a961a0b686aebf1

SHA256
d0e4a1733601eac82e0770eea0506a9138a5f75336af455f01b37d45670a84bf

SHA512
d01302faf35100faaa661e96a5ae93189abfa4eb31223743cd2673333b28dde6ed12aea22182ec93c2c3324013d0697f5b300c67166ed5dec82d9440b07edd4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab209D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar219E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit