b6c1a86d45d6f3c4ad75146d64e8d650de0449f2cb3ab280d62ecce86f07aff3

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

19KB
MD5

20f94e0fec19560a3addbd00d6e74d47
SHA1

0e6216c71cfbdefb6f3c9980583cabcfc7df0619
SHA256

b6c1a86d45d6f3c4ad75146d64e8d650de0449f2cb3ab280d62ecce86f07aff3
SHA512

3e6f52b3c379335c41c15ae92ecbf809edf75640976457e075412db6d1b9802256fc6b1032bf7ef5862ca9cb798712f5d833c3b2abccc7c625b6fc2875c48ccd
SSDEEP

384:rY8DpmReVoOs4Xi9ylKeGMpU8HhhbVck7aJo2paWhOwob0Vnp2IJCgMmVn:rTBVoOs4XmyI1M9Bhb2yaIWhOwob0Vpt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04E02681-1163-11EF-9591-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009b80715952cd56a7e3a36046ae75e327945537f6907a3650aa7e4bc7f5f20b35000000000e8000000002000020000000db2cba85ddfbdcc30c095d2acdf942ead673319c6894960ba6b5ee6a497551d9200000008e29b9895d27245e43b242cc8841205e599f63d7004d9a6f00ccdfed332bc729400000007c9c0493009482027e01248363a4945cd53ee69b8540028c02d0288945d0ea56bdc6c1ab63db59c0ac8d9e7edc8e4cbcb3a57af2e20c464dd330a0957368017f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03d6fd96fa5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000067e143877934427537ed7185bdda53f6cab9a2c4947173a48992d3b0ec01daf7000000000e8000000002000020000000b3805d0b9e7fbb1e275a5befb8acababde838bfcc97cab629368995ddc165c229000000036f9d10e3f49f568e07ca23fed21d83ab57eccb5017e661b310283d7608e4ae46d67902bf99988bcc00d9d111faca4d8ad494ef91ac76af0a8e0b798c7d52589575ac1ce84af6cc19b95bbf582aff604b310a39a21b09fdc27733c25209eff95afd8d86aa3bd51f0abe47079eb39760adee2c7a6f9362b33359d6d9b757c4879f16e18c2a7daf85a13258fb852e22f83400000002222cafe0c3d2217d9b748d0f718d1133a79d8ceb10f62b511cd2be6888b671e385375f6d900720b420bf38b498383e21dd276f3df68778ba368fbd1d8dcc3b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2560	2084	iexplore.exe	28
PID 2084 wrote to memory of 2560	2084	iexplore.exe	28
PID 2084 wrote to memory of 2560	2084	iexplore.exe	28
PID 2084 wrote to memory of 2560	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aed7a99d4b9493779ef944e2027aad8

SHA1
c2ad069b551ebbb8bba17dd598d4c3736857e708

SHA256
5b893ee56250bd234d622d2e3cf483df2c293925767c13a902029fea7edd5512

SHA512
26e5a88639b9dcc357e06cd418d61e8ce099efe01f61a340224cf851dffcd9aa892b06767b09a6a38427742fb4e577b5bc99cdfe86c5e0c475a06d6499f72d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb1dd41d84763f8da216a8f703c14a6

SHA1
d9006cdcbe738400e34e5a5348c76ec2da93301b

SHA256
960b3c752c21442e93ccc0ab8e4a5ab89268294fe03229b5ae987563a53634fe

SHA512
0fd84420f4fc37eadc2ac0690a2220a6c11039017cc5deedac0465002e79c88dc2c6efea8ead1cacc484b3936e10f9a9c3b366c7b0036730ac167e057bac7cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39fce15b2c3696863b9de18f85145ce3

SHA1
ba92c8be33d72a757cbc521f3d6f77a009d3562e

SHA256
1df250e633e29c8f25e3d3cff707e32b785fe5849585b734071901321359fb67

SHA512
ed2bdd7c2fb10b9531999f5bf0dcaa44822e9e32021c4be286e8657dc97bc03bb13be6b48f256c0c5275d9b600fe2bbae2a660bc8404e66fc193f2d3bf130aa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a67ef4ad25dbdd0e30e38c993e3d46

SHA1
70ea5556d53b1a76e9a3649e2ddc4188d5926de7

SHA256
40bf9dacf67122a3e0220205b7ab6090a3406d92839b8bdea0c7fa6dbd4f5fec

SHA512
67cce902fcf01f6df30e1ce0061735d69b929d5dd35857436aef15f38708e2a602f80d8de2996b8423d8651055473626f09b42d2b0e3adeb186468920fdbfb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a90cb40f1730e90ed9fd543abb512f99

SHA1
3dbe8b80b7699a64107a78a54d5ef49aca290dd1

SHA256
196503de063eaa9b93886550023640ae2bec47615ed05e7cf4dc98f71ed06eab

SHA512
7dc6d473b1e9bfb556b99c2819ad939a022b6973ed9e003c70c6cfe136afccfd06e01318dca2f5771259694f0070b24529b5490499b5d0c0ef03baf22ac8cea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343c5e03925318601972a04432b0d9b0

SHA1
5d8637cf11506d7cd04163ce84e11be747d3d9c8

SHA256
d403fb776b61ad20545dfe472556cefb8b74229bea94bc451cdd7d341224ed7e

SHA512
c0a27e7f8d10c841e8817bc119f0aa43f9eafde1c415a5aa9025eb5f78df68fdbb2b680f35c8d8f5499751995439b04ad778f0cb984d6749999df59563a4eeae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b825e9baa7abf7c4b1086699412e1c8

SHA1
9a555265daf295735ebea895b451ea7b5ae199f0

SHA256
1e09ce1108858910a219a906afaf31466bcfaacd4af1220dfe691ae25769556f

SHA512
8b2bb548c020bd3dfc88494cd5274b635f0800649c594be1f5c19964e0e69d69347b1582b3f1c1ab2511d11216e03e6a0a95d420b5b4355648a74004a9368d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A7D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B4A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B5E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit