48cc5fbca021072cf7be4f476ddf522623aa9abf483623e1722a92f074644324

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

3KB
MD5

cab6057f3fb0bd14fdb154c9636f2acd
SHA1

dee42b01b6c0c8c4244309249bed3dac8a875caf
SHA256

48cc5fbca021072cf7be4f476ddf522623aa9abf483623e1722a92f074644324
SHA512

7363c7604577ab5fffe08d60bcd92852fb9724b8b95a08d8cd910859ec17ee7c57adfb7aa39b54344ca89c830e0edd94776da47d924aa389c48fef5c6c7d814e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572495"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012e241aae4aae0488d747e1775dfe74300000000020000000000106600000001000020000000e2a26fb04ca313b3c9feb6ddd2117830472edc12ca370dc336acf20b0a76de55000000000e8000000002000020000000832a4fd48ced046976d8e0f05295214b1cd7f879dbab6dc643b7941c350dcbdb90000000a627eedbf34b9655f3a74442fffcf0a6a659b6b8e0b0c7953ac219e405e9c3a1f13ae17d9bbc4c9ae4b5a4dac2f2f1c6381ac5d01132d7986da9e8a49492338e3197a9d3a998a59d742cd490bd52f411f211133ef608d97c2dd69c816d20476a694cece51dfa1ed848547ea31d66b265f3e3b2ac4c32c306483e4fe6a77b8b4b7058e9b94e1040b25835e9099742b03a400000008e93b8738748c2d63462d5f7a325c842cfa0219e780af4e3bff9e236d734bdc977e79f4844281354db67b7f06eb3990708ea67f848043482b7dea68bf16567ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB857431-187B-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012e241aae4aae0488d747e1775dfe74300000000020000000000106600000001000020000000a87bd1317e51dcc518aa3d77d1dfa6803dc48312099113c01f4e87a99a374734000000000e8000000002000020000000d29a91f4c82719fbe2fe3548b48efe54f2d8753416dd893a8861c53bf4e5055820000000d99a5760bf43df54b167a3a2666b2022fd9ae141780bea24e7a363a45d1ea03540000000f56334d811d7a28ac8e0762867c2c766c606824df0e2c00ec65cc1f7cc7f388c984c3ca06696ef087104d9f4ac0f7b03529114b34319689b2fdc8b049bc75758	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ba84d088acda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2240	1640	iexplore.exe	28
PID 1640 wrote to memory of 2240	1640	iexplore.exe	28
PID 1640 wrote to memory of 2240	1640	iexplore.exe	28
PID 1640 wrote to memory of 2240	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
880eade1aa59dae760a328504b6bb6c9

SHA1
6b83f388073dfc0b4eecb79bc0e0456c69ab8af3

SHA256
b1abbbe218ea024a2c0fa5e7ebcd7a6c2d61b96c2c5f4dbc714a223a8768c6e8

SHA512
694a8317913d07e2966b7a45484f21303fcc830c0a146d2c483cbceb7a4874ea1d8122f92b854243b3bd1f41dc85089446d7d536fceaf56b5e7c920077846f33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05c8feb8321c63e6dce660b1b4da4dd2

SHA1
758cdb287c937c3ffbf71f8ea7e28c90ef893278

SHA256
4ba80cc13f74e36eca6344f2114e59740d54e5e823a8aa585d510ec50126c60f

SHA512
5550e27e8bcc1c535711218e9efe874b1a995594c2ffc219ac2ae0d95198708754576b23dc7aaedef2f4eea6afcbfe9fec004bae78e163e686d2b1f4d89849b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af17db6a773a2fdc70bd74915cb267dc

SHA1
b07d5ce4ffd1d4ae3d1d73bb60dd9d8c7a436314

SHA256
f191cccc09822bd53908ec0b62dba00a77edf4ee15a6abc6301e5d932e57a72c

SHA512
f4bad8b43bbadcf2da6ed3e919cb427d49b40296d0e6dd48cbfc9128a566544ec05a66967c911ec6ff5d079e86aba63549a7c0dd2f688298b34fbb12ee251c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f87a2920e681000991f6a0ba400c93f

SHA1
d6ab806ca060f737f04bdb7380bb524f1e412587

SHA256
d097e3a9d51f924cc8d1aafa381470f8d48b2c07ff852b1584679049a4d0fb9e

SHA512
234d248786d25bd95161a7c6cf891aff50350f3dba3e2bb8c52fb935eae8f696b1f3744cf1a9e52fc1c27d67293780be4aecaa93e6e712b6fec661c25ceb037d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfff626a1e8fc84d02a199f390c5d472

SHA1
2f81dee8e6f046d187ea97b66e9ec5bef3ed01d1

SHA256
0dc3ad82bf0f939420941a84c28260d7f5fe04d61923d6c2a189cb4e82ebf5b9

SHA512
f18dd669104b877205b9ad7d52860ffb23f4251778c3f29124c9243b29b13a10e4f03b89cdabc9f138674af4e5c24a14bb49b21ff0163dc3b24b975b73f84077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b7060698e02835baeef1a1e51eee5a7

SHA1
2b56bbf2e35ef1aadbbb05aded32da10037f54f5

SHA256
010afd7a3697ea7143471c4d7b74981785bc1ed04b910f8284bb0070815ee0ce

SHA512
a78593672c88e389b2f6ea6785e47b2a121b18eccea98f03fb2d3eb608317bee6bfe26a59265813e8bb97e0111eae29826eef087fd81dde6b1723486122cb847

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA5E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit