46a3169f4db01c2261e4afefa2e45223a140ebf11cc0e1899b865e98671d81e9

Resubmissions

24/06/2024, 16:32

240624-t2ajxasamc 1

24/06/2024, 16:18

240624-tr6vcsvbpn 1

Analysis

max time kernel
34s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

21KB
MD5

ac275620b98d1c030dfb6acac781d136
SHA1

b3695a3a026eac1ea1b614e9df8fa9b461c2f09b
SHA256

46a3169f4db01c2261e4afefa2e45223a140ebf11cc0e1899b865e98671d81e9
SHA512

92bc5118027426097cb7e99aad8d6414a3b41f4e87d9fddb7d1db1631194ea422b692ad8a4f81e283165df66b6916ea3f46b087b148b97770347d45b095ccbb6
SSDEEP

384:xLIrT5sPm86VzRYABxm4ej61G0aQHtQamHTB/VvRyEoe:xLm799Bxm43nHtQ/zB/Vvie

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62CA90A1-3247-11EF-A585-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005762e7854456fae8b7fd8017d33fc10bb833ad728827bb6d83be32d39a3d6efa000000000e8000000002000020000000ef9e8c4680f6d8486157bfe112d7d41c0f11b69444bdc208f771678a23086a9820000000a2876e4bfaa52d045af05db83bb23d430ad42714baa2d4db3aac434da5edaf3a40000000bdf0b37d095256f2cb85c20dc67d16fe3bbfebdb618e745bb3a0c789078ff608b70d86fceebd3aa8ae72ff0c070b1dcc3e6bde5c6523bf712cb978d6a641c6f8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000099dffaa5a0b78646cfcf636bc58ff308b0c9fd1ac10fb7fce964cc57f35a4be6000000000e8000000002000020000000c2aa8a2b6f816db42a7e15af299fef188d09a1d76ec743d904d05d0a6452171e90000000295aa9910d4b3768b791839b14e282262a8fa55cfc642c5c9c188532c6c56d11c40099c13ee961e2966aba1ed5e82f1a9a7a7d8277ea904b4e6f1e68465545977667032d734f12567de769ff8903a87bb3db9cb3c4ed9c98b3b2bf56c6b791f6ff8e9a8482e3b8d50155588ed4f8e09efdacc91a93fe479a78dcdeeab13954f5cbc52b3c254fd15e89cbb3acbb7d452d40000000920be689254856a11d4ddfc7b505ddfe9681a490b8186f821b9822c909ad0534e5c1448a90601761cd000bb766acca302b730b8476adb6f638a49675dd3ec718	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02c5a3754c6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2604	2392	iexplore.exe	28
PID 2392 wrote to memory of 2604	2392	iexplore.exe	28
PID 2392 wrote to memory of 2604	2392	iexplore.exe	28
PID 2392 wrote to memory of 2604	2392	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46cde836ed87060a05b22fafdd0cb460

SHA1
c8cd910877f10bddbfb79ac8b6c282d4c91fde6b

SHA256
9e76e67adb24cc0c2cec494a65c84381870a9849fe9af4f385e4e2e46daaba7f

SHA512
443f2433cc78209fa97d024631ec3eb8bdb94afc47031029a6aceaa2eafd6181c7c81360fb5e64336c2b1a4e7b002e7194b053b8b4760490bf13b1d0088a4d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3847263c06fb8494a1b8fa4f853db19c

SHA1
eff9e68fb0a34d764431fcd95ef287a81d8f6425

SHA256
ebc7a75fdc61e8e9b25708aa14f880257f506106bf66fd905c1942d2253db915

SHA512
556f690e6e50d76c9f59f5d2c92318ca897767e4b1d36caf7b8d229a06f5415f276c490a08f01f7725afd86beb625ac08cf3a06d942d4aa8924df0563f0c7881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9aaf86b28ecbf8dcd5663faaecd2daf

SHA1
cc0c28f2cabf269be8a6b67e5c724266de9ab4dd

SHA256
34872a736a6b12f79a000f8c80a83c38cabee3fd1b13818233b35a6faf60899d

SHA512
805b874a39b2dafcc2f61dffe49bef69a47afe23842ee851be628c3bfcd80fe69dc2ae4226526f1f2859b9aa33d0bc74aaf5825ade31829feaa0d1cb6b7c05de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e221d47a3b2515321f416759e0ed77d

SHA1
97d64a44debdbbc150a2f2738f55885736dc846e

SHA256
b1e4eb77bdc3e974abb61a0d1b05f36c1efb3ab0974d6c643d2ea5a791d50af1

SHA512
ff6ed991644af840819eade4a2170ccd1b996bcc42c9cdb740e159047c83e5651683f8836aef0a6aeb1fb446748277ea435f89aa8892975773800663f582554d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
396cc25ad0e69118944153a6be1a1b78

SHA1
94076fff9a62fa011838ae2aef919a1c0f500a88

SHA256
980abc0d16eaeda910193f3cfa51e91a956b363ecffadf31fc5d23b98c709119

SHA512
9ec525e0b39afcdb2ab0b0ed29f6f6387393316e31d60d18a36a49a7af25ff204076d53e089f6290420a52c02fa22b819655eda978821b1e80f0b8a83a33e8d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b89d1abb4e34d79cdc67dfe2fa1d8c3

SHA1
9c9b35cea4ebc1c8721935dda51222afbbf553be

SHA256
ba3452144c68b4f1d6edf092062b75b27ea7722cd54b8c74e46673df1204667c

SHA512
9f535022245bc245863f0c2ae68d0e6c24a9698b5ad0c84171bd7a6988a18359b1e6e627074541375efdbee70efdc0a0cd5c557d08e0953ee0d3aebb365410b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62cfe9c6ef119d2c5f5ffaaaf17dfe06

SHA1
8d1c276d6ea49701a3ef805cba42c73f8b5df422

SHA256
444e136b29c0b5a18e3e87335b80e7457a93e9f6ea1fcb243b28b7bd3a4224de

SHA512
70a768d67a2f578b2c632e04d5fc3fcaec22679eb6d1554c87f3ead34df8a4100e47378a7c332f611e0b4255fa086bacddd78dbc220ea98a6caa330fbadeeabd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f21eff50ce707870dcfe7339b6b241a6

SHA1
4ded817da3754dd6eabd94603feccc11aa6e7aba

SHA256
e6c1fbd3b32a49cdfe288f5d176c43e685e75496333f857143b66434bdd9697c

SHA512
f72b6bc1d95451e643f774b44e62766e172e61e7c824b7bbb66355fbc0423f40d720f85f3d8ae48fbe1f0f142f7b6d54dc02d32dcd00ca7b68e2f07fee2ee2cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcb1fb17ccc315b8f90a31b6b5afe8a9

SHA1
fcf8c17b4b207904ea91881be812eb8b447ecae3

SHA256
d49202bfd3eae711a90bfa4dd84d40886469a554efeee78e511d21356da43281

SHA512
59752e8a81d05d0405ec4d0a20ab8a3777923a4abb954669ad7a85fbfea2539adcbdf75479327488d90f74433b2b09b876760547b5863af21c7ac8edfe310267

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2685.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2725.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar273A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit