2910fc13fd3da3aa87f1320519b9ed7184c026fa5213c9a0d95c5578d577ee28

Resubmissions

10/07/2024, 05:27

240710-f5fcns1drd 1

10/07/2024, 05:21

240710-f1y9zsyenl 6

10/07/2024, 05:14

240710-fxefea1alc 7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

19KB
MD5

0811df58bccad6d4a6dd029c85c8fdca
SHA1

de6c8ed386cb0661fff00bed66f790a51ef2274e
SHA256

2910fc13fd3da3aa87f1320519b9ed7184c026fa5213c9a0d95c5578d577ee28
SHA512

2ee686f247ed20a38cfeb941598028cc9d5956c674c9f9619e30acef3b4a25a5f77d0ded36e9f69779e21534c45492dcf64ee969cadff805a809a1ec3c935920
SSDEEP

384:yJc1spY1ocy4w4lbGaTsvhpNYTW9Mkp1S2m0Y3Y06Ib3afl1xCejiw:/B1ocy4fEaQJpN2Wykp3Y3Y06O3ADxPF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ef2b69fd41a3822a165471b9d79812a17f8cd9bd97160e58b376fce49a2dd7d1000000000e8000000002000020000000d450409d59604a936dcc8838873e9cf5e1f4b4a5475b070bff9d4ce2d2eaece52000000062de370c43b9149bbd10bb29c48e659394ce4ac84709afe94ab94460e96e06fa40000000ba815f2bfb6439e34cd7066f77aadc5baf552e9092573ac09f2d57b088fb317f0a80f0384d9f6a95f2dae88f753ae8f9dfcfabb75588df04ed871195e5a04ba2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1150AA61-3E7D-11EF-B8B4-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b2cae589d2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ec83a074d316b3cd53181d9181496d9c5ee8a38aadb31fd96b3c810d1aa156a0000000000e80000000020000200000006f40ca8b93f4d73cc40e93b33fa2dfa46c9e077f5be95c9384eaae1073852801900000004234348f803a54fe18b489ddfded1287a9628f5f41ac96761975a0d5ddfc0b2a85aafc70fe242ceb3577ce59fb5bef0fca40af002b014259ba07770559260a9e06cb20bfbd4d8e1ef846129f7c9d4b5fe640e70888dd313427da11119b931ba24d161083e11ea54a4b60ac26a7000dd3738f5fdc65891685af359888ca87e0687d57508feefc070a05e4e16023d5415f40000000a5269750576ec29c6080efbbcd032d6c9bd0e619df99280346279b3ecddeda96590665fdb5e64d3ad65df047faf68e2cb8a525f07ab88fce5b78e30a55b9ecbf	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2628	2972	iexplore.exe	29
PID 2972 wrote to memory of 2628	2972	iexplore.exe	29
PID 2972 wrote to memory of 2628	2972	iexplore.exe	29
PID 2972 wrote to memory of 2628	2972	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9787b15d69c926d69c31477e429246a

SHA1
06c1ff57899ab32bb24a16a9d447068746cd75e2

SHA256
abeb86beec4346830b1f52cbf736025bbf5d30eddc32380c5c959097a4e99c04

SHA512
873cd19d56d3070f24ed5bf352e363e37fb29f0d46133891ca9f754fcfb00eba781cac6d44526877c778d755bca0753de7ea9adfb987b02e615be62788e1ddef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8254c26ee7cf10b3417dd0ef027f145c

SHA1
85a7fa6ffb1e6494417b7a4c39e76bc69898b9c2

SHA256
094d08af1e0a0f3abf3061a97a9444800514114d43913ca65856ac06d3a6ff5c

SHA512
24bd7b7ee3f811009a50c35ad209b89dad2b088d6d5fc9aa670cd13dd744705797c4fed15a0572336441d8377679533fbdcf981b47228410a85465842b675eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89f5c1f4247a9ecc5637b6da74e6f34d

SHA1
720ad75c1e8a12a4c2f1cfc82faada7e80c15c76

SHA256
37bb4a7b3be842def22716495a58a54167be5583163b60a4964e8dad80a3e8b0

SHA512
333e4ceefa391585388fb2681ad78da168e207c85d3484e288d0232c926712c83d9fcf24e49d568de41f83b7c0fc95fd68ed887677c3391447cb57aadca3e387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35156820a13126a1d4b79e25ee63c1b2

SHA1
75b55a1766c040053836714413dc14ae941835cb

SHA256
8112144c4d2fe736a9d1b43a77e62e4f6fb456790c8f707fd38132a6b5757db1

SHA512
1804e1f2affb4bd70e358c3bddcfb211449e644637a1d9f5fc397f885a43073c18c04421c7a7ec8f02d2d3476d6789ad6a35fa1f89849679989774aa6e4a6cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9b2296198815249bbad79385f0bf24d

SHA1
48b3835c65a3f7b18d9c2de000a2b22f6d95e179

SHA256
431f1cfa6a3d4b87d1f54dbf1a4b2399bd762eabfb3dee92aec79b2b3088d2f0

SHA512
1d34b7a5eb2276afdd1bc86c5bb7ecc282443413f3f774f6cde6d2179ec642ef87ad2fd34ba6866a0bc6c40d23b54a1fec248566cfcfb878aa15e3c175b43eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
355bf593617f403f898a2653487d89e6

SHA1
52bcf1eb4982336ee35416ccd41d64b34cfa42be

SHA256
09cb199d6362c94ee5dc04be59b1cc0323401a43d7a356cafc6c71608f39a322

SHA512
a24903bea282cabcda082012ebe2b2b74bb66a86bc09ffc2e6d6c5fd9c3159c092563cd851f2074b97fc27698208499a988007a524b2755555100cf013074eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53c5d6fcb6488b2bc0f3609bb4553a8c

SHA1
668a12b941ffb22f3e0078c445e11fa34eef2215

SHA256
e5fc5ba7c0aba4315fd1dec48fcde78b4eae150c9ff2fb3858c865207a45463a

SHA512
4868ff075d3b82da144d2ec75faafcedbebb4a0e755f82a98d349745492ede729f285f0760c3c0540083fec9f789fa870675fb6ec7889080e880c5fba35f53c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1208963cc6bf91b336cfeecdc8a0ede5

SHA1
7cd74a0b1020581448af7a255d928c0b992551ff

SHA256
6ac9df520650e1a27fdf4218a17843c64756af8ed70d72bbae803f1ad96d0941

SHA512
46c5b634e4d610dda502dfdc2bcffa208ffb0bde507eec4fe548a9ed71e2516e1d9fc18caa9c82e67d9cb3366c46f55e748d37c9435cdf610bdd75eae3cbeeeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c4dad1ab5d44849836be9c3fa81c72

SHA1
6c28633f2b4c8bbccf72ec8903519eb7c429cabe

SHA256
b0ff0882fb1dae1351ccd680a41073c1b24b7c93ab65977f2118f1db44c64299

SHA512
cfa1739bc8272b0971dde96a90cb14a3aaafa00af7033772f31b9639274a1e1372b68902a74ce9ab0d90b76490f030a5ecbe6b19afeddde5c81c9e62780a5854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93762d6faf80f9c9869f0a507f06eb9f

SHA1
c312825ea31d8b1b104410222005ebce8ad31972

SHA256
63ee36ee0c7fac5a915e8b83c7a86044977c3cf0c248b99e648a577c9e5bfc19

SHA512
0a6e02eea377b6c19ed98c8bc192a678e886b4f016292093eeefaf581377343b43820689dde1a1543ab98db0a495b86d7b350540401173046971d914ce3e4401

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2272.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22D2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit