6e221f752f623d492d4aeb66718b4eb1e3a6408ab6f7bcd71e4e882a6d487744

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-04-2024 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

15KB
MD5

177462f66e7efa0f38ba4353b6e179b6
SHA1

d59f5f45461b28e77e84c44f5828d035bf8f4286
SHA256

6e221f752f623d492d4aeb66718b4eb1e3a6408ab6f7bcd71e4e882a6d487744
SHA512

39b22f691bc7be3db4b3ac0a55506ad4029e242f5951881ed2ab95177963f927c77f717df70cb248879a3c76f538d50b98f7d72dab7b4aeebafa7e95c6536c40
SSDEEP

192:PNx5Ssv99qXoqTJkNr423ZPiipmAWyuxqSa0KfkYIBIwKflWTsCyEXN:5Ssl9qYoJkN0Jipmzy660KMYjtogEN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A6FF331-F8B5-11EE-BD3E-4EA2EAC189B7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04fe9dec18cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000332a844ce211c2429442cb6af75bf81e0000000002000000000010660000000100002000000064a9c6c0669695d93b5cd39534e54f82b30e77c799609f406047fd72b394ba16000000000e800000000200002000000052bda40443fa3b43771c52dca269f592c34848073d39d39b916742d1922e169120000000f96b48b939fb9badd591e26c5218eded1d163aa3532f814bbd3bc5a5a651f88040000000c46a13d4c7370cab5876cbc5e49b04dc61597257b9b64ae0d0be004aec1d4ad39f23ec0779808a276530cffcaae905fd6f33b91515f2a08d6b34b27e3faa60a9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000332a844ce211c2429442cb6af75bf81e00000000020000000000106600000001000020000000d93bb4c3f2b7988c89bc4b1504a0918341b2a968947d9a12546f6ccfffbe1123000000000e8000000002000020000000f46599a998d626912cbebe039f920dcd17f6d36dd3e10f66a9375e8b1e7a7a4290000000880e6d4b7881ba0f2921f1623def8b76dc8b75bb233cf3a514338e051b20342ae6101d4abf669b5cc865c1b63fa2953f775de580e3dfb7516f03245fd965cce393e06016268a09b308e0bb42b366d412dc91fcddfcd313a76afe76b969e7b363bb352c7462a6500e04f070f71b0de911b8be56295126f0718c7b33e23f7a14925262b477caeb09c45d6689b1b815ca7f40000000e7fea74b9f8f55fe2918b1a44260cd74a53f82f1fbc3e65746a5b9b2ff9eb437d61ef38bc5724ad5bbaa2a45a8a483eb5bcb59aa84f16919bb5916c81830f0d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2996 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2996 iexplore.exe
2996 iexplore.exe
2552 IEXPLORE.EXE
2552 IEXPLORE.EXE

pid	process
2996	iexplore.exe

pid	process
2996	iexplore.exe
2996	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2996 wrote to memory of 2552	2996	iexplore.exe	IEXPLORE.EXE
PID 2996 wrote to memory of 2552	2996	iexplore.exe	IEXPLORE.EXE
PID 2996 wrote to memory of 2552	2996	iexplore.exe	IEXPLORE.EXE
PID 2996 wrote to memory of 2552	2996	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
cee08e8d3bf351e9028d6ae2b8768342

SHA1
eab80eefea84b0daa5e837a7bf4f6e1394ef9baa

SHA256
e92044ed4497c3ddca43c09ee1e02a4ce41d2062d993a8a389a6a1a16c9b92c3

SHA512
1520f91e212973488f57f86bf10d4f0cbe7d28c1084b17a4277088f382d30cf35abbf36e7a83d66bd29cc6085b1af3fd28a1e748fcf80ad55a916ffa8990fbcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
96946bc3a49873e491aeeb89df716052

SHA1
8cac501d282fbbf78cca4051b8570e9aea716b0a

SHA256
987bd6f1c92f36778da0a4ffb435c4b00cceaf134c515af37e7a762eb9aeda36

SHA512
273fb8b5e5fc2d89c8ed440020835b37b6194b71ecf4c1a409bea02b9d28bd8172350b1ab1a49d873b11c29fa7ff5e8acf270cf682cfa582f7b630486b7a65db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8deb91f3a2ebf851aaa7e3156beb57e6

SHA1
a645d4b8031190b5f2d31e2bedd3870ff1df8cc5

SHA256
70436a2c7c5cf4aef44dbfb4971e6c0540a96255bfe1526dddc3b9f396e3756c

SHA512
fd2ffe135a7d4005c835714e2853ccda92e108f042cf95971b47f2e7405b5c3e4e1455bf3914abb79fbeee1995a9f1bab7017fe3472dbed919ba1cad2dac0dcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d73bf228d4b8cbab2f8c3e4b1012d78f

SHA1
b418a269dd217630370fd9c1b8211a85f9405d06

SHA256
f2d243c3e8b13c8c82d07aadc3ef3e6ec8a20e442a836de6ffdb6db5401d9e5e

SHA512
19f0fbaf2d9cec28f1f504d9fb56431879191a22184bee56e5bb141a53bd4593a4bf065c33ab7a4d2fd55d9dc1400181c1fd6631f188fd3560afc1f792cd32ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d6bb6656593fc5036dd4349bd90df0f3

SHA1
e7809a826e8cb8444c6fdcc12b66afc1d3e24763

SHA256
afb8d839ace3d35240b8383659344fee99ec3cdec333ea014cde085c4608033e

SHA512
43d3b9a73bdc925bfdbe12b6090547ea606bfd98d33f331ba3587c33ee5e78fa34e4ec72e286b4de22d2f2d751bc2e8dae0785df0ccfa5f26eb1dbba0093646a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
11f5d457e18b3df08456b05e2ef72976

SHA1
054f1315682a32390b8677a63fdf2cc2bdbc28a9

SHA256
2a2ae03aceb294a5ac6add4acae39f3c54062f78bd9250bce6d3caeabdc9541f

SHA512
201f4893e713a7af6ebadbf562fd5a4820a8480bdec5daf5bda5daa3a866824504c5a81b22037404465a6729a5a36772e5065b6bd9e31c1aa0be5ee0a1753082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
194a6baa517584773b60d69aa09c443f

SHA1
c4dd414f96d2e353cfbb4dab7507822507182b01

SHA256
23f6d3e74173227992aed994875cb8d42821645c416aec4ad6c027a8701c0514

SHA512
3829591467210253f8e79dceb618f7aa0c95555eb9142f0ec24b501cf2ffc441cf839318d4ab105cc6e7057b9ab7de1cce625d127c6468a6f91debd348944d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
93e6bb96282fdbb4b43fa75c4a090707

SHA1
84eaa5a463a9f5bee436767995f25234325dbc65

SHA256
f0d73815638d7277da7b3f62e5d40797937d40b91b35a941ea747552fcfaedae

SHA512
a20d56fe65c1fec457cce925865e7009002ff6bff1c3cf5a67a3ccb978bffb5c4f575e082127724fc96d7f2e2629aa6116f91b27b8fb67706cd20319405dd35c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c96094c42b9fb9271a20516d745720c9

SHA1
203ed7871a55ddcd7415d31ca46b6d24640fc273

SHA256
222bbf9e897da51147d2bdce7fc36cb2ab3dcc1f447299301b05f45edc520479

SHA512
0ca6b2cba427dbd0f00c8a983a7f69d72a72a9132924c91140b94cc792ea393a032594bb2c11e9529b39b19f049af616e0d0e0afb90cd8de9d1b7818dbfd6bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dcd8ba78af1ef940ca9b72f579e88b88

SHA1
7e3c56cb043682001f1069528c31308bd1caa60d

SHA256
54d15e86b7e6b401d256b06a24e486c6449095c249f52de35e9feffb5a858daa

SHA512
5c2cec5140feae1c758a4242fc083978309d0527c3e1f2295105d535877e27f147727be99f1890a522c154d57d102f1fe2d06ded9d32748c65f18fcae3a1cfaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
b967b225df20e29c43308262cfb54169

SHA1
68266f13b5101e96d74bbda943576570f1931f83

SHA256
06f7783d341f62fc283e9cf386729426a7529a7f63141f84a96c37e3b4d60c73

SHA512
3421539238affb9e6d417ba05cfff3a7ede468b1417c3dcd759e6f8793a7006440609d6280249aceef5b27ecb7aa2bda7726b85c69eb9ab5301678f5496b6cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B00.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit