a2904919109d0a46a2b62a24dc85fa034d872a112213dea1eda08ddf00f9a49b

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

179KB
MD5

f224bbcef2f3e6c02b9d3003ed51287f
SHA1

128dc7e7498012f45177776898f878f9e8e59981
SHA256

c1aef5dfdc1c1f721dc5c63f0eff86f288f6ecbcf4f5e05ed9a9f4e79f2af5d4
SHA512

38ec5cebd3ba2d29e38e6481acd81f3b567cc397a26ae02b3d3f513f581c7a8419156e14922e3c23e38667b174f314d58ebea065691cbd48f4ac9dc2a6c7b5b3
SSDEEP

3072:S4YVQ8HKiwg69pSv4TyfkMY+BES09JXAW:S4YVswWUsMYod+Xx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{330F9E11-03A7-11EF-888E-CA4C2FB69A12} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420282082"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
59471b154ce8ff6144e31f4cd8b15810

SHA1
9397cd751f6a9b0d8814ed4129c24d7f23ee4afa

SHA256
d18ba77e62b6277ec56bdf297a6c7aeb27926ec9e196c81a8a86d3486d667a68

SHA512
b1cc91cdc40849185fbd336cf282a10a15ff8a1596b2777468db4f2dc2d3aa9226432c220158f5dcefe4c2d1ac79b1eecfb94fdfad55c759439cf48b0d37015e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc313dbdb51b391a7ce9ebd2fd84fdf2

SHA1
6638ab3e23cf4246e649f9b271308cdb8c1dbc08

SHA256
2d47240a741c03a96495ceee977960e0369e3a243e87c308927667f40d619e1b

SHA512
ed870391cb054b764cbdfc4cc5e62174380781e210c2f431ea4749b8c6c37da281bf87358ca0c757b73875deac7d3954995d43316576eb78f6efb5080659d07f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c316a9484b51953cca146f6f3e2d53b

SHA1
567a3574bcab1aba05b50d653d9d37b33922da75

SHA256
065f3695333b7c438eba39bad19b7f2c7eab31caa482930a962240bacf924399

SHA512
401d28c2a0aa8ccf84c7c8cea10e09dd180055037ffb11b9f1524ac1c6d725ed725cb18b785054f7b21260a98b842b508028ad1f2d2f20f45168e3e55522d368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b26458ebcce7f353db85d6437cfd9cf

SHA1
a25e290dc668063e8962f106fcf2f29daa2af07a

SHA256
495e9ee4a5b3b34a4fe21127f25c94da404e4a13cb96baf9167f4b47f37fff2c

SHA512
e67754b5f7f8da888e71b90d2552175ae5be86d1b279a5be482e2264c3524b861c4ce12c96307a654825a969a33ffb8ce5d1d3cf664018eec1f27fc3ff755f86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
254ddd970a5c8e1578bd74bd31054493

SHA1
168889cd1bffff24e0f71aeef9e1ffbc9bf01319

SHA256
320f3456782c3e14d0aa6055e31bb0de873f8cca143222caf2774de2f2299a93

SHA512
c475fa34b082b7d8cbfe2c9ab46d70175dc948f0e0666e72de751075195e50ceef79a8cd3ebd8d239cb1a12172f9caf655c952e74f5a6ff67a1e5727f3051ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13c9ecee094abcf5c5826ea8e1dc6fd7

SHA1
c76fd8f41a15e83f4890b8721cb7e0d5fa3a88e1

SHA256
74f2fd08ac96652199311b0bfd7bceb7239cea23b7232f7434a6ae32710296d4

SHA512
65190076a87ec8eadc81f35abe1c2ff8abe8ca6ef2aac8b389f35f3eb09a2194bafec666bd0746a242392ec1bbebf47e3bd132dda6a1e90bf59027a33b74f24f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a96d5b383d03bb6d3b65de7c5e2d7f7

SHA1
d3b355ab2c324c589546fce99308ced2bdfa95f4

SHA256
4d21ee898d3e417dd9f534c7e17913264577f54f79a83807107fdd38ba4157df

SHA512
0ba02157ea60f57a0c5e91dbb3942e77db809f855b38658cafdcc35d25dc24400e0ebd7fee82d80d2367037f4ea68adeb8c82d4246a4d62ed58ffe1eacc69fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96771914273467f67d479a0d809651c4

SHA1
5d69155ebbf9541a0bc88c50f18b068eacb65726

SHA256
825eb80c7b889ee8db22febd7e5f8fef74e1a3c7374e0cafaff5171b810e8931

SHA512
0e33710f7e6cbc850b674cb5b1e0326df4d1658d1c22c861535c8830e08bbc81f697528293f6608e36e0e0c08ea61f6f91a64d5e31f9c45872b8b8b2c5ee32c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63cca8e9eb694cda4d2c1d611d39b23b

SHA1
de058c146222e80e408f680e5fc9e2f9be662e07

SHA256
af46d6de0df4d3ae9bc2f8670789ad3be566315f82601b234220c4ba84048410

SHA512
2fdc3b4ff97ced5d7820b2857757ef43e1dc44d760587800cd6a4bb6649c7a1dd40b112d2baec9ee575e88e231ce16c06d0fd391f3b278beeebd5d96e0f07e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd331acf6a01714241d7f2711887c702

SHA1
62e45c9e4f8c74c2ac144f16458c6add62dc0b1f

SHA256
a8ab58f31187a211c5efd9d4b629da232adb7f13b64a41eca6e97443ba8cdbd1

SHA512
65102d65e880b81a797e43ee2e6f7e8976b6008d637b3dea076b02112446a975d2816ea64102edf2b07b81baa42acf55a75518b1e83c5210824687e6bbd21ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d2d3858cb8378d3da6150ad1eb8ec40

SHA1
ae23a806b99dddeb325c3384e43e86bf8adbea1c

SHA256
613003cd36f20bdf7bbcf4170cda778876ba067b357556aab1a4184a36c60bbc

SHA512
deda988c7722f854ac62f546e38b316c10924f95953041cb8391038fd9caef84720bdcf650ba3d4078337a094363e393e9b141830d2077c22cbbd1a04a47bdf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc3f48a5df9b9de1029f6995741b7cdf

SHA1
a71f9bac9f8046e821034752558da72f85ad911b

SHA256
c2c126ec4c496a5232c364d9ca345563942197fb675e3e5cc09e4531e477ca87

SHA512
6bda00c2dec42ea5cb8eca9aca7a43c9303ce57ec26a6118cf75d890a8cf2de95a61e23cb9b518b3cfdaa5d4f20ecbd42a58aa0d87d13b734d9b67a8c98fa0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80ce5c5d49c502dc5b70c2af1fddc0b6

SHA1
0e513452faeb46ab9e3fff86e5ff3647aba48302

SHA256
066d43cfccd67b857503a692efb8ba3eb0fbdeaaf169f192ecba59397b508169

SHA512
fcb3a7361cba08d0fa3e09a88a1c93e212c2b4c95b585f17bb6516380a1542889de4d79a2ee9c834f175b711eb5509aa6b9c46ec61f72bc4074d8b20c699962c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
30948e2ee2d55fd379a4d986bd57640e

SHA1
7a8a76c618a21c2c56e9d3735b975721e329cde7

SHA256
52582f4ce3fc1f258dfefa825656c6c668709beb3e4f4d757a4d9086ff3018fd

SHA512
6f8609b1cfa9a239fa3cad4c6815579975c8747f1c5a5d4cebc5294121eb7969763f2a5249f9b5ce893c0c706f40c26442abbcb655f85a3a5b93c3ebbb8fec67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
075ac8cb18836cd8772a5941b300eb9b

SHA1
2bc9d8e1751917eb64742384ce01b90d7390a4f0

SHA256
0babab27778cc32d65776ebbf2ca5afc32e76dfc414db9012cd1bcfc841747e0

SHA512
8a8240ffa67c52e69a883bd8b2adb48269137e86446320afea04c2cbc58c054ddb8e0c97ab1e46023785db0372331163269cdfe4f3fe7f3de504efa698a92de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1875.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit