25a06278e0d6c378fa99d5ea4a6cf133163af9a6d7de18252b6e91c4a43b50de

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

84dd857e50f41a8f9e17e9c6586cebf3
SHA1

22b36b0af81f4c815dbc930f0ddf2cb50d959d22
SHA256

0c8538dbd7d1629e8a7306b524b37955651f8f2db57ae64512d6af0a5cce0e59
SHA512

ed319c63e28ba9444f0813210f666dfb937916cd8e3d6702b6984d348ce118a2da5ae4b71de65c37a7317bea5ad729993ad4c40709dae55e35b34f2c1da7bdb4
SSDEEP

3072:SntMrNwK3VAOl2yfkMY+BES09JXAnyrZalI+YQ:SnthKvZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420374370"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{143356D1-047E-11EF-8178-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2688f5dcda06dea17e06a59292ff6d7

SHA1
9b713dbacd6b13f2e84f1838693aeade8752ca1a

SHA256
12adc52cac137557352a147a8da5f6e7cf0e9aa4af0e357ac8c5dd91fdf4108a

SHA512
b907405e5ab60dd0fd0330483f230b59816cc3c3611deb3db1dadf4cbc1f72036b20829d4bec0eb2a36655f5ec86f7528b96a20d82019f35901e5720b3ac374f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ff617e772c1cf9fbf6a470b0a33e63

SHA1
ff31b89c82111ebe1c45996f1cc2818c532c72c5

SHA256
02979992e911f9c8613e1d5cbf01dbf7d7c7d47d778a307cf95c406c295e7f45

SHA512
844352dfbc4519263927b4aad95c5485061f33a2d108827a5a97ac12162143621fe65da7875f4fe2ec7595d9e25b2abb9002bdcedaef63ba86055e4bb2381977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b573f93735a00aacda847d2a958c793

SHA1
f0a43b8159c2849a049fe1248e28d183c5d12c2e

SHA256
538d29badb51cc1f9a3e9aaaf459aa67d4c21e18e9261cf47d782bca8fb6cc05

SHA512
3d932c6ac34ca11c10ea603fd2fce17fb3c527bc50b9eae3768255ff5ba6fb12d40ecd52a7c9959abc847191cea5be752abfd8af939557a51791df029315b18b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bf43e0de9b12399aac851216428d9dd

SHA1
12eb1d9af91240a2e039e4b71b358b893ab177f4

SHA256
afc5df386f964e79625b50e067b657daa520d6f87029c68301f89d11b29246d9

SHA512
cb5b9b7641e0fb1b0f1f11dcc2a9c7c7fbb24570f597f3080d981070bf67d0ef269f25a9a9da0bc244ae00d10d2e1ed7b47918ba3ef746a2fcd5f7b6c09da844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9370603374cdb27762b9ecc57cf40a4

SHA1
2a90bd3f5ce834df96be7af4855d6579fd50f8a6

SHA256
e30c05f3c89c22d0e8c0e332354ed94d978ec55667161e1329dbd9466416dbdc

SHA512
bfef711d3909cc8660c283474d4f90e5c6a5a1bd0b232d1095c4a661c29be99babce39cb14b995e58813e1256b78e3efd9dbb746478ab69647be056ffaaaced2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2065580ba4514a9a5004d0db0a1334e

SHA1
6c54187016adeeb53d0373c9f3e9ff1e76844b54

SHA256
241d1830548dd94055b9ef47e6453c03680070b6b25803fa3a2ff4498273b675

SHA512
509a4c54cbdca80edb13d2ae8dde167c5218281d8ddfbbb7f93a3d29953b657be476d01c9ed6d6c0b467f4af20df38c45e09f52c31d69cb89599f247af024efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c716b2b1fe25979276c59ba91e01bacd

SHA1
77ee307a58f51eb3330399009a1f97bf2e105cda

SHA256
46ed37c42af6d0addeec96a3bc2c9a223e73aaf4182cd4e8523acafe26d76810

SHA512
d671b1e0d25b418ca1eb886693648b9dc3841e341650495166db14ae08dcc77bf4ecfc720da5ec3b5419398ad69507792bc71e8a14020810ccd7ea32b4e96a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
013fbc631f8a6e213e873f297d454b94

SHA1
c314cba72688a0e019be47a46016254b8943a82e

SHA256
9f8a148e512440fba066e8ac024f7311a43e3f366d36ab92442a8441e10e80f2

SHA512
4a301dcf25808700907b1472a103be380dfb5c2d22f45e7df0f17500bbacef95e58e1a94b59f1be19fdec485591703d33778fef808ed5fd442a6c69aa8f837ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f60bd38fd89de625943fd4439c23efd

SHA1
5f73b13c5b16b71d2dcf479d47ef640b4903a94c

SHA256
fdf01410dd8f48c3a6d9861ba3c813097baf50dd9f4cb607dc9cd49723224046

SHA512
bfcdff1d80155ee7aab02f7e76dee96a6b2038b88225f4691d910956b1ac154ff5432a01d7d158b0c7e1f91bc563f4055ccc5a57d59f9c0940923012a6950a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c10ec200da86b4f78aaac3aabfebbd6

SHA1
5e1d838c0fe66339f6c30213999cd21a69e11ac0

SHA256
3ee0c4b220089ffe792b424569e4e2b99ac4caaaffe145e1d4c792c8710dfabd

SHA512
c00f01394d134ca9596cbf016f14ea9f9b698c07c27dbf9dd695a59ca1f688ef8fb774b7577dbab2a9d3c16314b1a8a32465093b349376c7c3eab845d20681f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74a85ba4aa03b8231d7e909494855ca0

SHA1
6445c3eab90fa18beefdfb5d99696dce34e5362b

SHA256
0d8fe63430bb50bb36402b3d6adf8e8737560a8fcdc558c64784bc043d6781d3

SHA512
71add771466aab7e9868d016141ba28d064099bd5a4af82406305c84b2b5233c37ed617dfda86660c9f11acfbcf826a532a0a11552505062c5e997fabf625c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c55d7066acb82ca04e7bd97c5210b4c

SHA1
52936a4798b3f87ab433e0f110a9253a4437ab65

SHA256
03a2e38e9da7f0a7e5a05e2085d219764f9db6dcadf525fbaae6f4ab54c43bcf

SHA512
cfc786fd9452cfd383935ffef93abe32a3e62d777168280da2f69ba6dc4ebe91e2a679896408468d53664542153ec1f61878f9d810192bb3b9ff2eefd0f23334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3f89e6e57a345e6503a81760948a41

SHA1
25e2d31a323806a9ae5a723e40092d6ecb3c52e7

SHA256
0a998af439ea725a45e3362e812e3c30a62c6dce43881e2396271c4effa9aa59

SHA512
e9e98f159616682f6620d7081cf22866e3c73bbdade3608f8e5bc3e6840c7b1acac2232badf480d570622a999c1ccecc81765305838a14fb4cad8f27618fb895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986902707799887a5b54dd019ae4e77e

SHA1
5345efca78fdd1af8c88189a7cd36cf3f4010ed6

SHA256
3bbad54fdd756d9ddcabf2a2ee9e5a9205ba87fc50bc6e396727f01da8de401d

SHA512
20294a32372e672810ed908eaf349c2b49920fe37c2143c2605d73babbc378f5db9114aeaefd1eb47c4d36d69b64d027825e2eb06fcaef314f6a2c2ba05ee35a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
797c8cde8141f86dad419fb08d103593

SHA1
07ab756613f16b57bfccb02c7d335b90f1c945ad

SHA256
72b108143fccb467a37801ce3d92116e60119a084dfa81cdf06eefc7fbb62753

SHA512
818fa92fbe2a0eb4d1fdcc70e0bf2e3f91806404ce8adeb2082afde2b583d861f53658df37558e386d29f83ec8f3332c7bfd0de15970e47720ebbe39e8c62e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c572f37aebcc5a83ca62394db491ec2

SHA1
75723ca2f3a3d17fd0a6eeb905b4c1eb808fd22f

SHA256
02fc7ef6846ecf6793d6ea91c640ab3b9bca214165b80f7e8ca136feb1c95345

SHA512
c7a1eab5d11817e96a668e70621bf5ada84b246cc59637a8bc8ed0769a3f4c6304864786fd5be91354e04ee03fb690ba5b81c8e698016736df02027bb30e5c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57468aeed7530062057457ab75555e1d

SHA1
6b886e6d9175fcc9d0d902dff49927177a26cd60

SHA256
1a83456d08844696aadbfe9709a17e179f05dbadbd7b371976301fbd4c6c6d4c

SHA512
fed1994090b6e7e66b678b77ec2153c014e2a9c52c6c4254fb1543e636d783b55591fadddb48622b757a8cc29a83315cfe1fbfbfe3ce08ac662ab512b1213dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99862e86ba552a744ccf6c621e9f9d6e

SHA1
969e36eec1ce9efd80a91310676a8220b6a7e4c6

SHA256
205ae0f76b114da906803a679fac07855df079606ee6115fddcae853998baf3d

SHA512
e655fe1fcac99b413af19469bb2156bf5c3cbe9b2f1bd02c5a54fca0226484a8f942c2fad7aa6613ca8df8ab35d0510d240ae929220e0dbaf8ccb56a1fefb94d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b320c14ef0522270ceadd9ab90963f6

SHA1
4142e9a501678ce137146c538111fbc31a331515

SHA256
931c842e7f8f7e3100ad7cde0befaafc7a17ba1f99c1b8235a9690844e3da5a4

SHA512
421a37fe76bd98ce8b9aada37018a103bcb0afb54cd8933a29f5593dd83f4207e1b9a8aa7c2f1d3bceaf7b39caf01a93bd7c5479975bc25187ae09e31f49677c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB68.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC3A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit