c960f30194056c61dfc043a0ae12b23e6c20103db7730cf2b2f8003a1de448c1

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

bf76ee8434013d068b73c950b30ea498
SHA1

2f22989edf1120fd4ef55d9c53411beb9c5d8c72
SHA256

c8aa66d70ab2b14e1218b90438613a9efafad4a47bf64d0d70cac120b26f0de7
SHA512

2e1a74f0e5a2b7aacada1a4875f02c74cf737b6b6b81a4190188b934ab9fa549656270a0e9b69fbe7820a802a7c300963b1ff81cde701e6c2b40c805a53a87f2
SSDEEP

3072:S1hV4wg1N9Muhx1CQMEZF0/6Ck90Ek8HZwRGwt25o87Yyq+m8aL3tfSVgndyyfkC:S1ga4G3sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59108BB1-0528-11EF-BC03-E626464F593A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420447500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2056	2868	iexplore.exe	28
PID 2868 wrote to memory of 2056	2868	iexplore.exe	28
PID 2868 wrote to memory of 2056	2868	iexplore.exe	28
PID 2868 wrote to memory of 2056	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d34c2e04757bdf9d9b6b8fc673223925

SHA1
e6d1ded27a5036bc4c791aac19f7b3c647205a95

SHA256
0c7e06566427e8f4171cd094b4a6105ffe4fc67ad8368e37df255e722a66bd4d

SHA512
96c5813a89c159630f439c582768bbe1323dbe995b4f950d6894500497f7025fd8c2ff7dd557768fd000015544f7c0077d7962a2528b41c73813af6d414f2310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9673ecfb8e3b3ae35007d09f2b7e8fe7

SHA1
df26651fb4884eb2a81c1d73d69eda74c0065bc3

SHA256
84774d366411c96d1afd14d2a4fb9d388eef6d26ad9d547ac480ab287dabdf83

SHA512
b4089a577f76344df9e9d998c84902fcbcbbde4b5b6162dedffa449dd1fbb0e0107efa5f1deb2742e1a799c132c2075ec1b8d3d52c43f8bec03da25d343bd497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dd859e4718ea82513b93286479f36d3

SHA1
a8b6dc135ae5646442f4137ab38c5e856f08f870

SHA256
d78e6fcf02a0cb5d0cf2aa2df075a7e73742ca17305320ef943f3b369e2c820a

SHA512
dae57ebec735685fc70c4dfe53061e7fda847231e07adf7a4d99874ba977b71a1d038230239e4540b85e2c2d1e573aa47e314acaed6d9a74fdd3ed540deca785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b7b1a6439358f27a2480bf46ccc74e9

SHA1
3bd38c7a2a0a77d1a38ec0faa5a122c152ed4769

SHA256
9f4b2d4ab6f88b1c46a90df66174e0d611aba7f6d2ac6f5aba6435a589e4c0a5

SHA512
4abaedf4210496cd0d8a429b9b068758d53a427191a55b8995018884073f4509247aa30d7b4f490ad713a314d92a52926f66642ef6efa5e8aafdc0ccd8ae9e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f797dfe95982579f994d042a970019b

SHA1
4e90588906d82d8c15284183ef102c1ab01aa4e2

SHA256
22250a115779a1feb062b17974cdb37883fc9879935609144d64c8ff09f93da5

SHA512
fb9085a246e77e4b2039bd6fa1f9814c36ac0c5c2b8338574e1825519c6ad03970fffc48dca34ca1db927064951901f148f401b2845f64a2b5d55fc765372800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5630cff417843b5fa4f9d31ba267d1e3

SHA1
7473a3cb5327a489310a28eb6173b62a827e66df

SHA256
c94f1e9b3420b86c2b269c0ce4b85d126817bab4ea932df86ea03ced3becd62b

SHA512
b47aefdc3a35702196c959da5677a0fee330ad632bce7520b0e44eee7821893fe52830481d0393ee8753e3e326a9e2fdf3dde0042a0d507d263d7206eb7d9c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b420c5d308d5a6e41e2cfb9d6176b0a4

SHA1
83c29f9fdbb1e339e537205424180bc71bef0539

SHA256
1fb71891ee86afdc73bfb49e9abdd0254609023eab991d79ad0c7ce9033b070a

SHA512
d57abd10aaeeded8d3f7977606da31f4c39ea0aeb697fafc7729898291e5372f37866a5d8af9b90845f178c9f3b8d717f6c4760577122e7077e48d807309002e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c825dc9d26010af968027b125db5ed

SHA1
37eb5d2be0a1fca1f3087a8f3ca263d5d3b14614

SHA256
ad77c8268a23e7801b5822e5c02d63f37e50c4c211a71050909260120babcb35

SHA512
3de98687f52814d91a6aeaae92402a77d16204fa2fe0dbbf39f14df86b8115b7e401a25ab5726a2e0b01462a3e9dac4413be877c99ad3b0a0652e2e4d1216e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c2406a1bbed52d66be15c08e8cb81d5

SHA1
cfaf60827f792200d7d72142648582c64ea9dfca

SHA256
d898588f9c56cb30f30c8ccd21baa5247eca0875ade743ae9c7d74854933a4d7

SHA512
6b8642a85350803f0d12c99976df5fef43c988295a95110ab17df851d89c2ffa01f506e0093ed74f65e2e48b65ec1362682b7c23aa9c0760e8962a6c2bd09adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404a8f72fce1b44bbb772b1bfa36cc35

SHA1
058d14a8ea82ec630dab88ea67ff0b0119254456

SHA256
c84c7cc8bd36e2fea8e541e5c85c65e7a1ce16d024eed26e21ccf16bfb6b09cc

SHA512
ad3314f15d2409c0879a38e7e0f8dd1c7ddc47ecf2d5d4dceb1811b6d8189fe4c3b824a960e5893ba693d80c0d33ec1578efc68ae8ce56d1b272346d4f74e9ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb776fe8ae4968f75644c1cb95901bdd

SHA1
2514605576d5b1c8e115adddadcbf42149158743

SHA256
2687ab1eab05f8814661ba91dbb93224223a6e23f5c11b36b47ddef895b2c02c

SHA512
8838093bf5565f6aa056639ac30f140b78ff0263edbe3a7a41a57da25a4ea8de61f865c8f523ef69507eb31ed0af58786ef7bfcb743ac70d3d5ae123a1ccd4bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d93fa429b838a248f320f2f77e01b414

SHA1
74a953bd2b275c60dbe4c48b4b97030f66b7ed87

SHA256
7cc9f346d52271710abd4d3201f90c9e93f0c12c321fa2d41ba801f764e0a135

SHA512
c7566bdd329d3967efe2ac8108f40196da4ef174260f5e0a377d1ad736c1d8bdbc8354a3d3c812d98e6c2d63d46cb4619d14d5d70306988ad3dd10d3e6509ece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc799591df3ff994fb915020fe466fb

SHA1
d8bcd46e5bc44ff9b7f0c10c7cef7c79198a0868

SHA256
947b077b9f4f7b86160d95616bcf036699391a3789856fbe2558979fa54fb45e

SHA512
fa0ec806e0a6fa10b6b8a2c9bad0bd508763366e7feae746947414ea2386748746bca473478e53ebb1420110aba6305da97bdf61c89125abb45ad157b9e16a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b31a8739a68c8d8113a310bcaca15b5

SHA1
b076e0516645c7480c86ff71df0b9ad1cd3374a9

SHA256
1847fc4ed6ac089b72dfe1dba379d3dc602a42964d0ba363e90da42276dea518

SHA512
b18e3ca89b29e1705c44266634e33060e6e89cc47fb08c433d513b4c09c1816e793e99bc61a21f7846a77f94f35a93fa464c06722a7f41b8143795754936ca01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb2235f4503c93582230e32fb433013

SHA1
dbf10e557d59563c3052cde90fab4bf8c7423808

SHA256
60fd217043026aa0108a0155d586977d3199ef5a6db77f1cc84dea1ee89c06eb

SHA512
5a68c50bf00717821c2866274cecda957630239908fbda19fcb8a5f3ad4603645b3669894db46017efef8a971ff3ee976bf8c944582e2a7c5b195c12ee10bc18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d713c148bdda70c230e0e50a8e2c2d6

SHA1
0e9a5e88cc4d6e3f97aeb74b08d63ece0031fde8

SHA256
4a25178a373192e5dd60efc8eee1694b34a27dfc78d669040799d2b8fe4edf42

SHA512
0367b205e9181cfbe3e99f8c0fad207598cb5714a1d5240c74f404e67abc8fddbb63cc5bd7becc423d6f6ec0067c99cdd361ff1829c8c6c16dbebe5ff76ff694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4cfa8d13635b741f26f09b7b2d413f4

SHA1
bbf465be4e423848733979e3128485a974e1e247

SHA256
666c4a04cd640ec5f21d849b7af37dd7ec924f0fbfaf478a690024b0e13ef91e

SHA512
a89a1fe7ed7fff72446d1941c9e8e07a2ca1388a8bfbfc41ccdb0a2fa86f8375dc8d3b7f1e12701f6c2fc8cf682d6c9e05800eb9f3130627d5f5dfc77d5739d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19bed12c8f37c5d8a137a3ca86b2dde6

SHA1
7d785f961be91a35c7b3b13c61742f9239eb197d

SHA256
b7eb50f2a3ede254f9432e6e49580664cae93efb83c83c25417f108f092f212b

SHA512
60156d335d7f6ec9e5a17d507576b2a38de9fb2e617e79ca489df3cb21bfe157b5e8a9ef743a2633dad8410dd7b33e823a5315bc76fefecb0501d8f387058293

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab121C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12A0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit