eaf0c72deeb028306ac5464bc9991373c49b744d479cd398885af9b4acd52ec8

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

bf77cbbac80bc49b55dec0c7ad0a5c33
SHA1

cf6db0dc13e8a49adf93c2fee4c4e706f92c1515
SHA256

fa91eb80a63f3b2bb3babf6d1cbf2002d0aeddf2388cec7a053230a26b28dffe
SHA512

4c329d4487a3031bba9ca7630f54e6cda19de1d9663ab42a7b0b92b2865143dc3c94c792e8ebb1ee3298891be44bc2919cd5c3602169da86666eb2ed07b8e81c
SSDEEP

3072:SkJfh6m9iurIWW8yfkMY+BES09JXAnyrZalI+YQ:Sk2m9jLysMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BCA5321-073B-11EF-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420675459"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b46dbe1408ae3c21898372ea80e5c9d

SHA1
13965cdecab76e0c06f2770580f9264b0449761a

SHA256
f41ffef01c4e7d4f59cc02779eaf0b44a3a2f1a33e38dc80161f4fcbe7f97e25

SHA512
ef5667ad208de10244c1f7d10bd5af9aa31011c532f1f26cadaa71c2ae460521d6ba42520a3174e123aaed44009746ed892719b4f26f7040f212ab298c3351ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db945b2828728b57edec424e486d29a6

SHA1
a6abf18ba406dc09232efb52e42a206146d9e2e2

SHA256
d4a9ff9ce0ad692c898baf2670b4899c56713378789ba7441d758478f9759f67

SHA512
d199174a278876a962f82be136fb963d2e0a455dc546b8e5fccfec1ec3dab8322e18073fc6c10db7f84df377897fb3bead883ec948a944b7d49f12cb6564a145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9438245af826c6e5cd156f2c43c68a8d

SHA1
1ab627665f3147aea1925f85595306a58f938217

SHA256
3e483bc59942492e27ed25322f4b1b584d38db1e48f919b8c4dba003fadd9c34

SHA512
8db968a872b545c44a3222623d8fbe49b72a66aa3a6f95b9c3e71e8b3636ae0172e99890d6e18c21df627822aecb45515a5b2d5afb39a18948a85a11e917e16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e82db65326b1e436a168abbfa09b5634

SHA1
770f555823fc2d4be2863f0eccca4d40b77eb11c

SHA256
9cc70e9510beb6ddf4c7f7bfc42457c57210c4b5424caac7295c8acbbec28910

SHA512
a681d733c57e2d33000e4f1c2d26ee329520e721285da18991a06ee57d513f11afe6b0ff9870c5538a4151f6ff9a4fc02e2125c765e018bf68cdcf85f5c414c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71d82ad3c6ebc6c79af8554cfb510690

SHA1
48d24bf1a498a3e0645eb2b853b0856917fdccea

SHA256
943ea7202bb02a59c53bf14442d354b17751bad9d772072c0f353d191fa13392

SHA512
1938d3890a5969821588f44a706bb692e93ad702b8f1a4ace791d9c414487c6e36ad37b5deae97cfa1aa26abc8a1e516569be77bdd43d9c525061c1633c14699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88c2b675947040c8fc970c0b33ee7974

SHA1
7b918015d665d2cb52f9c0bbf197c8594abdab6b

SHA256
9e2f5f3ad6aadb1e705e66ba595d57f9789b852dd339d3436858e0263c956939

SHA512
47098b04c15c3e03598e3a4b0091c8b7b197e40d103b8c28a2af5e9b07f6199c92e944115db4fdf2b0d5642d825fd3429a1520caacec056a2d7674590378fda0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc54c644f0a77f409187bdf6078ed6b5

SHA1
9cfbe2a960b06bc5ae54956dc8c6dba165483690

SHA256
a831caf2c635ae270fb3bffeebd98e5994c789f3b1588389db39287bfc6e21d9

SHA512
77358971ab59b93b769b4d80afbb63450cf2ac9ae7dc1ffb22553c03603d38295e71026162a02b4eea2c1e3b9e9a327a14519a728de497c5afde0ba839c5c357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785428ab2652e516ea9971bde2c9a366

SHA1
fe4fe75f122fa2a35b10fc4a007055742ba21044

SHA256
7a905b417b030381e9d445b4fbb2a1459daacea359c1c3c70386d406e5ace2a5

SHA512
c94d26a776e8944690c5bf861b506350c5c1f1e0b24743321194b86804ea6f6a621f0e1113f914d930969a65a173a0f21ee203e6330dc1c0e6979c1fb5dc86cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0bef2e85b9c6549dc0a4a09f449bc12

SHA1
a1583b6c199fc208b9145b505325a5ce3ddbf90e

SHA256
28f6b08d2c24c2f2b85f6bec468e7da5e25666a704449030888caef12b20b9c7

SHA512
872b7e1d1e986933c3affa966e73ebb72a05f1f8415f0d1e791fa683230490631d981008de5027af30865fbfda6b59e7c5deffb5f37a66919a6747818ec9f63c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea4714233ee2671b75220e788994e296

SHA1
b3d895f1f1c56543e79602651d5eef692ddb10dc

SHA256
a90dda644aeee057ea60350cc7dc7394ba2f741dd38c71dae0b8f0c5e6591f10

SHA512
8247b2f747e8af353de5f01a85853eed1a5cf911e9803fa869333f261217cfefefc971c0aae5eec808e684f31bcddadf832541dea0252aa523f78aa2b822b371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1a44c3a73a17d9fa84fd2ed94ca6905

SHA1
34c20d519c92fa1d1cebd2f15b09fe723d7b4e4a

SHA256
cb1f17207717cc900c8234bef1425d61c814a2f80f5b858e909050e742ac0bb2

SHA512
3fd6cf5d6504bc8099bcc7e70a0c971eca04baf01585512246d3f9a70f9677d2fb3dab1e920ec57bd5f5f435ca6b29fccb548efcdd2e0a9935e9029c2a379572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd9de41136facb9886e4d52d585f05a

SHA1
351c320db860af5edcaa3cca44a7ddc7327fb073

SHA256
9d7e70a34795c22805b8fcc91c68d524d785331a512756aa79ed3c016f6a1e67

SHA512
f369e91cfb99777b641e1c57b8d12515511c2226da02eaa40705a7f44c0919448c45449de483334a4d0cb95c134cce8339562c9e8541e6888af3c9d79d7ac3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e031b748043fd9dc4261c800d3b8ec

SHA1
7a74e8bb5c3f67d1a4e5d7ce2a3cfcf36fdba950

SHA256
af32689e447c8a755003117b418a419b034f1821eb2a75f035afe28fccdb1325

SHA512
000d77d84e87e08dc56567006013c0790ef4f06dd647240865ac2dd64d00685d6066e6972c49d3df1c5b89178f0caa9530ad9f03d82a311c634cee32c722e595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ace460af4cd63983e52d12d830298a9d

SHA1
ef254321e76902bcba02246171e9f050faacb806

SHA256
60e61205a8888cbb845cd1b79335139a56a95b33aafde121b257ba1110a217da

SHA512
87481ece9bd1f07564136a4ebbd1e7e521cce61aa6209111dd75e1108f19544c50765854d6331be98c7f9a0bad4ac2d817605f7fd1e2771657a589b741dde8ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e185d9add219e5cb0940f2049badb602

SHA1
2d1a953561f52d351192a089b364985626ba1660

SHA256
8365432aab6436c748f009ceaaa801d9611d99873db92099be4f1580428a7ca2

SHA512
b4859d49ef7b1071508a78899b284d670928eaffa4c699c4730c0a1c52bd9a33ceff9ddb07defcb086ddf2c93c573e2d84f7523e65a83a81c56c524c8c15bb1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e74b49e38093f97a2c7e5c8829a216

SHA1
59210f2dc35b48c4702570d9f138fd5fb058c032

SHA256
b47fabb6ba04a6fc6f3be48871e3ed27bb53e55201cc5fb72d7bf916c9e4dbd0

SHA512
0753a19ff563f2f219a183e91402b3ad61fe8e0d3f950a4d2156bce2ae8e1505d30e7cbc74e7532e6a863c1e0feefc911a40e743c402d96325b49214fbf1ac6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
631cd83afd71c0257145b07704242b55

SHA1
3b3822bb5072aef3ed1b544b2c8d10bfa23cf425

SHA256
d90f09ac38e4712607c7b65207bc8a335069d9d8112d605b5b64df38c06bcee8

SHA512
5a6dc73325e1284ab50889f208da4106c7be0ea543a303244f0159e48d58c402f3b9fc16418d46e3edaca37c7e4ec45847739658c60464501da1e80e5a5207dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba14b6ef9bf0c1feac84ba26f76815eb

SHA1
b40ec03d5da4a08506dcba5f2688cbe0f2777a53

SHA256
7acae7ad671250a8ae7f29f0d4b1ee0d50cfbf360361ae9770f51101e3c1f9d9

SHA512
15f4b86e768dca28da06ff29af31029dbbd0ee377b5b24095b6552a48c62fe8d34aab09fa3e31c52cf9157b2039e79dc1df8b1b55928cad909cb240402b54086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa371b1bcfe0628ea4b9cb630b546e31

SHA1
0c2bb37859af625207540a1cd0b38c4c0c9ab039

SHA256
cbde89867a7c215ccb02126a1e25197e253889b4966b5c20ea2797312887c4b9

SHA512
d71d574804f0f701f83198df3df39b26a28befb9f77eb286ed83138fcf579408b1cf45fa0fd9c738c0c138ec105eafc8662420dcf5eb2cb0ee93626f1ce3e276

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit