ed096929817d08d01d9f78606f4b2d94a285613ef86bbdd37d5bcc4b8b10e0bd

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

c067c954aad56c3fea8af03d19d9a60d
SHA1

fc0cb80201fde2ccfac0042af8119412770c2712
SHA256

12d1417f936702f861a9439c1b405ebb5415ef08dc827eb4f262952a265e064b
SHA512

58e7b801529ba2d46a64f7ec91da35974a0b00b96f28a6548d99f22283e2dc287ba7bf560371a94d64e8b0903f2b8be13e7dad0075e415dc47c4529cc164856e
SSDEEP

3072:SqmDvLIumOfuTiyfkMY+BES09JXAnyrZalI+YQ:SqhZnsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420619061"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB6534A1-06B7-11EF-9267-5267BFD3BAD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2208	2944	iexplore.exe	28
PID 2944 wrote to memory of 2208	2944	iexplore.exe	28
PID 2944 wrote to memory of 2208	2944	iexplore.exe	28
PID 2944 wrote to memory of 2208	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa2e679297e3af9130a1b9cc30704f52

SHA1
0e89e4c384ee0b987605e6986c7a8c292f7565ac

SHA256
c9bfc3d4d7a149b40854e82068bcad6f51edabb84a9ddbf1d2279b93b0fd50e0

SHA512
ba54f0fdf1295c6a861c7caf2ca79ee8f61356bdbb1e9101c519bda0c61444920a39d3bd7dcea4c2ab4c6a6c8b6b78dbef9beb072edfda7e96d25c0b67021eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bee2c6059052e59b28b6f2e33df4ccf

SHA1
dc20bc43b1c99ba2e9fc8301a0003a86d0414ac2

SHA256
958e64a80d813283a874dee9836e17f215f011a2ef8a7151ce945e4239844e34

SHA512
60e1d07970d99e73b0e690cd95cf664bd1ad5c17353c0d1405447e1305ac800f01e486ae313eebef638edd31dce597c93ea252828cc230b935a70b8d5a77ba40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f926c9b0cb64815253e5380959eca9e5

SHA1
cf870071849a6549fd6971acc936a1d397f2a591

SHA256
92191fe6e65cb25fd66384992e189e5c7231ef51ed7d8d6a5369c9219c35c525

SHA512
faa4abcf0da158bf4368d7bd4a7da3d666f15c9f1fce12b843267c7792d67d02c09115d6cfd1e0bdbcc8425f09ac9bed60cb8928ead5b9b7b395a39917fcdb45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039415db8ad6a3a5d94b07be619994b0

SHA1
72ae631ef235b90deef65cd21b0c60b180b69c4f

SHA256
6ae755b737d342905b57544565a5114d9491468e0d67572556c3b858f7268a8e

SHA512
d4647fcc8c53e11da53c3d08b68991a70c72f5cbd9c27c487b32b6c848782a91c7dccfcc6ea7d776ff31a773a09ae593e56aba4f6a97e39533d687bf39e2d807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d4531fefbfcdd203d1e6096c7a39a7

SHA1
a2710277073f8e5a23e568c8b1593822a38ee788

SHA256
a7c4639d554db93d666b8d74906ab30555bc6b283a4dafe95a7cefb40842c5a5

SHA512
065d7dcad728fc16a54ead32a6668ea1d17fbc004b37ad2cd4b566432281b5e130529a49f792cf0bb7decfdd58978eb2d470e5fd11c28bee26b2730517c6cfd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7acf08cf89bc6530bf24c5c47434243a

SHA1
7e0d8542e79e8d35ce2dc408593f493c5fadb978

SHA256
17d55b4a78c469eafd3aa8237bb30a6464f79f9b765f06bc56bf670af45e07a5

SHA512
c1d80085b7056e63cdc78400ba80411f14ef104508d8d878b6ae9ff39eea52b3595c639739d582aae5083c74bdb54ab0276d01711d3a89fe59957465b2ecc4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42f632c27466d151d9367d7d81167703

SHA1
362aa317d8456f616b11846de88e525c2ed83bc0

SHA256
e6fc239532871a98e08d0661fc71429895e62628c9e4831e1220a4266bbbab2b

SHA512
b55d349a6ccd0f38bdbf15d2ee40442f31aa2a2d4a31d9246689c962d3928b7cddac5de81367f98bc850657312c64ffdaeda8a9d6e83e6ca41866ec4ea95e4d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6fe11cf3c0f60fb112bab415140a7ac

SHA1
00d4eb1dcbcd6b87baaa4b7cc3746b22a98e4990

SHA256
366adc99e63cb254dad2e2ef0cd4c51c4d454e32ce3762adb011869ca905b3eb

SHA512
89edf4bd186303611c4923e03c28c54d4578a01844a77b41550d4a61c5d52078626ebb962fe71b141abb5003eab28cbfaba1908ddc190cdfd24b8acb90bf22b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7afb36214be5736b226ee2cef71104b6

SHA1
48758184eb22d94710799ddd62f10f0cf15c2d67

SHA256
d63c80671e18f8d073902ee53c85447fbcc3b1bd8fee7b0dfffaaa4ed7902057

SHA512
342b7dccf838b77794ec657d44feef787141b08e2e421fe66436f2566e345d417369f26c2db5892a1f053226d88869e917ecf4e3fd7fe2fd8bd3c3be9bb4b7d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9ecfdb7a1579714543e1813fc869c8

SHA1
12129a65a71f72a4f1837a2910140f6f38debc26

SHA256
0b1bd360110c2e9e1a329df2e9f8e7f105c7d75b72cf4283ce67d8f470da63f5

SHA512
79e46a6a9bc978dac6926393ddfbeb83092ae0fb285015f08624f9e598f67a3aeae9c56574a0af79d6e598eb690baff859fc2b98ec9ad62722a126c9b5733697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1381f60eeb2345a30391d3f52bac1ae

SHA1
580df7119017e5c4aaa2781c8fb82a39862cee7b

SHA256
77fb8091301cdf6391475c88bb6b0903ee626c1458229b87323e71d285ae542d

SHA512
9f65768fadc16fcb1e113541a00b3d07917c058792328648cee7fafa24f2e5ca60a54ead24628a31aa2b987e9ce8b9334006bf04a304d19cf4f93efd7ccc9759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef63a13b04b32bbeeb82767084e4ab54

SHA1
30fd335166adc0dc86e93fdc25916c3904f84bd6

SHA256
095774ae25a8392a698615f172f65f94367c8a79805e10cbbbf891210a7dceb9

SHA512
8a003255fd3da968f70a2003132284f01e52d48f0981c6712b7633a773eed262f877c1ab1dcc5d70af99dc5e65dffb5fa9da561a5198fd885434986a6f6090d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a38bce19e1197639de0f7a2a05065fa

SHA1
8ac568ba58cde47ac5145205995c2bb93906946a

SHA256
40056576390f4453f5b34ef87d64652f5ade6c80738b02e5cf8af7d1c54ffc73

SHA512
a96df11c30dc758764f353030457591d17eff433b921c3639bcaff3123ac16019152f78430447494e475352d080a115ee678e62859ebf0c8e0c242f8ec25bca9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4181fc89adb19482d3d0a77f9fd23d12

SHA1
705f0d46d9f2ab21c5df5b7f89148088eb212e5a

SHA256
7feb949db11a9baf590bead67a4e08a7d37a520747fcec8f27a4103f6252ed5c

SHA512
b47c8e440b4ede8611ca839d34854149e54528174478a0209201b5d118c99ed09f55887025b5b756ec2e9818c1310aa511eaff88525d994cc5c9558d83f80ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df883fa6ac4f150937590659bae5d3e5

SHA1
62bc839b7b9373f822a1e30d79c8d66b30329ff9

SHA256
694cf143329fc2f0e321ff79fee1c0c127e8c244a7e0a5cf4075c09252ad4da4

SHA512
e8422f4095f9ef437594633de516fa1d5802b2bab4325e436f68d00114c1b7c35524170e64c915277d50031d7b70709039d0c3bd6d8d2faa10d0c1fde81a4cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dc51f6c8c2d81e9239d58220b7e2773

SHA1
799a86ae3a38159d05715fed32c988ebd76d155f

SHA256
6cf8c8fe9159761cc4e63a122b739822083c8c96c7507b566ad1406df8f70d22

SHA512
12b36cfe17213b8e6fc91bab854ea5ad2dd6b7035fd051b5d566db4a7f3864b7ab5a6fef3e4db03db9dabb8b957ec8ef78033e63c48b4981192158db71021105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4573ccdb049c41d6b587c9d8f4e2fd0

SHA1
c92246f5af5b9cd122a057ae17fbda463ce31afd

SHA256
19f6430f66630de27fddc26c62622a6a780be8d1f77b1bb566b2328808079749

SHA512
e7dd336631e5b51992b8981c1fa6d19ea63de60bee37f7914e913086934bc5f3eadfa9bc3e9f7f4bc2406713b08bcfdd2f9a42bd4ba5224ecfd6ac19cb72de45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
597b7525ace9b0a57e4a217615fed38c

SHA1
db30a21a53e6df1b5daf7237b8769a3d04a73e5d

SHA256
21e00d5e4aae23f3c78421207beb664587843c77cd820c15e46f4da3e41578e8

SHA512
946e626acaa47cc4f59dae6a9c511edd92d85ecb126e1ca429fb36f5786b67354f1882c63684d09f51e9c0f300d9e89b9e72adab92d64f1dd3db097bf75778bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC73.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC88.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit