7dec81446ff4dce8b0d24e6c2d509087ea1a9a016f1da9fd7a2b3efeb7ade600

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

ce4b16ae74b33144347b260d893f6c01
SHA1

9b5dd12e40a9ac801b0ea6936e00fe786c4064fc
SHA256

83dcba873a41e4ea186f297ed1c12141d5dd3b2ce9c92eb8f75d3d754e4b6689
SHA512

38af4e9695110e770d3b335f2f2a38582a635d30b31e33b4327c19ae583c53a854f115f4611cd09c46fc07ec54e3f210b99cc0b1588c7bdde0f2c38e5eafde34
SSDEEP

3072:S8i9dNp09WpmyfkMY+BES09JXAnyrZalI+YQ:S8OLjsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420647226"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F0D6F11-06F9-11EF-AF73-469E18234AA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2200	2740	iexplore.exe	28
PID 2740 wrote to memory of 2200	2740	iexplore.exe	28
PID 2740 wrote to memory of 2200	2740	iexplore.exe	28
PID 2740 wrote to memory of 2200	2740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d57d55ae7000c405eccb2660750e41

SHA1
a9bd87d0a522bc56e8b37f5ed4e7d5cb643563c5

SHA256
84064ac837977e384b3dc043cb273fbfa2ed90f35efc01319cc1d78691b995ca

SHA512
8c5c93184d757a2730f874171116fdfc6ffc0e0ab3a93aaea8c3037887a60752d1223dba00e303815e5a2a0184cafae298be3ae9c5e6efe0bfd485b703a9fc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d9cd6d281339bb4968c1f24247e1e01

SHA1
b7ecdd9d9b82a3b742b6783905e83fc5cf451008

SHA256
d2ce9a5a5ab7e1439dcd7dba291d56518890f7ed6749f66e1a19ce57fd5b7fc8

SHA512
ae9c295546ead8d5cb095f4ff16e8bf9e34478fd9f62c87e8ed2226f2d9cd75de8a659c8b0c2999b148a6070e9e8c02520446510bf5e9982754d93ee722dbc83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e1e4072a711387884c3234f4c9c8f43

SHA1
55004e3f223a5a546109b7efb41d8533733c5a8e

SHA256
adb894379bd966223179c5be61f5ea803eb9bf4331a800398a3136952978b620

SHA512
1500e339aee6976a0dc7dfe69a172d1c6cb7e56837890448e8920ee3ec7cad273666b4b7e6f9f56e6694485cd36232602fa974cc89a01ba3fe1067ad5296e1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec8f0fe85f97825cb1aa5c07f657a3f

SHA1
865b7dd19e94e9059e69df83c2f9b4e21b8a3edd

SHA256
a115545ac46be7183587b31ffb9f2341672398ba35539070cd731af0b8195859

SHA512
61e2a564f5e16bf9c512071f58ffb8312d88764c17effcf6092e506997de6c4e65938ef675cdffb030c768f8dfadcf73898cfdd6585f2e25cdd1325c2b047ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e4c97f3f80a0b43be0b9c16e5818aff

SHA1
b5bf801e8a632f8ae906e6e1775ba06a7e86b60f

SHA256
20304e3930cdeb42e49fed87d2ca17fc7c2d82c5c0a57ad31df40c21a5dc05cf

SHA512
fd0f9121a2b9911011c298a2aeed2c0a0a574ddcb15093b19a518d70625b79919629655481364753f0751e5523f91a6cda9c4efad862fcbc36055392c9a88b4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f4e2e80d7fca33e6a635c57b4daf59e

SHA1
008a2b18a198f0c0e9e36e07ca79c90eaeb70b38

SHA256
68efc9e2854b4e904ae5880723ef5a269a9d77ef1d68ea66d176fe597c951e61

SHA512
cf8662f343c994db7c8de69faef5516cc5a17e4c0f281c945291c0f0256ce5b43af798589424ad4146d282493dc4c80aa0215874be98ece4a8860fae756a3d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0c0507bec4e86501e8395f3e35067aa

SHA1
68b4020691908341d0ca9b19c743147f7eb36f04

SHA256
1b22a9c0ee97c5e1e2e2f3ad6bc763857b84aa414bcd28724822dcfa821c93c5

SHA512
874b3493c0a6edee590941cab9b6e81e352d3b9434db1707560b2f9c043d05473c491c009484e358af4d2b3cb372b28771428d6312a53335248c766388b55017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f191e27c96e1adae7a13a9dda3c1f0dd

SHA1
f3c24927bb585b5f8aa600cf09d88a40d8f2d204

SHA256
3e823d7cda8e52a55d4e04711a3bd98f752f51ea5f9cf71798da4cedf258f003

SHA512
2849bf8de063285169eb20697a5d0107168117e5fdf81d6968753acc5aad6eee01c918ca840179daad2a66c0964f6120eb5d1dd32c5a318b213da444a6d17393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0b0f7260a0999c1bdc292b42dbf36cb

SHA1
0d634673867fcea339e7f09118774e8bc64e322f

SHA256
115f4bd8f4889b79b25899f6425cfbf3d519fe8211a4665e73ba556a336ecc4b

SHA512
83d93a6fb34cbb6026487a14c697ac4c44e8542181e5213f045f204dc04eb103569dafc3441375bda65b5ccd8262c219e51fcafdc8780f8756651746d03e44ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e6e7681f4e93baf9916fbcf8b3e9cc9

SHA1
735d6c448084d0ecbb863c96894c70d8c36c9e5a

SHA256
28d81030198fd84dc6a947060a0bda5b88fa9daa4103aa8db48bc98be3db1109

SHA512
b793b053e5c0fe264006aa84c2ce122173ff74f8adc6ca882d714d3d2a035af3423b06c887e112f63fc6b5bd07024977a356802d9e3a10b65279abcb0ebe8cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97c902488c4daa629a9bc625be7980e2

SHA1
ef366011372a33eadc1746d33a68e9ccf8951c40

SHA256
234fa4226f4f08cd14420afab9e5245544c5307e8cdfb36e7b02d76613738a94

SHA512
dede9b84fc291bb5ad08dc1d8a37681e6760ec77b5396f5626376b1d0a89d8f145e5902575ff3f81dc3ce8bdcb8de1638c1f28113eb72dd1ad7b2faf5fd4a23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9581a93c48c307619c33eaa1af2511c4

SHA1
b82ee1e855dce4fd073421e2e1bbe81f8974cc00

SHA256
9f14992a40c09dc41fb73722de58eb3f159b024011864d4a976fd3df3b9c8ffd

SHA512
7b936c951ed00867969d5fd3e0897b8e0673aa78ad44f15a9729bb1e2bf8c2e99888f556486b6a96e9475410656005f48ddb3e142ebeb9e6f76d1691418a60f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a58d9c05ae009a22110e817c2c97f5b3

SHA1
a7be89e474ae05268d0df28a3bb47e75674d3969

SHA256
b818e3d6b89d1fa333ac8c7a9d309bbb85cb064ab744c7a6fd5c3964a4b9237d

SHA512
be7553045d995fe6b8cc2309700c7da78383fa8e3f681aed7c7fd81683e6ba98adb2a0153321b5f8c5145dfa9c76fe6a4e2ff4dec37e0b659488d50a3eb936a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74b70a7b72705290762df442eaabc230

SHA1
516c8181b34a16b8fca5c98aa9d1d43e84f86aeb

SHA256
b2fcb81c0438d55bb2cc8d62da205617df83b92321347cfa1afb0500ee4e8423

SHA512
834317f3fad81f2cdc95126a019b687e8551943f60465189600445cbf6f5707e026b287b322976facb8bd0d8c4555aa23ab0058719c0da07799f1467b9092557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21b504a943a428742ca530d70a43eccc

SHA1
4d7a18009e354e2a730962368b2d6640808689a6

SHA256
4d12e33dca7da7e78031dc8adcffbbe047f8f9d628aa940bdc0e6ba45b931212

SHA512
9c24fc81c721bb87dec99fe166915053ef7e6ab6a792f15f6e9ad676f41ed620f5fd575df641935566d6fce6745c20b53c578a1bb9cd07ba9e04f6681e3dd0eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4270d1eeb803e8befb677be78ed40564

SHA1
9786587b44f7400268c7fe8e9ebfee93edb05a2c

SHA256
079ade3806e59f099673c11febd4074fa786d7a074c614acd5700f518759223b

SHA512
f399214fb527bfe4ee89acf997567a87207d97154a2bb19beebc5dac2e76905e680b980ff176630d086257515ddcb003b8a0d5365ceb4c0980d55fa7e3589249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
900b74db01714c68fdc2add19e43790f

SHA1
499a96ec3e892771ac2d796971f2b8575e3c59bd

SHA256
f7c9fd6047ba8b0f7b9c5740f1a658e85d519b058abcb0e7efb49278d96af1e1

SHA512
007de71534da98371fb2b55dd334fb32cedf7a1bd9ded693b794d665250967b582f2ed4c658eaaa31bac1d219bad856ed642be9114e4205d2be3f3545502a650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74895124c36b253f876f4f139c7670cc

SHA1
b13563a55f232023b4b61d1c2037b81392f99e9d

SHA256
19584ee45e5030624143330473dc3c529085d8588857bcc171fba59cef5e173a

SHA512
c329e757d133aa0748e437f855297a49f684db38344e2e983bedccfe3413f761edb2c2b41a36fa7f520ada03052b82c02c9790dad258519aa8b32dac36b22101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a2a500bbd190e5865edd58f6f4419bd

SHA1
346a8e80c3063699c9241ef8059de2859185b747

SHA256
fac0fd574e8b12e587363474f06d6ec2f46bb57bfc538e167bd32405f33ca46d

SHA512
799186f65c9c05a30d0ec4731bdbabce8526a9c3de7d5179137162d00b1950e76636fb0c3492c8a1720f65fb916097a3f4d11a4a259b8b02f9d01964e5578aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1373.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1435.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit