cc2cd6eec356152f3db7a439e9a91455c903bc538ea18a01acb6b12d2b83851e

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

c053a4c81e59f3cbfd1f81e188c229e7
SHA1

a8adce4a6fe5d273d3f98ce52a75753e6b685d70
SHA256

82fd0f3cb029957ee0b2e681eca4d5afa7a0f7f1b836eccfd0ea23b9c8454ffa
SHA512

ce56318d019dd63647dada7006266f91e8e5dbc1eb46553a7dbda869a8ba5ab19af3b4979616e15323107bd6045ca9fe58919513682c4fd89d52be5d0e411639
SSDEEP

3072:SnZT91XI4FTb91wbaJWC0Ob/3GSKyj5GmO1KfTd15BT0tqtsty7cLTHS5yfkMY+V:S69UcsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E58A9BF1-07C9-11EF-BB01-66D147C423DC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420736787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1800	iexplore.exe
1800	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2212	1800	iexplore.exe	28
PID 1800 wrote to memory of 2212	1800	iexplore.exe	28
PID 1800 wrote to memory of 2212	1800	iexplore.exe	28
PID 1800 wrote to memory of 2212	1800	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b7ab106e3660dece81b1928b9b8bb1a

SHA1
d2cdff4df3cfaede6bce749680bcd523fee90c26

SHA256
f4c65d3845dde2f5dcba77451fdcb90faee02bea1fd2ebc5057d3f7c92d7e0e5

SHA512
b4b38008a4bc1a9a5e10c799f0968ff941c865c7428f9dc1ca13f7b8fb81765349b50500180540397e1c58b71da9f94b98e05714c781a0c2b21a052a753d8a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8742ced92651afec05ffcfda2b8b9d18

SHA1
ed2c1cf977a80cbcd917221a9647e13b9891bde6

SHA256
9df043f18b19d0e6bc0b4dad8167317f32043eda3de6826e00792baeabcb09e7

SHA512
133f5887bbe0e02914e409bb6d8be2f3370b47249391424ad74f4d77955af55f9788f7d410c3b1604e06f07c70f0a97f7290f8a8ed5c057b90eac6a080573963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
261c5b383ba69e5307b471a1e8cc0d86

SHA1
aaf8aa69e96a267c0dbc1a66ad24b3a8b545e014

SHA256
049af4dbc8aa0bc8b86d19b027d9006ddefd7df2756ddfaa3a92ac7235a9bedc

SHA512
a02d50e57bed35a4c973620e0772ca02e9a5da3e1a9d63af8ac29f8eee32fe7f9192e0f3fdbd30aeea2a3fa43b9f850cba34b696eb219f5a659c5656b2f02894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b418699aa9639c2a47c93d42dc6965a

SHA1
10ce8660532c39791c32491e78d4bb6a97ae7e91

SHA256
da77cb7a57e0814676a66a3ad690fb056e220a0a701510f243d19575fef249cf

SHA512
5e269f8da87c77311a0f82781475ec609fa49f3f40f6d3914e81204d1a80c13d2cf386c769c329593f5d3c6b7c31cf90f07015508d6bb3fbc60da8ea069b32d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
152b7054eeabcf09a45eee02711013fe

SHA1
c38f541917730af0e33a2452b87aee9e7d704d88

SHA256
b7c7bcacf3a054a832cc1af81d273b2c27a3f374cb45409f90df56b7c4ec2d9d

SHA512
a4512cf39a55a2e3fc4cdd9f9f84b7d8c35f402a2b61c97a421ebc137e23ec6ba93da747e8f6358348a851e7fce65c8e5565e9cb3198e2b1294132d6f25dc37c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f690e35f98eb3f867c43d6694cff9657

SHA1
a8a944ed21ca1fb0699619598e7e90a5bfdb3320

SHA256
221f1ac180c587bfb290b5b0b110cb7ab7f0707a6223e0668c56f1afcf9d0d99

SHA512
ed56088f6913b7aa05296b0c72da5b6b493f00eb1023a9e38164110494ec1404b8dc35459f813c4b243e6bdec89dc5eb9f6be2dc705f17294f140fc0acf00afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6a5bb91523a047d6fd940e0a746cdd5

SHA1
8247037cfafae224ee3328bbe108d1f0d129985a

SHA256
291cdf37e2e17d72747b5a440a6f65666b835247602fb83a3d1b76ec12d6690e

SHA512
1b2392ed97000f48fc492835a01bda822081f909c093cad1db1ea2e728fed1994c5949eb871be1231ac01d82e6ec4d4224edb06f283a560bf5d24c790a2973f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d7ce36cdf28c887dab65d1fbbb2de57

SHA1
5cc0c2615c99ef8395d88411d5e21709e06f9845

SHA256
96f01b71f97a5b0b5c70a92e47487ef49ddce78329f6c86b055b127732da5bb3

SHA512
3a195116d27315560951cd7019c8cde0cc5625e0e355dff1ffb32cd150b09676e616eed68c163d9826c3d928def8ea0475fc6936f7e712a4c541b477041d1358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65d2ad2a8f11ce68b70e3d29222eb217

SHA1
b88cdf37e54a07d8ef11613d256bffaab431b50a

SHA256
b793e6f490050c3fad01c202d261c548ce4029815c8367a19729963bad922164

SHA512
4b878525c42d44cd8ad52c64fd709eeb1443aa73f3f9f4d87e543e1121202af3d9f0a187b36a7c73e4224ece30010227b106293aefbc8dfe32de55edd6ca572b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa20e75ae6441e497e7bf3404eb94b84

SHA1
20625449884debe976a620fc3a672adeb996726c

SHA256
3e4d056fc35e353851467fe7e13ba4fdae4f7a37e9dc8e6cef76a1ceccc5bfaa

SHA512
af8d432c81ca6b047cabe50aebc278b7c02e568fc00f94e5aa14e8d87774a5b4b567203ebeaf4ea08edcf41c31b676465c42821d1ac3a5c3a28a48354d815741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd5576298177febc9d627a4f3f5dd158

SHA1
baa4139ca41c91eb6ba195f0e3e5d56a7ad4be41

SHA256
57032868d69434bb083f58359af65d5bcb1229bc39a027d01dd97c7b372f5808

SHA512
b76e127b66b666d437bb8a9609eca75945692d6bc85bdd6e25b0c0abe7a232429254e352446fa03509b88e51b83df7000d3b83bf029748ff7a71a1d8eeea0b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7fd68eba803804872ffdc95e49c84d

SHA1
2e6c2e4ffc368d66d3196dbd774cf115f8e71678

SHA256
555328077ca11808ff22b3790f09a12081391e34d996d53e8e7ea254443db362

SHA512
31a305589c657fd1dee4b826fc8d99013f0e657d91f167ed43329772adb5ea189736209de4337cd3b58df882f031173521027316de82d7e30bdc8a3b162e4ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09f6fbc5de25bb271e2337c633dbd7a9

SHA1
2cb44e85c22d48b78468bc236d79ebe66be38d85

SHA256
fa316b06c1266cbbb9e77d714bdb81ec57198426d4fb4cd1ae07287e652b3dc2

SHA512
9f44443df0578d8c69759df6f4fe8e48def3addd5c7722ed0324e03ba8edbcc7ae660f66cab514bb54cf86bcd1a84d4be5f515bddba30c57f391bbcc8f114612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d3f9b7c923706fb3122d6bf4e20816

SHA1
6ac6fe72ad4369f32efac8326602df570dc98816

SHA256
66c4981741f6af6dd9e7f730640a54933cf786a2ff9d14e80423c75ccea2916c

SHA512
0c65bbe1f0a3cff745959e6c66f470533cc4ee1f2ed0d117d965da5fa864f1cb2d21adc18613326856833c8c25579999c44af2db7bb1e53016d6c7830102657f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4d63d3bb5869d63e6078c02bb61e765

SHA1
dd7c56214b6ca71103376ff2c670076c805c604b

SHA256
f01ea216985b1f1a423e3d045a4528a049b0798d29570a01000dbecc43d93588

SHA512
29ce167ddf4e7007ed9728beec47816a1979a258eb9b60fbf5269a997e5bc40d0aa3f75036934e1c6d1310654e4bae5acf7af3c0f8b3c25414cad4bcdc92b775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a0a2d73316b8073d950a406c893538f

SHA1
dc1f33e5fb2836bb696130b2db15fd4baa314d17

SHA256
f1b413c9ab33e24e93a033ec96e2600adbbcbdd20930df56ed9e60a470e7bd9e

SHA512
f6ef9a9b59d045b4ca259b1d95e1269413a407774885c880c24c2f336b1e5fd444b84d761b3d4254e865b1d1d6f38eccea093ac468eaa7b884a9ae4f0b148362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
648b6969ba7c5ac003ccf47f9ea9d178

SHA1
c2b4d67259e559816321d5a493be3f8db8c50e5e

SHA256
36546deadbbae3b8d9324fe54817eb20c43a4c8878fe131eeac74d0747a5b0a4

SHA512
6136d4410e6b2d3d105f73fc8ee4156d440a3a906fbf5a59d9e4dc7d860b7d88282a9178d9a254403456acbbf8d0ee3dc5eaf3507090c834f3b28d5adaea6139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24028605e805343528d62fccf6d7f51a

SHA1
7270ba9ff5121bd7e3a8be34ce49fdb708422fb4

SHA256
35673d0f53954e45adfd5af627e272230f4a7548a4453dbf69e7a029ddd76a3e

SHA512
4ef726cda1fd60c46ffb8f6cce621eca5a2b324b9d11c90c696c542654d0c4c629b0c54ac0b32ba03544b73967326d6b0b3d7187a47c33d50e54bfe8a57b9ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
537b8c9ee42b3b7924ddd175fe777510

SHA1
5c65613a70d2ee874511fa4683d8a71b5aa9df28

SHA256
6be07ea1c44471e3963fa3c8ed0121fdf2e554633390739fc90fda50704589ef

SHA512
33ddefef0d708a2baab06aa2fae453ff799a56b9ec8c769eddd69f568ca191143c7ab9d659f33f61f605087ccb6ae2449456a6177b4fe2a5cba4f67db040a499

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11ED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12BF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit