432b0ea418daff803901a5b49339122226343dcef008ed3a6a5ae2cf608651e5

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 02:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

d0ffcd3e00b77519ea7c3a27b4dcec9a
SHA1

450accb24ca1cb702b73f1b0f93b14c41c20f2c6
SHA256

932ca841bf64c25359569513760a6900aa18873c94523a65c190433c01a575fe
SHA512

a98377e915938bdd4a6a67e70f0fc918c9dc28a1202bd3a5c53c116dc84021b6ecb603492c77c29ca6140fe66d695e18357497b834b4845b5a0e86ddee93734e
SSDEEP

3072:SGjWSfpLuckyfkMY+BES09JXAnyrZalI+YQ:SGFlpsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBB6AC01-082B-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420778888"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8df8f6edd33d16a5efe5d105740dcf93

SHA1
0c2a26ab8adf12f23dcc02f7db7b20b97f4fd583

SHA256
d863c75db0caba7da69a76f5300d089cb85e448afb3994f24549af3aa7c2160a

SHA512
a1ea70bbc062e373f4b73fb69c32f50aa16edf9ca58e05d741065b8c4ae21680b8cd5cd5d23adf9ba58e4e89007a962138bb917dd89a9e2e6a0220cac16f3419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a83ec916cbf6748f8c2db51113d291ef

SHA1
95b056f55c6f80b8b04d5c008e13493df9ea16a2

SHA256
121adebc6059f4ba3dc26ab32670d7b65cd569bb80dd67ccca1b2ad75fb88580

SHA512
c960cab3f5296e33114c35acb297c76ef020900acc17292aa1b51782c26ade1bbcc6fa3054dd6d83892732c53e309df64b4748f60b9e693a5e65e78720d57a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1a777b0237b89f2f7fdc674dc311b75

SHA1
9fb1f8bcdbe30f6316c0db558d1ed9e93b78bbeb

SHA256
79a7722f86c16cb3c61153e7697d322113ee550d94eb470f24ebd893e5c7771a

SHA512
1c7daf93fa0f0a58a82ce19784eff5aea07c8e7f69d0d79add850a9647d37f8ba808ca479dd5bd427a5f895a4672c4187f0e88f193fd993e19c29d9a8c6a9c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c5b67a0c488c2c856217f396a888dda

SHA1
33777de4dc41db4004e1c90ba60326a80712e6ff

SHA256
c6aeb1a17ccce231d628d9e9ef5d7a6fe60c7da691358515fd0e86455fec72f8

SHA512
c5e280677499cb349f53561d031137dd0dd8981edcdc57c62bc93b2a6b4af15687dbd2e77164d814a85978776ecdd6f44b2ebef68a75a6c2b4c584971b07f305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19888967ec615cac401e6dd65f208ff7

SHA1
7a6475afed6f77c00ed7ae8feebb94aebb15a982

SHA256
93f8f9b68d3cedc19f5ef207aacd3b8b0ad23cdc0389ad77c4cf09d79a5b923d

SHA512
86c19cec721bbd73e6f6064e8acc9e8d7f1492b31ebae2a87bd24bce25ba4af23841a6d4515e899394fa14113f29a180a0f85eccf961a35cfaba39ec946834e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2059660fb042fe6424d56f26a8bed2de

SHA1
2426ac0a15a62b08266e8621bd2924db7c8aeaad

SHA256
16c89ef4fc3fef203202741911580206d0ab22d7d378cd8e9479b302e3e8c49d

SHA512
21c29bb4da2a4e75ba375566e5f433a3bc2626de65d2fd4cd6a6c770ff93748463fa7941605fdd1d9d3776ed8eb399a3471107085182df8047c77eea20d7ff51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
825478f0348d28c5a805a92103b48f89

SHA1
62298e60e8b8f9fc2373db603298af514df1f7b9

SHA256
f5ca4cc62332c1b673d699ea795ae29cf0d29a6c3a3b8be88e013bf3d0865037

SHA512
dfe5005a9b5cbdb140363b8400d21ad0f6a28761a32c5974cb70100909e8b193777a34308e987c6af8b4c39c55c3f3c61d54405aa720138b4734ea4f6ce0bc79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a574e6e3a8ec6c33dc5e1cbb8dae170

SHA1
efc60a39664eef18388253884406800620a7e963

SHA256
caaa9a5f988c223f07682fe82f93d7a4462026475f90923fafd4a970ed2fe310

SHA512
4e0f4c0fbff3a7248fbbee8dcb75e45c2f76e2a678f9621c9933aa59b7a2026d6ed5cc0507427db8596e2f7e3be1c16f8737af8579fd318b9d647ce8c84714f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0de9790111cc494dcc336a692b2be80

SHA1
924d0ff649c11b8c5b857de58da5b5a2fef51a85

SHA256
f356b41954bd7c7be65d8c0138520000421de8e6e990a6ab37a20158aac8ac01

SHA512
50ab37fe7a5364d42c8125ec3fcf8207fb0d14ceeb4dd15d991bb73e07a09d6cc176838e5f9b0c124ab029d49b3082cd9c64cf22731d5aab2430c007a5a0f3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
500d5dcf3c8ade4d2db3698f4e0a5fd3

SHA1
0cd50266102ac6265cf639636f7737b65405dbb1

SHA256
c3553f3f8ac3d93c19ea6ac1fa869a4e3b2dbc324a8c643a79523697d033fa6c

SHA512
1f8465564da71fe7161f57af7e30e75edbb83f058e75a82c3045b14ac7bbf43cc9036e0bf43e6792a503912893c23fbdbc1ec9c252a6049cb934646212a1b5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29afcb16c126db51b440acc0a34e65a

SHA1
dae650bc364843ff564af4883fa92508286c0d58

SHA256
90be7c926abffc8ceef1205d43817a7a2dc74f8b4e82ddd2d51c00266d61a4f6

SHA512
6d4c60833d12fa2226d84f605a332d8b2e2fdb90b2a8d276e8e960eda347e6622c0d985e978c5cdcc0bd936314b3f2b0df9238a3644069c20bca1af058aea4a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
459e6e0c829f801b2f485183723cd197

SHA1
f1649ee2bed2b7b0659c3f2dae2860ab0d756555

SHA256
7a8d10fc68aa8b75ca3b68cc8ed391869230434cc0572aeb1011da160fd56f4a

SHA512
10e4b9d20c952502a2c4107d7934fbff10fe31899fdc879828ab0b6af2a5807bf29082dfdccbeb5130f84a95cfdb5e47adc815a1b86f670ed9f04be7dba27752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4725034204c4a0db0b3a9c44cfa2d28

SHA1
011bccd28e26acb584dd534aa4706b82ba8bdc75

SHA256
4a5282e843c078ef282ada2fb1f7cf2b71692416cad8de1db989df190494d393

SHA512
7fa6235c83a915ade20d97e0fae65fabb112213adfb31817132412272286938b92b92269d870769d166d7bbf5c939687ac751ff1f4ac4a07a7f35a6b4b6a0790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15fd3560b6dc3306bc97ff3a408c58cf

SHA1
77e5dac1242a3ef3fafb0fdf23b775733bfbce87

SHA256
735976c0aa6be923f3131dc78cc92a2deab0b9d1323512f1439967d1647c18c1

SHA512
cb28b99f452bff04188e812ba27ad93ea9ce931222f3b449ad2e8145ed219b312061ded82dac77c92f19a7b63aabfa4a86c6b796d95a2ae55a2489772b6f1edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
824d076da0919c70ef3c3d7d962385d2

SHA1
7324b7777699cf7e65776dacc32cb9a1b3344038

SHA256
970fd5db110ec762908d5d9b0b96c3af9912f9cb0fc297a4dc3f1157fac105a3

SHA512
e88a3a7630ca9768881672ffbf053320a5b0c423efa23262bd62db904d6f4afcbff12026c4cd414dfdcaa0cd974b7b8f53a11781d560d9a0b230d5746fc6f1bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e63ad3d3c8bba86044473d1aa4b2c0de

SHA1
28bae084eefee48d88c88685519cc008534b990d

SHA256
2bb6f22e73ef424027750dba5d15f617724d7b01d773936e2756f86e4eb0f4ca

SHA512
8a578f5148a7b08bd5dd8f0583588ef28fcb77c227634d33cb6d497dfade72b82c42562901dd8d876a8ba3eabd573821d3e03405ecec108616e3f6435eb39d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e523289226f6b9946aef0943ce553ea1

SHA1
b521ebdd70d45baa0706abbefd82e69611e904ea

SHA256
a3b764c65c05c7b0da7a3150ea559afbdb72fc13f94b5cd2ff0db0657020b716

SHA512
280f5884c56c8bab7c98a08944123036e4a0bc261447b212789884bab4b95b93104b8b93e8b7e09e43e769deecaecb9265e89f2c1c5d96bc2f6ca373f3b83ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8f10a30f4c9c93614c9db504f391031

SHA1
85d7c964673d8911a4af9a12260b6744ac641ac5

SHA256
7eedbd2cb9aa79333903a3e6147874afa8acf6c302bdb8d0d38f60a65021a2d7

SHA512
e3bb04f5d6ec29c08c228be7b34d75adf4454e064178c1d09ee5ce551089746d1a45536d748169b513dbde999a7ee0ab1e218805a0e0e2c9f6b013a5fc6a374f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bf0f5a4b7a896dc241c1ea41a21bcac

SHA1
c29046d220172d7125289e75fe6730a6da6318ed

SHA256
d52757d4cd2542f73bc855d6ee2f02efbbc2ab21e2ec2996b699d1c54ae5ab9b

SHA512
a371fad93da0ee4cbf9379a403903e64f8d73b43a929ee2b9a2a967e7580669f23e7df2a2727cd2421fd5d74e4ff9f7393a90f9213e6b80d154a4fa72e7eb0b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab168F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1751.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit