1ae795257d03f9721d1a1e3896f60f84c40a6dd34e9e595d4d874ef56b0d63af

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

e2c07396245dca8571dc1e1ff3fff156
SHA1

d7b52abb543804a6f76e74b6952b98a4048c5323
SHA256

d9f9c9bc1c42ea8f98bc5b6b71a9b8b47a1e543d0c219122de54980de792cfde
SHA512

272dd7b9f470268e46d517654df42d3e47e8b4040d6c25816275a30d3075700f10495c89d3fd787b9778be4330c8828ad3ebc9287dc74186fb19889d7481dc66
SSDEEP

3072:SmzTcOLvnMIyfkMY+BES09JXAnyrZalI+YQ:SmfAFsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E7B3E21-0A6E-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421027437"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
996	iexplore.exe
996	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28
PID 996 wrote to memory of 2532	996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1574703cc26d9e16530e7e31160d504e

SHA1
913d0f08711b7de71a797056663547914704d17f

SHA256
7740f398a100dcd831d3e572e72713f614b0431c24995aee44e2d3822562e4d3

SHA512
2407692b02a4cb10f954a977573639768e56e364bfcf6da3d1d505f619a959135a3cf2929b757aaf986c7a3db12b70ace5a6144fe57021b6942b338e986c298f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cd86ff7f9bd578da7a708b933ff242f

SHA1
8f72443f887d4276376bac91fdcbdf829e8890e7

SHA256
025c25168f3f33220fa804170437a347dc41727077dbd974f525d739dbbf1f65

SHA512
f2a9c382c9ba6ffeb248c709f0d5f9b31f9e7e623865bc3f159831b17c1dbba22a1662eda1b28072ac4b2908bddd8281703068f60a574d777175ae98f5bc3211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11593e53b444e8fba949d2ea50c0bcaa

SHA1
ff5d9c7e1f83e2b8377aec9be62b66baa0d5ab34

SHA256
ab8705f0f1f8a4363b483c0cd6ca53f2202c1c6166ad7f3b938d2870e660b480

SHA512
d183841cddbef3b67344ea09e488926a9b4d270a13dc2595273c743ae59dee427d83eb7b9c9a7412925ba1c8d08e97fb1649e4eb97dbbded71c401bd8e3bfd7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d4d9c71e20a0ff20e9ce81c510241dc

SHA1
f45fdf210ccd57d58f1e131218ae130ce4a21fb5

SHA256
d2667077295e466179474a0a0dca1a84ae72a1f76706e86ba3af26bd78730a9c

SHA512
3af749cb45dd1512ad21dadede6f460f5f50b308adef1b78a21d16ad121224049f4cb1976762e407b88391de9b67c138160ff5bad0d430fabd04e14b44b7b3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eae8766011c468d0877b8f2654e94fe6

SHA1
49842646d296537924991719843462a88569e117

SHA256
7585b031266b13dac6e89e34d5778a96128b480e31e8990e07c918ed936ac51d

SHA512
8b919bd4ae2928e7bca58449cd653c4a95fe8eeffa3a10fa39c42f1c72f43ea2a4f70d71978be18a0aee7275a947ea5fef11c2e32c0ba793975e24794ebabe43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
757c352dfd8c511ad916dff48df793e8

SHA1
71c6be4d832deac0f4bd1e95bf152069578881ef

SHA256
7ca3adbcdbe92e55dfe77c157ce807dd3b2d873ac8920d6fff459dd764b167d4

SHA512
e8f3e1e9a2a1a037f8526715c6c4ca3874b1076dc01c43c095e40307c26b773a6f005a5f44d04717a691cc8884918ba1ceedc5053021aa85adfd39bd14407d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cca35ba7087c1030a4a25b00b0d9764

SHA1
9b717cda13d77a7093cb97ed235cb472d3addd24

SHA256
2c8e7988ebc14b746448ad88541f8d3d261ed112918a214091f564ae52ec0378

SHA512
3ed71c6b8d38702b20aa07e6e0b269823cac41e6b35d62affe23c252617060b39ac41619a28145cb94e3ed9df9c5a72f3ec17e0391174c8251c215598a98a644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0717a901ec4c5bc544c580b04b27db4

SHA1
0f213c7fdcc43638985b42e536ddfffb2bb3633f

SHA256
29967183fb673c3d964a9ba0f5c9369814e050f539d35c2348bfbcb8d44d0754

SHA512
73534126c01a63784dc1c78e91496a3e59267ebc5d21f7413df32fcc15235767696e22b33727e5271a17aad8e76c387aa4ef53dc03a4be6d109c5cf634d7e49b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f535bcc75042e25982bad11d252cb648

SHA1
55a44a10aa1be085ed1aa37d9f734aaadb221b9d

SHA256
1b614b7829cf31e8f2f6781ba9bbc3c13fcebe92e66d84e04a82c3d63c0aabd1

SHA512
d55d2f13ce7f5d48dc9b3f15ca73627963f9013bcc880999d30b06bafcd43548aa5c7a61f7cab016fbdd729894335e70126858ad03cd0517d83b390fe2f28bdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9906474ce5abe6ffb1b328190295f2a0

SHA1
2e50166be21211ce94a2cdc00f5d5c49bafb9515

SHA256
879ab24a1a42ebe9bd19763fbefa6dce8afe0b16b921a8f04c8c61aeb4d6fdba

SHA512
9907ee5eb7e85979f4e2067b852a3784dc9fd6928228e498aa2a97feae96ebd17ad46a3b62ba9197aa3fdb7ab09555bba054c30c0584534ab25b8117c6e601a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d468cee32cc19c1861491f880c8311

SHA1
e7b0c6515ea8e58a96d7853aef508ef76f162606

SHA256
872aa49c92b21734d0c3258539ba3e811c7240330fb4104d6f2c551aba10dab4

SHA512
3a115e4dba7f55bda6610155538400816b7fc1cd2bc32162ac52d458f810e1b7901ec3629a80d9a45b5be434568ded16d90548901afc0bccfaafdd712827de04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c30d29a539e43d48c1074938c833fdf

SHA1
477b04aaaece075f79d3c5e86cb993cadbc25fea

SHA256
e0ef86c1c000c783ecc407ac54aeca04311a856122a447b625c2febb02be7d66

SHA512
84872b7ede0c1742b326c83ad27b52ece172cd62761241be8576aac04c106a6dee52860613f14823b63c065c596b1d6dc5b98ea69367165bece7cddf8c980a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d28404a042454c888e0728200a08514

SHA1
ae7965b3c986aefda6acf95ff079e0033a778eea

SHA256
ed2b82e6fe7acbcceed3b8890c4411c252c07b7a564b37bdcfa49b5623a3714c

SHA512
62e07ef4002e8956aab8fdd4ad1f2b0324492dbe44c8ee5fce1a949b5b2dc098d74385f6d9f269204b72e71554669115ef0b0cb47144b04eea8f7ce2c4fd9cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
043ee353efec0c4b327ed2d3b5a77a63

SHA1
f9ead86d4d24f1ba99d3b38c2cc7c77424b2c877

SHA256
22400f96f0caf089d49cca6b8d66f2675d41243a82af99dec43480e8a3437591

SHA512
a03c3c0182d0584b658c4d05f737b72933c70226bdde37ca9ee6bd3447ea391a43af9c4432110bfe6f1f2da6b3bb378c78bf6093d22dc805b646b04b1c675759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8285b877d2e069c5b9ece25059fd3230

SHA1
d3a4975225c937ce06cefaa85f6548b56bc3b423

SHA256
d9fbd6c24dc70eb9bcff9af4f10d6d74f7e5a9809cf825915e0703c16f0a0a11

SHA512
4db8da1714320980c1bda6e1f2337906a117ead79599c19a73688f7f70737f5c43e7e7eae8e006026f4342c5f8b9676a935f08bff52a5762dcaf64e62a038db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e579f18c548dc3b4f90c53802bef4d

SHA1
b7efb576e9a04fd886f035bdeb74a90650529cf4

SHA256
52d1161ab2b96f274774b12cb0293e6f8bebddddfff47f615f7cde12617285ce

SHA512
0cccbe1e1f7b724529b511e63f114664de73c0cac59dec5f4d688ff0b045192792ca73098c736f38a369c25832c94942ce5174518d08e1d998e7bde729e3fc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0e9a3f5d42039aa30c7488461eeff1c

SHA1
d8cdcb1e43db9e2dedbb2bf2340f7a625e007395

SHA256
c267416c721d4318629cb754152139aa6c9d593addc4e077603ff221497e6f8d

SHA512
7c038f72e86f276e8817c7be2a73735005e7867d69bef07d5d005f35a9ecea5646e9d28ee53a6e3978f2172d3eb4d02122cb318028972bbdd6f1b7949264bd06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9e829f912a9c580f068b1dfd808b9f2

SHA1
484e24027579cf49ed38a8b28ff5492805dd562d

SHA256
fa055e40afad4a6718d1b0eab79cf792369199c9b8892678a52dc5230912ee88

SHA512
b73420badd7b14aa54b05fad0b9d0617ee09886e75728c6c11b76151435bd0aa28e709a7711628b541b0559b953a0a8481d64d83afa8345d9f3d08e5c7d30dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96e71a783f1c17dafeb3e5e52c539e34

SHA1
fdaf89219ed059fc84942b855063dc44c676e46e

SHA256
0acc8fb997cf6385272d0c21b10eeffc88c6c143053aa54d1f4c5c6533981a03

SHA512
2635488f17ac05d7968c57f77f37a3ebd18084ddf619d7ec4d5af070cb55d5c48fd2e2e493d77077eaeec66e108f59b09a8a1c14286df338f535cd5c8f0918af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab280C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28C9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28ED.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit