2d0a1f3e2fa9919c55b0b44d89ba38829a5a6626ecb96b91a93d3af511f474ae

Analysis

max time kernel
136s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

41KB
MD5

91aa16a3a1edaa20d7b40c41df50622d
SHA1

dcdcaac3c9ee6530960e9830274d86ef70fa1784
SHA256

725eac4274b5ccfffa8e7ad7cb1d85b6e37dd6e9149b275be6230cbe22c2f68a
SHA512

535c02d01e4fe2ef2370cc5ff70b399f397a83010bf55edb06a7f377f28c54b10a5fcffc8bfbbe97e3a4d60d6994f9087fbf416f9f9808f99d3805ebed112edc
SSDEEP

768:Semh0OdBcM8K+ICK75AuCSBc3Z8vfFk+ho8KuGJ+reXhGsj+cMs/tYj+f2rKKfCv:SemSyj8tJK75RBc3Z8vfFk+ho8KuGJ+u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420956409"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b212d056dbe5383350ea85250ff52d3ee9a89ce3feb4f8315c83490efff4447c000000000e8000000002000020000000536dee9a26e94d40039dad105a7dfb3e154483e59ca7a68513bf7deb30f2d76c90000000495ab460fa3b18f38043b9fc0a197cd15717f09e460a970700afc3cc57c73db988546086b12d56155df2ff42a473e580ffec4c66fc296a377e6fddcc2aa44dddb2f44959d4a20c8e75034ad8eb9ba969bcd88ee7a295af8b4ae60093c3dc203c84730fccd43ae264e6d6f19be2d1c408c9352e1ade2d702ff3b8e26d65258a8ec2792431bb83cf01e201aa748f336732400000000e360eb1d0d35adc2598a52ffac5953a9f85d184b5727b4ad811329b14f39fd4013865ad466705f18dbeac2ce7aca371ed5637f14b8f2157e7e89039ee51f704	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E7B86B1-09C9-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000bf6ddfa79991b352b7a667c63f751a0d504b0e51537ee28213a943ad4b07a817000000000e8000000002000020000000b2f8195b840bb3bd2bfe789447826fcafd75af5289669a954c66b7dde6fd9824200000005e190219f3d0e668a4cf3508395430455779532c0857e8e792756e4aa784af9340000000c1b19daf5270eb94ccb3dc02eb64aeee3cf03ce15b7d336f2de2c92b69a97c6e7a53a4fbad0dfba1460dfe713765d9b9242411f114541dba72e10cb400c01e5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305eca51d69dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28
PID 2844 wrote to memory of 2136	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c43e62b2b933408f512d21518ec663

SHA1
57ae7b0ebebdbceae51b91bf1af08bf9bb11490e

SHA256
b6695061d5811d58ccabe9175bae0ee7fc0f3d267afafe630d0d746155e7e54a

SHA512
c735da2e329df08b5317eefeb204180ef679e3654db581181860f2fea1705aab93456ba544c79ac4599db37c97b677fde4b3471528fad3582b802b40d128df9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1b2f9857dcb9a7d235d88d27b2fd090

SHA1
2b40c39981595333813ca36b93f53364641d3b97

SHA256
d777bb1993e65b830c5d6ea28d7f4178431b765dcd14f807c25b462a1b9d1b3c

SHA512
ba7c052ec8d6c20e43e919d4b97af4c321bf7c7b692137e30676d275a870d75c92a41cd36099100197d5d19faa74a5ddac3cc209539e409d0b2344078649d9ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ba4dedee7f3d94d7e1ef255f5b307d

SHA1
70f11ac423631ace9c0547bcc3bc687d9d846196

SHA256
0ac8859517bb267488b30d53b8c2a1a7e358d9d5d29ba8b69bcfeca88f299925

SHA512
7217856eea472c61e916c00dd9e0670e688b9e8d632614bd0a812f95ad8e58a13e88922ddeddf6861636386d019d9b58cdc5ad90ed73ce70d95e2e62eba40618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
291ec9fe893345ebcf0b20ffee95a96d

SHA1
8e66f792327caac0dafa839c6b17a32f33eecf99

SHA256
982280e3a47e459936aa2b38e964bb668d070534bf3abf90b60cc2c44e4d3078

SHA512
03e667b9881f2107375c8ccacc9a0ce735f935ed7f67dad7bc5e48999fc691bd26f0695bd6284480a96b314e123560d4ce6685f564ab412a01b335b532652449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c125d4da221ed9556d3a7dc993eafea5

SHA1
e6e2c3268c63d2a419872889ec58b88d9237f6f8

SHA256
af70493aa30816aee3a77606014699a873c03e2c6dca6417bd112ad7f5b09aa0

SHA512
0769a11e347618b242b01ab4675fc80cea5ae275dda19aa7034fa74022491f122375caa942212e2b4683ef0e1200614b3a41e8c9a62b077a1e577adb679264f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d8a84c83f012facf66000390c7c1b7

SHA1
53a995101526fecbe7f0f880ea04c24d103aa241

SHA256
0cbf0329c7061b6d1c472a1d2239770646e50274a2d27652875a057ff9456b17

SHA512
6a54a7a086ae2cfd136d4302229210432b78455e007f4bb3ed4c984a139109069769b4c70e36f0c3313c8e59598a8752e2fe14dce881bb4ceece91ce1817b94a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59db1c966eae25249a9b24d2a95e324a

SHA1
460cfd36c057edc0e9f60cfcb3e38b28a28df351

SHA256
11426ce4edd35cba133eb5757959e5acd2f5b2c0fbf3ceb9bcfdaa72b267572a

SHA512
b6262dbfb8e8b8538305f0db1e9c6f86a1dea2c2a9d3ab7bca8528441bf6499678749ea4010959c4fde0f6e0f49dd76cd36e3ab98d88b98cb919ef16e81f7744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b1bb71bbdf57f46c0673d1622e45ea

SHA1
77359ea879e340989bc055c58c854d54fe6ae975

SHA256
00118d1966382d4a93ecc2c9932cc84ba906ca2e3ac2ddf9d8f53ee0f7e50783

SHA512
41d0e930aee9b82bcb991004da408b534d96bd28139755293d2af225a362a0f1b4f030a78a38f71f3f1e864bd52db88e3e77a26d483324f55db31047670a4716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
651f0c809ed1abfa8ca99bb3401d011f

SHA1
b47265b6b12b092d6523e608674096a0cbf9e61d

SHA256
0f3f8f2924c8501a1c71b8e92b6003decc9dba99c303fcebb5ce85431d99ecf7

SHA512
81e434c4e9dd8a1c6fca4c793b92a06a200141c8f0f0bade679ab23755256c59bfcc2da849fecf5fa78432412b158a451b7d342de2b8316dc9480b5ace487682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab23392b31e79e9d59e334debd02ee1

SHA1
b59dfb24ed4695d4cf443c4e4b6899f7d9e09465

SHA256
e85a3a3f3c6b419cccd2b3e4feeb7e5b03074b159a10b9e52ccd49d3b9be2c52

SHA512
806a678ac20429fe28b72cbb1f2305222b336ce26d8bf4f22f3ddfae5e3565c9deec002bcd7508c66228b1218499be35f5c90bd428a579fbb4313e8635f72668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6d77e1d9d60efbeb72be7149a318116

SHA1
ced8bd0aaf437ca599abc63b42f3de0c759a39fa

SHA256
59122351fbf507ba773396c13298f7969043481fd5e6336889f882fd141ad5b2

SHA512
5f671ab0567815b081f570631161d34d25f306bf60c2d68de3c7b9c70dfc1ec396e4caf70b7e00a9fa6e19721f1e38d280bb612dd040173618bd3e7a5dc4426d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3984baf3834fc7fa6443eb03f76cd57

SHA1
8818fcb02e13a18693bf035eadfc3100cc85fa20

SHA256
c26256e7a148b1804900e632851cecd7bc195989977a4498a448f47393f31ee5

SHA512
71d798fedc07e42274629fe9cb19b73770d71e133c87189d48ca806486b96ee7f7d9807310a4cca23d64d17fd2603b8fbff20bdc8be1893d50772ea43d86468e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d92212cbde6f57b909d82f13e480019d

SHA1
7db6c8fe0d06073d0d168037367c31d0e8ce80a3

SHA256
9d2fe8fadf5bc8b6d9e85cc92e06c3535c7e816124c87a902028120973af0278

SHA512
84ffc973f18d37af9d0cd54b16fde987327639164dac4188e64ed051099e40acd778f5c7c9648d7d94cfc718961d08629827f00cba8b681eb83338848a2c5d2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CF5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DC7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit