17278318af7980b82f184607b55f092373540abff97d03836ba57c645bf47bf4

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

7ee68d43045f2be150c182ac9452ebd5
SHA1

a6ee0cb7e3a882e2fa0a35499f27c811c372ba00
SHA256

58b9391c7f4412e7773303743798f514d7ecc6f29dc35aa76d7b56641500ac6a
SHA512

ab8795d3087d700665bd2fd9c3a7c8604eee381d24322669802971ae050ab00c3dc72f97ab5a55a0da850ccb4b3cfcc7538f39b984542ae7c5ac95a51cffa3b8
SSDEEP

3072:SWCFkjY8GQINxm2+5yfkMY+BES09JXAnyrZalI+YQ:SWCF6p+xOcsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54946751-09E7-11EF-9B89-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420969331"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2740	2868	iexplore.exe	28
PID 2868 wrote to memory of 2740	2868	iexplore.exe	28
PID 2868 wrote to memory of 2740	2868	iexplore.exe	28
PID 2868 wrote to memory of 2740	2868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daad5dc0921d75218da073b4465eb9ab

SHA1
37685a04ca329b36d0095567c86fa826f06ec261

SHA256
840a6a54d6b76040eb485390a7c303aa0293d5d3ada1b06b99bd33a81f8e761d

SHA512
d8290460d43d98b79dcf361e8c545e174a4868bcaec695b67afbc861bf282e6dedaf92b55e54b0dd190f6f151492b2b09ec52d3efbad3310e71aaf9e315bf69a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8dc0cd829105122d0a09aad1b306c45

SHA1
85ff58ad81797c0a8b2f3038a08895fccab4f534

SHA256
d4118fed58a25ea2a400d0d3450805c858678b96b7772f3ef21aef53f7ee5b4d

SHA512
077a1d4d66bbd9c28121eb3af0e3dd0b88a8048739b9a28821ce8d2ae1e2ea97475d0679b5ed6358c927425920b2e56907f75d5a1dcdb28eaf20d2ed2ab4d01e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90a6e49410f235748253840821c0c691

SHA1
d3bb8ed8eda6bb6cfb353c7d751661b46cb2f1dc

SHA256
0e600502710306134e7a4243f26eed11de1504827371c284d0b5ee8e3ef7704f

SHA512
87abef7f4d0b0adb8cf648eb93572947da0aece118bdbca3ee271834babf0e6e8cc5363bbe7a3dcf9407cafa03e6209ad746e4181295420ddea28d559227ecf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b19b9433a287a56ccf968a1b47ebdc21

SHA1
3466a15673401f226c80eb15bec981f66a44ccde

SHA256
7e05ddb0114f017a06eaec6b5d3af218cc8773e61d7cd980d1e1f81b0d4bb3c4

SHA512
08c4b6bb0063e153b9e4b875c0e9b04409cf7c56a7a999d604e52f29f9c1bb806536dbd5a0a772b96e5b94ee38bef12dbbb23e18e76dd25764e3f378419914e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89a35092d05c7440dffca782fd434500

SHA1
7bea88f380417709dc850a6868863522e25fcc2c

SHA256
18ec1abee40d978f8b46131801c93a6bd30886bddd45f2890aa425e3249bbad1

SHA512
18b8800dee5448141efc7e88134bea413a9e1643b1e0e9269cf4081ee1da1fadca1cef5aa2413815987b772c96123910f5ec0de79be6091bf72817c40d7b7ff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80af0892b378c65618a63abfac7efbb9

SHA1
3d2fa2500e43489a0122d3d6231ece08490eb05e

SHA256
afb428cab2b0a87e4926cc51f169ed745c7a7a8ac9452132b8a3205191bb87fa

SHA512
171e18232aacaa1c4181e2e0fe998896a02861f9aecb0e7d810a1aa35868d8cf67711a3ed2d2d9a24026b1082f954a52184acdf5415751af11f7627bf67405b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99633f1b2e159f3554398fd81640ef1e

SHA1
d3f7164a916f58fe981e4fcb98988968b3575bf9

SHA256
db6daaf433eb0e20f5e3fa48b0f0c0931b463b546b4ecc5c9deb5ceab2b4b0e9

SHA512
e908fe39875ab2c948fd366dcedc63d4b534da5b5e0712d41c8a2147f912187e3ec704208c0d7671a4633705767d2bdfc95668bbaa48eb83b5461748a3510abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2a34a55e121a015487e6eccc26f5cf3

SHA1
048673286280d67c4d62bf3f69b498c5c7126484

SHA256
63a493848c9ead72b22aa14b30dd59e3ffe2baaee01df07d4efe156600460ec4

SHA512
d459dae83a9b52d66c9fdd875046c73c733be08c921850089cc50c447bf2a6e41636a78363fbaec2d6999010d9d13419927299cb1cb4fd9d66ff1561553b033c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1d9331d5f60a96e5994f5b3e1c61f67

SHA1
d3c63fad5573043bc50e848fe63d3d5c9fad70bf

SHA256
c38819aa1e422cd224a5c8262b9c50e87fd9adc2da122253586375b492efad28

SHA512
6f06367135914250cd2f12688db61e39f9751dc28f74f44deb3221fc4f4210caa7c9c397eec4c0c1326b731a95bb73f46eff83d2e68fb44d1d9129788b0bb51a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b67825aa9fc7e2d2454f6b10dc562c9

SHA1
8c97af7298687454694e00d2118fec3af4a8ce16

SHA256
e05f5af45b72c620d50d2cebaef18c53413f0eeca3f08f5846584d1315465052

SHA512
fd7db699fca9b4a730a5e0aff3866ed3215bfb4ac07bd44c9b12fd81fc8fcf50586c38b97f899876c4199802cf5c8a2475ad10f23af6ebcc5c6534c182083fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9c9c92a17642d25ef820016c9b0942

SHA1
dd521ebd0c4bb426fd5d9539c47398bf9479d37d

SHA256
9893aab177fd06db10620646d7fb398f1c670ac07c666ae2c090a944b4d309fa

SHA512
c40767a6375e417a10aabef64f4e35c73278493d2c0033f6005430340ed7a7120f5540fa614f184287014af79c57bb72b85b72f386202f955a12e7975c63f78e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307536a4f139feacf665082f3d481257

SHA1
21ccd026e14ed5ba67f296546db2e5490e781fff

SHA256
13e46d6b9a7f82f6c01c28d1e2b2dd64b867eb571cdfa4336892d8b3c19e75fd

SHA512
dab3998896673f68f5bb9d0ed32d216536572649a852dc8541b5e5eb00bb01f8bb357e171bfc368dede10b38353e8073aec06658e0edd6c1a041b9832fd76b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65d4b65cb1fa27e32fbb8d8c97402555

SHA1
93a280abe3848e0888edd87604869d0fb0ff77fb

SHA256
40dd6c588c7a1fb53c65df0a0c69e7d51dc9ccc47bd1711f6419b61a329435f9

SHA512
f054beb8c4347b73948fded23e180c4210c48db5394a64618ffc9fb0f5d071b3e8686b0da0312ce693a03bea989061bc7bc76d8452dd2d6f5a8bd05566fa5b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d4cabf1efb6b34871ab5ee51e2fe83a

SHA1
44f14e9b567f6ca0e9f66778e1b583904702ee81

SHA256
0f88c12a641b454187552c02c0a411ea2f827f7783651657ad50fca818db6af1

SHA512
4f9b3d04aaaa9c2092a3703c55f7a6ef03e7616ade2e0dbbc0aacee3e933249bfc1f573beacb61d0a905ddd4fb25650b1f80dc7d82f7ac448769c5752a62a6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6420f1c64d10ee02bf663fffe40a3619

SHA1
7218b74a46833d6ad1b9aac86eb281f379ab7461

SHA256
d25bc5af5e9ce6c3ad44ec07ff11de6fe2f7c06acc755e5ef53534af82659384

SHA512
e2df348ac50165066490d4abf7d0a694181bd5b970c85b7c71ca468304852c4cebccb87612f1306e69796fe3acdaab1efc56c8b401c44b667189ff09ca34602b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97262640c7db20ca6e4f8e468ec27cc1

SHA1
f5a8511377fc169fe65c0a06e07fd680cbf17da6

SHA256
1ecefef065b3c74845919f76eb556ba6d14c2140266318800f457c9d7f34f2df

SHA512
1b4d3b9d377f44404c7bd465a797ddba1dda8fab09ada5343f18fcb11ca38d28c614f44ac67bd0da6fd7989de24252d579132c00b94ece4ed5f5926007ec8a8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f6b12346f37d5989502f88c88fbb1f

SHA1
b8150b07a3611881ac47d409406af6d5f0106c7e

SHA256
3ddc53927a402c5dabd92e79e4e179bc36b133d48f9bde2b6823a5b60b16d5db

SHA512
77ddd578a35984302e0a53d363b106eeae5cd2dae9ab932da633c033a2e9421c6ca8acc554cd5718e9e01c24252b15b67350ee10b2a30533e3d18dfaee3ac293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbc1e90499cda3ba8a2dc975d22a7255

SHA1
80e557db8af6a55ce3740a184c59779529e29593

SHA256
7e97f633cf37607f14e31dcdf2514eb4b8a60f0564333e8f1996771377404db4

SHA512
588b249e18d016a7b2d0625ad5d12302a53ce8441eddb4d3c99c2e218ae58660d5aa4cb661551a785364c2d13a92db5820ad648536b52ee04747ad019e6a23b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7efaef60fa20c7144f15c3d984d34d17

SHA1
360d3738c509f9a4c560dc5503b5011e345c8130

SHA256
25bb89a335c54b47044fa07d88c03744ed566de80105faa31673b9bd59e9abf1

SHA512
766b1224a4f22397e15b6e33a9b8fcb5bf52da497d9db32e2901eb8a82f7ba67352395f86f99231425d5bfa968ce331a8894ad50fc7577b8aaf09ce61f3aaa85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1122.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11F4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit