54b2a803a3dbfcf95d2f3c3e4137f519aa7040c5f67271e651ed33da8923ddc6

Analysis

max time kernel
136s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

444f70a154037477118e88863f8aa62b
SHA1

a297d5bd7970394c3cc28495491656587c521c0b
SHA256

397b4a5282514bc52264a5098d739353f2819750b570de1f2260fc4725df5fe3
SHA512

03df2c3d8bfe0b6612e084aa08fa9aad8b305d6d9902e3b017b144a3fdf105fb9afe7ba6c0ea037db7dbdd95f587df8759e77a133b21f0f41a2946523d2b0e52
SSDEEP

3072:S+evbBEo7EIv2yfkMY+BES09JXAnyrZalI+YQ:S+eWUbsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420973414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5AFFBC1-09F0-11EF-AFF6-E61A8C993A67} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16d2520a9971181edcc79c04955e1b88

SHA1
453796c35bbd4342e9657f25a4a3aaf58afbfe06

SHA256
98ac586cb935cc3b6b7ba39ce7c50f14cf82d3a0a438b9eebe4040af3b478a32

SHA512
aaea27428d78ccdd60f4249229a6e183760b57a88f5c1dea71621dc6dc78f86e9e068b7debe276c582cda4a34d12e9a8385ade9c075791df373442e1d4b33dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43258bc13a87adb8840005e354929b52

SHA1
716f046b03a1f028a0a11b96017ac8ad9e8e95d9

SHA256
baec70053ec8a3abe67aa230e67b3b2fd2a00efa38478f9ff2c2bc5ce0907f93

SHA512
3598da3c1eb33f332701d051cef14d2ac8361107f47a403082653785f1c9bca974263051d5683be3132bba74e47b4214fb6acadca0dad4bcd0914c3bebf0e1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27bd57837b9e8de502a53c415e24ed29

SHA1
81487321217c37e8ffc68281012455feb9915ca2

SHA256
da7ac932ae311c37bd4a603851387e48b1d0d0e9f7196eadc88db6e615e51ce7

SHA512
84613ce315c2c4ca8423bf4abdb36764065068046222dffe2d3520a23b93b52dbf9795d47b81546ec936f673da261631ac4fc62928c7eed358957ba6304c6f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b4ddeb281c6130681e8498019c92fd

SHA1
e5feab162fefd83334ef39e538a04792aacbb143

SHA256
95c9c24b7e9497b52808163270793b56b81f5f7c9957aadcd2fb7bdac55ca891

SHA512
2cb3196acc36e8014c2ab6ee644c0fd2aac6228d1ef40b3abafefae0012c0e6ceff894625076ef469eacc5d474424e01f04b997a68fd8d848773e60731490108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03a56d0ca752293ae119c0eb84b7fdc2

SHA1
ddd7318b203a17f2d542fb9c806ad8fd11883fe2

SHA256
62a7569a00bf1eba5382e38b4651d4679d500d57df771a41f8d0c3e5a920261e

SHA512
6f8eb6be0f47d5eccab8837a4dd58e2f66ba405ce4e28ed088712dcb7fd56db6e423b7a88af78715206535935c4ccdb27bc3e22a914c844da5dd849480a5e357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41093c05a8939ea215194e7b6e766825

SHA1
1450b3e9791f47f3df9d8b1982544cdb8d8b4e96

SHA256
792765a38f8a512fde39af0a0113bcd3efdb5b3dec88efc84768417de0237a89

SHA512
7f12d272c523aa3d8b7370d6991fe0c25c1fc18a82b7fdc7343a2736012de980c7287d6435b3ab470084d4ae661acc5b16ab9d721bb7687ca53a3d6e64b177e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6326e73c42d990562e50a85654063596

SHA1
e1def53c44c4c6b419b457ffb895fd57df2126cb

SHA256
e5683a64ffd1e7af95c618203d42f6ed3afadd9439a9b8e3f2dd229afe6408bb

SHA512
23cb985b8874ed2c49d776562993f188080c0d189732dcd630562e071dc7af60973775c67b000035f1c37222bc299e575c246dd68d0eead805a2ebe44b56fbb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e4a0c119fe7b495d133afbba971cfb9

SHA1
6f813d77da8238d33aeda4fbb2743a8684a3f8df

SHA256
5b48b11646d1f51ff6d4240abac36594e67578e0d9c27b47b47e9fb4778ee4f3

SHA512
6a53ef01e2c643181e28b1fd6f26c4d4cbb63fc821ff03f051448b81738ceef40e9b476ef8e0063c08f59c00f23c1ba32a64f86646d14b9d5c49b39ec94a4102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d414bf6fb9e45e96cc6011a7a148b625

SHA1
3416a3bf0f89fda1e23ec749f2233795c5b7b467

SHA256
0e4360210bf30f7c38e22924efddad10036abd2a8ab36c8164dc66f50b98473d

SHA512
ca80a764bb897732fff8cc3c35b1524bc6fc36a0ba4be9ba6016fe55705c32afa404403cd7f0b07135c4d89e5cc2e15c4e4d81b68cc9d1a7892106635e3f218f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d005eb1532a2f640f9cddf2f3e13ac0e

SHA1
bab48ee5bdbeb4224762210229539f3ff11ad63d

SHA256
ffad9d26a59bfcf1de25b97a32b7063ad87c0a56b5604ce7a05ceb4945ba27d9

SHA512
635f981b8aedb9929608694ab25c89c1d03ee6d0d490301f2a7225081c055f1a9967abe5b70bc8841306c9ce98a75eb93741251d90e09e928cb785a1a2c9f2d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a80b10240cb84735be2b8788fb3517d

SHA1
430381bc4a2cb8faf264b894852766788dadd36e

SHA256
1d6e8f767b2633d26bd8e8f7ba0d4fd83d017a4dbf1364e1e21cf0b44d8cfb48

SHA512
a9ed5f6185d245aeb21ae817794a5e872037e060350374c75ccf7fed9ea1c07214f0b2ee47d4598b3f5040aded27a5979e6cabab1bfc876c0cdba4aee07e6ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11546cc20baca30d0513587a06c6ca9a

SHA1
ad9be8e511cf24ffb7a826ba59df51a51641c9f0

SHA256
8df95a1eff2fa7be965031c6612f28cc58324cb1c1f927e44587cd0f874499ad

SHA512
d711e97308fd2142d17b5f0210b85db3ca27daf4cc0799c8bbeb34123ec273955ba3f45511391f8d5b1a4112e2d7c958827da5f1143270dad39369e9f374c0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c678c2724a40849c0748daacdd0784

SHA1
9ab1b88deed8cb28befc6fa91b85868026dc8029

SHA256
47920c736f942914efb96f100e3f97b582226891456f9b1ab607fcee7dd586fc

SHA512
06695b7963fe4780258372a4e661d105042cb35bb4b6472aef2345cc718149d2d9726d6ee22e7767e83b9631b8d48ae8694082af381bdfa9527ed9d82fdaa8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce524b91ac704abf6d5d57bef40c8b9c

SHA1
9a5ec3d85a5679d3e7b083680f270d8f22d95e25

SHA256
55af80424e43230fb816573599f3fb7a704cce341b5b1db313561a7632ed59d9

SHA512
0409dc836bb2924398a04388918172794abe21aa3072f09380f28a09b193493514b07681f2216673741e89db22930a3aeebc51b70aa7605194c2f6cbff61602b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82a8b6cb885f78a3402ad27ab5526587

SHA1
664d9136e72387b4ebde9fa51edf7d6d210ab236

SHA256
0446dba982484548dc8e07aee850aa333be3f296bb158e0d0d36f6e9e5493615

SHA512
90970e6d82bb47d57256e6c511c2caf861d1e7ab2e3b8bae264f26e4e403c8936be8823856397b076896e368f03a8347ac8c5d792aa2a5764aced21b2f3e9817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c30f24e5a2d9beba486ff6b47887b9a

SHA1
c63090fff7c9bfd8548ca6fc08f04b84a6fefc30

SHA256
69ff703ddc8f3e86c1629f011ebab423fc612936ebd80fa42a0699d8e2b06565

SHA512
91f77bf69dd932cb31134ed01a9f21309b6851d3829824ccb50193115336ec99ec0fa69b7db099bdbe016d618d20478f0e92e5e92d6b7c8df9bca952dd04a4ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbfe4860233502872a8b23a15f978e09

SHA1
38f023c49298ce21ca819240b5c5f0862a9be5f2

SHA256
f4cd14bcb5af7249bb0c1811602d1c799b0633aa4a93be85eb0337808d92aa52

SHA512
b9adf96a33a61842836bff6bd8cd9107f1e7820149b3196727c0c05122b30029cd0a8d13a1ad39bbdcdcc94db4c396fadf8fb43b24f7a5887cc5e25a0564a6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4885df1075e24e7b88b432429713c6a2

SHA1
c3e9583789319569f88e66a89f6b4994c3ab1320

SHA256
4c86c4569e9a98e7d1f2fbf12eb0b4f53cbefc76b55f741b25564c916bff1e55

SHA512
e6bb40a6a3758b2217c16558fd2733c0212e0dac00856633626e26cee37995137de310058bb21ac5edcb158cf597bd2c8f07af80dd06097db696b489aaf2a956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ccf8a7a00865ff61bb9b21f2b6d4a7e

SHA1
dba5ec6199ccfd0605f6a83f9b62105d280431e5

SHA256
5f4a46041479d29448f69c6151e405853cca6028408853e22e8be898f9d7ffcc

SHA512
861949b3117acd2b2e4fb717c8a8f5e71554de208ee52c97a405e48b3241235ac28e693e2a039e40c60e972d7951fd3b031019b4b737e3dd194b5bce80f18a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81EC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82EA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar832D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit