135aa8cda4f6a8876941ffa09fe259804a38034af25dcebde97a61de03eb5bf7

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

dc13e0d4cd69555c5bee880d5b3171ff
SHA1

777d4bc7ad94c24fa62c60be6002ec6fd644ae85
SHA256

2b8cef87748118b162f9ad423bee05224da0025e00fd1cdd886dfb35a09d4a04
SHA512

933e755a2eb0c65d4b589ec09819235e3dadf6d52b1ac7da834d891066e60ebb8685162cb9c73abf6ab37a1eed19d8af97cf550ee6225a6e6e29e1378e6d5644
SSDEEP

3072:SsFiBipA5JgyfkMY+BES09JXAnyrZalI+YQ:Ssn0dsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7B93421-0A11-11EF-9ED8-52FE85537310} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420987563"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea19dcbf1ecc673bd7ffb780559f2448

SHA1
dcecf5cebf4c1305277844b71aaaaa06650e1cce

SHA256
1dacf084e032203b0f61962a1e402b99287cee0272b61f51a589fd72036e0dc4

SHA512
d534662fcf2d542a2622a54c4af418f191b05c151fd80856b65d0acc9f484ee0aba9e2da2e433b04f21e9102f5e74034d8543e19440a54263b0d3bc0663718da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddf31665c313b7364ae2d684571e7511

SHA1
772dc488dc4ac38259690b5edadea683350c8448

SHA256
28ad2db0a5805504d09d68e25cae398d9d8cb22986e57a86c7a169b2cd60828b

SHA512
56bdfa7f7e1897e2f68bd72fb7d1be6b4987b88d7ed5567207acea0df7a281d5c99c1e35a1ae4ea60c0083099784075041557b84110502d7ebf2f0884bc0ede0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3a186bde5b0fc00810693acdc35a27

SHA1
d500f234e192c06a9fedcbc1a831d50b8c9b7ea3

SHA256
02d8d62c1141d382138f2977827a170d5e9bffa1549e98831ce770892ac0fde2

SHA512
31f1e058268406a4219b29c966ba4864ee39184c155c27fad05cdde2450f2063270ece34442fc22b4b42849be1e193e2657d6c0d2d30d298a02591d92fb267d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c79430c82d3bd1a330b0100ccfe82e49

SHA1
2c89a06126efac1707385d45d9061375eeb6fb7a

SHA256
6f0053c8b2ab3cb5d66e84518b3dbc70026e4ce0a409923bdf0c7cb7ffb39099

SHA512
adc6ef6a2a0ddf9c5648f7fbb9d0e979e8322b70f7128213882cfce74c0d396ac240a7ecb754113b0db58baf2e16716febb8d95be2581d1ccd2c7f5d7b832579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3372a1ac55b002ada2f553a0a1eeba04

SHA1
92754da824f569e9aa31bdb2d160e4cbe4b9bc28

SHA256
5073dbdee3ddbca368facc780aceaa9b7c98718d1279245e66afc88acef384aa

SHA512
be9f2bda10f4c7439b7b7c2d349927ccf4405d4cd1363f79ddfc4db4c98bb90bfae117cf5f86a2a50bb1bf4b7f53fa3d6e09887f18eb0a38d710a1c3d388b8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f043a3590a25eea1afb4531dd8e98b9

SHA1
efdcdd94eeba1672e5bd20d8f98d7c80b57b675c

SHA256
601d4d65e7e6e0bee5e085a8e42087bb6b7e4fead9e02d6aaaa183f1369335f4

SHA512
9eda83ec126049fee68bdf3b3a0e8f52295d575c4b7cb69a26fa0f1a0fe1436ba7227512f91249cd6c9ef9ad37e95ac50d8a07bbd4c0ec6f0056fca363300265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d6da799e02014aca9b4d606004c4987

SHA1
35b6852c12f485a9cf814478b5222755bb23b971

SHA256
16b9bd91c6907efae887e92ce9d7f571a2c3b6d024bd6d9ac2a754402eae0654

SHA512
a5408a00a80c28a0c7c9bc12f22af125cd2885ff1f0225e7723cb88bd6dd0c53f5b07e9d0cf23fb15206fa4762db29f615b91629c7f76cb345035d6f1a65ca3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c53035f101d81401ceff22b4cd5bd77

SHA1
3d8281195452b8f68098c6b2d068db9fad9decd4

SHA256
5b830cc5e468c36bade182bf48dcd06606d48257daff7bdf066d9fa6a55d5979

SHA512
849ca4730abde790023a6e284f4fd06a03424d1557c55d2f71afa9862c78f3c967e39ae1372cd9576160e67d131f757e067949f14e65615563db3af9dc56823b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9b47bbe91b2454ac1bd5913e27e770e

SHA1
d611b327e253c6ed9304809c711f2130a30600f8

SHA256
4da8b7210eecae3d4d893ee846c077a745b0ad1ea6b638da9d897dc19892137d

SHA512
df8915aceda399845b122402a8dc2a80087de093d2748253a0e718b2dd90388e85ed43bf27f414e48b5efd734a7502edcda1cb8e549128c06d5361031386f7a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
847b539a8f7f9e4f756b1a5bff605547

SHA1
b7a8b934dd39a1b76c30c50cff97165ff51968c5

SHA256
3cf382bd87b248e7a3a7b2f5491cb3a89d41c49b9611409274f9b44acd341678

SHA512
18fe66a5e86f40517a1315f7c2bec9b3551604a5e71f48917e16b1ccba1c6fb50dae54f57602a7ebae770a0d0bdf5580ff92ee7ee1db4866e86a0c7161e25935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11f4c4aa24b42ea3e02a114565405a29

SHA1
6ed825b71d3000b113899fb0d57f277e233af8f4

SHA256
4b155bdfb5761b1410dece84b6c86029699786dec8607b02fc07f71bb2ca4d85

SHA512
1b4af22f8c8956480c0433ea7b4b1b0dfafbf352934c9882c0cedce6167d1c7c841bb75eb6272ae08b2a8ad548f078f2d844da9ade41e81ade3eb55c8736d0c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec6fa846d4f9260fda0f479613d800c

SHA1
796d83e8e8f2f7aadf0548c0eafae0c37d03c37d

SHA256
4df92812803dc373ebd0179b621874d92182ef245b8831d2d48e5096d0d08d94

SHA512
3f0a130c73d0ffbf4325f23531adedf17c4495cb71643c5a3365d605cbec9abf9ed9278c5b6450b2ffec876bdcf212b2d3affd219e079f2eecfcf604455794cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5120d2f85cbba949531050f1fcf3022a

SHA1
be38ec1ec30ccf054c5bb7ebbd47c0f3636ce3dc

SHA256
0bd1f5d2436b1ccd0f459c422d762fb05b3c963329a4d38858204e26df44a600

SHA512
210a2671cc36571fb67b936b8496bb6f0d2d85c5081d8e225951b3e27f80f0c2c7f922f65362c90588056a5a46c3210dcaf58c3f7bef81525a1fbbd4fff6512c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fbdd8eabbe45a43c8a8e0da1c3d2c7

SHA1
755bf9a1f03282b7c85134e679d6359e0ac6d38f

SHA256
feb4d8d0f4aa2bbdd9290452c64be9a8d698affc78cc58a1f091b86a154206c1

SHA512
2b30ba5ec671080719b802538d3290312deadf5a07cd2511f7a801b4b89fcde5f97ab6cb151102a9838d3f4911c0ebcc90e3ee4c1237bbafd8eb0e393b5cc483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36295bdba84a20910e60968824640887

SHA1
69c28c9598066155bd1cb15f7c2bc4c02b2f03c2

SHA256
3f745eb93ddc36f65ceae27110c85a67baaacaf57e87a09b1246d4ed2fa3232d

SHA512
1227244095e269e4f29c5ea8b3a7ffc7a689eb87cd35c77de606e8e2c019cfa405144e179c0c8b0b864e7bddfd636f502a51aa2321013ceb657a28262bc8603b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eba3eea73d1a5d135b934e80f80f6ee

SHA1
6e1bc49330446df7dacbbcceb027eb53263f5006

SHA256
b7e34759645f563cb008eec310ffe4a0d4aabb70f59a8b8c2bb1de45111d3bc1

SHA512
aa49499ba9c59a22506ad43d6223aabe547218478dcb9f6ee9845b3eda0a94d74602a6ca2e4aacfa541365e4eb991ec6c6f1583a7fee59d2507c55bd8969eec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dd6a08f15ac4afd7fc66a7fc8cba12d

SHA1
68a01061367138a86c7bfa852c7ed6ca47d6ff97

SHA256
23b7c1d90bd1d02827c59f314e5caac5bb8cf1063a9fd07316ec3b0606a32afb

SHA512
89b881ff435cf712b7ca9eee810c1a57f178c6227cc27201f0b1ba511292fb7d32160461541c5c995b01af23f5bf990227ed6cb82e27ec7a9b0ea4e9fd3e5633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3db89f16dde82e5db327fd733c8f14a

SHA1
b752ceedaaa5aad415c01fea5ed176e1f717dc1f

SHA256
6469b42ede369d17cd032fad828f913e59172c2281297b18f03e5bbf062e879b

SHA512
2c96ab9dd866bcb54d91bcf2301a53bff50017d0a8e3d6261c7e949fb6f07f9bc7003cef01d3210ccd83f65f0c76787a49df561d58f8ac594b19fca61b077c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2139a72f1b9a04e887345f993b7adb1

SHA1
34074982ba3568010086dfa9e3a9b95396fb1503

SHA256
729676efe1931dfe1a2fb41be1c8df38a02966c6eb48ba95c141600a1082441e

SHA512
2d5ece798fb652dbefa246fe9c1797f5a7d949858983031dbb4ca9b4ac93fd816ee5c2ec80d7912135d880fb2a1fe2a5fa4520b835a9de3382d20ca181b6a4e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab256D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar262F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit