a0b4c2470314cf5deb12fdc956419448cd8252cfb76007944520bdb9b328dfd1

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

a8e5e2f577294671f97726a6ad62d1ed
SHA1

2b061ba5092f26bf7d0c33071910521cf61052d9
SHA256

e723cb17539d0fb1d1dc26fd0189904086e8168d85c02e2d481a79afffdb642a
SHA512

2bdfe151bef57b383b947c96c898568b37c4cae9896545d26c374f3757a0b31dd4122a60ba338a4b21dc16b13b292b486f4b0af631685993764616abe5a72f3a
SSDEEP

3072:SkmKMeh/HgGGyfkMY+BES09JXAnyrZalI+YQ:SkT+gsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A54919C1-0A55-11EF-A1A5-568B85A61596} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421016711"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2108	2072	iexplore.exe	28
PID 2072 wrote to memory of 2108	2072	iexplore.exe	28
PID 2072 wrote to memory of 2108	2072	iexplore.exe	28
PID 2072 wrote to memory of 2108	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a02b2164065108f6b01ecdfb9f0a942

SHA1
7fc74aa13083c3da247123abfa06ca55ced8f915

SHA256
b46d78ec2fbc6d6aa9cc579ccc673308e25516cb78f8efbeac69c3a452302b9e

SHA512
ef3666baadbe7e83a0197940c630800a9330e925c067e6ba056ebb391712c8611903b3838b99ed6fa1ff1f089c8e3bedb91925c7d48af50120879f2baf8f2f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc246fffbeca56f459537dee4910fde6

SHA1
d29cf99e7d7f090ccfbc60d228700570c401f2bc

SHA256
a3be83121bdac4f4252633081ef1228bb08898274feb09967b6f6bbeda3da587

SHA512
94f43c2930a3dee796603db9f94265c02c0912bd310efdf2ead97a0ae1288d791dd4467f22f2a1d49d322b9f2951c161980975658ca9ee334edf4dfbf460023f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97438de4ddab110a49dd81a45269805a

SHA1
abdbab8fe4915db443da96812bf7487f18a52fd4

SHA256
ed8c568b133a455ec283d88d6bec87af7719c8f174ff205b3a94354c2b3a3d25

SHA512
49a3c60c19def34872821a65b8a52d891d52a27b95d8cee8a1ee16b114ec36a50f94919505a2efd27683f9cd0eb984d9c495e45547178f6d0f81ae14ee7e4fd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a6e3f4c9e78366e2796f3a1a05fbba1

SHA1
47b59e583d46a95699e87ad2a36058cbf149bdfc

SHA256
602d53f9aa5d6257abc44d4507928ba0e881cf142e15f8c152e9f7276f100587

SHA512
36d98bfb57b7708d6b19d2840428ed7c6feee6afa2d8eb8563854d9a37c685f748a15fece094f28d121085ae60be96142e158e2bb1875d39d9b89fde6fdef69e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f36f1730c8e6be4eeaf94ca9e5182f7

SHA1
1d8d77832d5dd48c64258cfb45a752f2d1f97cdf

SHA256
04c83fbc612cfb0e2322ab44c5a892f8a605eda2834d1a0259a1b6d0e662069c

SHA512
7e958866ec0ee36fe72f3525658327665626c0dddf8adc556704c454a6bb7cc177d97c0e0f0441efe75005627536393d036da2dbd4dbd6a38a6be0e069ba7b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1409c7e4b17724f150c08c3758a6fd5

SHA1
f921dc437d3477e426954018e9064fe17585c803

SHA256
b5b2ff92887d00517215fd76bfc3262a164400dcc6996ef7ae9e592ff9f300ca

SHA512
18ed80dc55c3858ce713f579c7832839f28443281477bf5bdaba362e49a5fd8d22d117cdf004fc3b8406277b1be32a4ee0d6cc1de9e5aebcd5548963f91c9c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c674b62b1bd45c0a10ca3461ccd68ef

SHA1
55263b6a19a84ae646512618c336a8d6ff02c226

SHA256
f00ea606b5466ab9f027bfdae3bfb6212480e706ee60f7be1ef57f1c27597185

SHA512
0ad69dd01ceeba4d1400db0cbea614048451554ad85b8ac583c03ce6baca4bd91d6c1b6472b0319fb6c6ec8258635776816527122879770b781ebe735818d90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99f4b3e3d95b54e490fdc9dd8cd30e9d

SHA1
3a48168f5c81919ac265a41483a6720ad81d2372

SHA256
eeeccc1c66f71b11e97e0718556189b84a6a4b1f0bbd7af527c59c8bc0302566

SHA512
52c18869c09284c868140982d98792a6891459f862527bb31567a404b805b3eace82646acedde86c21e69a9ca1d1d56b7b996ae97ae7f690e492afab64a50536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4c149407eaed65c5b10d0098e756f04

SHA1
25929d6a74ecdc13b5e907e94c140390c857b497

SHA256
cc46c5bada3beedbe3698409825b50be2f0cff44c23f008081fcdfb08bfa69fb

SHA512
d1d3e84a72e67914539bf2f7e5be1816fa21e1d1d34aa2cc8f4d5dcc94cdb468b52a0f2e3e16a20f51c1de01c2908f5fb5694a6d7f969fffaef2f70678fc7888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8cffb03ed587f3e46376d439f04c0e4

SHA1
17599d8186e80e8a398f560cc5fae363cda693c2

SHA256
d8ce417920470c4522d9b7405451961485d72290f216a4f176892c9cd6df1882

SHA512
534afc5c17d38a727d9cbd72452d7c5723692a1dc82a74f652f28b700f7e608e054e16819eaf26b005e4037ebd202b3aba46175b385d1c839878150ed13bbb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e815a239a9f8a4d46ffbf729a1a0144

SHA1
b3ccc1ac085653c786a7aeb8b3d84fb344b0a2d0

SHA256
79eedc5f7109cf8aee41b1b15c97d78944fb625e5dcb10ddea631733451c46ac

SHA512
b61dbcde015b649279480054dd8aabb886af3edb8927a9f683511adbc5498c92c9d764d328c0a71d7c6aba0b11a03b057631c6ea3f0d5fe1b5ef32c21369e512

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1641.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1770.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit