9b085634c6fa2c3324eb8f64efb9dfd9a2a559cce25c54a15a314d3e77823148

Analysis

max time kernel
138s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

efdd342f309f9e5e3925aa8c727e6c5f
SHA1

cbdd7a923bc6fdfa65ce34f8e6928a40f6ec9dc9
SHA256

925a457a47574d3f01f22f9577bebf0539a354d251ffa6b84830d42ed23124a3
SHA512

591a8eb23b60dc38a2a9370ed213dc9029218a095da043e9ba5deaebd93b934aa0036a10ac49c9d88a055fba6e32d415496b1b483b77552290f3957068b52f5b
SSDEEP

3072:S/z/tymQTlWFyfkMY+BES09JXAnyrZalI+YQ:S/YbbsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6951601-0CCA-11EF-B671-4AE872E97954} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421286974"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2456	iexplore.exe
2456	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28
PID 2456 wrote to memory of 2884	2456	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
855f3fd02b7b82376eb0b8c7307af28e

SHA1
8c6f7201ad6753e7572eb47109170d8faf511e89

SHA256
ea6152303245c06fa34ba4df21d1c5ca2fb2df3568b202540a06e553b2c2c156

SHA512
aa398ecb10c2934161beb4512e3f1bff90ae53517b08128fe22d6f1fdda3c770d80440f0becee231969e65d3ce1f16852359482fdc4e3383efee517d00a6a509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
425afde0b510318b8345cde45a186a3d

SHA1
d34e2176ff4be59b7b108c3ac6cb0493bdcecbe7

SHA256
60e20c2e83fe63e553113533e94bf2c6cc76704fdc7b9b6e7162d298a7bb9a1a

SHA512
c28945aaa7b18da96e71b14476dc8be7ff5bc07a526b56d3891a879e66790c9be9061b89d70697a7c75d7bddf95c955807b462ea192029bdf0597865830ebaba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53efddd26eb4b3dbf5e1f5ad3de94d64

SHA1
48bc6f038763fb6776fb8310daadd15d14e9d49d

SHA256
d5b02d3fb4ae2002118de1719eca7e82c8f383c85dc85b2391291fa48767daff

SHA512
b075f24a2e66894919b2c31f4632222dce4509098612db795a354f187d04d523466ae65765694fdf69a872f8530b9cac973fbaab87add69e6ed637f7d27095c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f6eeeab9ef8c7e843cc4a3b84f0ddb5

SHA1
51d36e9ca3607d4d830ac09b08e51d73d6a2a813

SHA256
77d23a899f30c7f34219243bde2e11669e773094f80d137380ad97d16a6f3da9

SHA512
30af365b354b6b395edc6cb43400c4ae4377b1a181cc2d15db4887d99d7109784e730186b312be26bb59425f60ed2920a401db86abc6a34d8ae74bd33fd40075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f19799184f27bbd9c714618ec8cdb79

SHA1
2100e47b49e8672a2f3c4f74d591d013e0af158c

SHA256
b38b4927c76103e121d580ec8b55f90563369690765f34e5b669a5dc4f4419a8

SHA512
bfacba1be38e7ffe7e3e313678007f1dffbb4b8a426dd6fd34d36ead1d1070411070f48a69b9fe0fd9df1d02211e3eff4bc892e53b2c39b45d9e85be55d5133c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
722f0dae64b7d8830ac058795e7ffdd1

SHA1
8fabe5e83ad61d62e1ebdd40c484b543ca637026

SHA256
2d636082fecdfdea567b85d3a10e368adc35ba5284a356b57d979d8c2f14cd96

SHA512
0d9206816dc8ba1ff457a424a015c31cd7aaee0d69c864980ae582f407162f5b1b88c638810bced3431a3a873696f6287805bc139f51ae2075247b1bed902ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eefb94e0005622f615c08b24be2663ed

SHA1
ea64cadf9d327bf2dbd73f2788f2351a36eda135

SHA256
4b81455a2d7c89447767fd74217be25197a91a67b6226d537365e5a6ffbe3ef0

SHA512
69a9a73dde8f55fb3a6208d98517a424ca0b05b8580c168531f552ef251c6da05e0f1ce687ce43a0c3de32cedb60eb0849932b2773d6be2128ce276f49b9072c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e854bd3708f129125bd92239aed23d

SHA1
b17331e8d4056c7f408542a51c98ea8449442219

SHA256
7a5b0df6f18dda6a2933de5baa2e693ec0e109ff21485658118628744d451192

SHA512
0c900de309ec26ddec3d64389da0efd40fcaf1b72604f90d7b83ddbaf732fab5aa3207675d788bc5867b4e114c53faf0fed6c2f08df56fe9d07913cc7accaeff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e6645596e3ba49082d2d5af68f76adc

SHA1
6fe4c2ac54987fff6ce0d320a79bb9504a0e5b74

SHA256
0f6d7e601e54ab3f8e95da8761047038350955c671924043df5ac3b0467dae14

SHA512
149323e17d0b36fea6e7fadb7aadca0733b9b01a53a0f72122d0af636505c6ea83ebdfe2e98affbde78dcd50816db3e5314c91a2e70e3a0945391673679e0e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d6fac77fc7999920d933968d785c8e

SHA1
03d5bc8f69f1c2e3cdd657a150cd5d46d259a35a

SHA256
5546ac0686e67bc13255e0f8df4402759da25c7d87f5ca86408fdd3875948642

SHA512
f0067ffd1d50d144f725ca31fbe89ef0c1d700e82dfe2774f201fc1329c9f477faf3dda157016632edab77b64a0fd547ddda03f1a10754af81e986500baaf923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c4986674dae79e2852b054aaaf2121

SHA1
2da8b26723025f6cabcbeaccd5c85f867249831e

SHA256
89acc5fa2565bb8000423d3b0514df82586bb638266d6b6c4d65a51a13dd0292

SHA512
323f0ca7756e3b8fc0306ca84c6837839f80dd47794802443b5f5ed12bce655e015d10c67a45705cf63d7022339a8739be86ba3e8906e0543843649224984175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09a6ed68669c45db81b6f19db482ddb0

SHA1
3cc55b51dfc0ef13706180af988060a2cc23e167

SHA256
3eedc94629a78d566ce69be0244fc85f69386dc3fad53254ac64929c2a3236a8

SHA512
1b03e51e8f81b676caf88a6e45da3f5ddbf475f31ef2204523c65f651266f8e23cc96a627d378eda0552c6490996aa60752e7de15f5e071929673493159d594f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12468de868a1b896ae0ff8d36497055e

SHA1
f7af5f29a4717c94228398b0721c9f6bd81a0824

SHA256
7ea830a2c9f7fc2b468638f3eb280c9d79406b70c5ad8b7eb98196fa67c8fff3

SHA512
ffaa04738d82582dd6c20572cd4240af5625af2d77bceabacd81bb6b9ef0a137eb21c9b68f3cf6cfde2fe7e30e3f909f56bfb3450024d8efbc306a0d9e5da201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
536fa81321a3a1f9db9dd9cc370ddb80

SHA1
0195a9cf22465d0b482170a78140b371d652c245

SHA256
5ad3ad7a384881ec25d8ea4131993dd7cf6cb7bc40df3924c668987fef63dca1

SHA512
4c427827b374d8dcc1402376314975d716dc27f5d6c0d3c8a5ac2689b168231edbde524515f6b326bfdc12821d4a345b54c46bdf4df6d84b3a92f44b245f8c3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
355d6f273e6e2dd163d0eff16c678f7a

SHA1
909a32c8906eddc732fcfdb232611ef9f7668b59

SHA256
7ef77b4a7a0143bbff9c16a96c60ec401ee2cd43d231f6041a3ddfeaf23f6310

SHA512
30c22f363804807075df6589e004a83d9604fac865839a1787c72c76a72ce447d33f1d40865e230d816141195b48ec31560c16603e997cb116c513ebabe78367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cf23970ce9224ac305f05545846da2c

SHA1
d5db856882c40f53da3195dd64736443bc7fcbf6

SHA256
d99d81df2058babac21315247f54b3d214181e49a5da89f12334089b188a1fa5

SHA512
11bb09148cdbc6610c89f826eba288ea5c066b5c8c68bff0169e64ae3307aa52bcde6e3e6bdc0281a78d0d1d443b8e8a49a19ac8bf80452c3cb91f68a8bef7fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65f073f3272baf927ab6e54f59294216

SHA1
7217eea1a555b91f15ac0b233d965c595bf7ca29

SHA256
8604e9cda6eb222826b25431ae1e6f49948d2e9eae777ea16cbdb946c0aafacb

SHA512
c7aca7f6dc4c2b12784705f05d01c710ca0d14da324d00a5a4825caef689444d232c73b14fda1930fac0bdbab56ffc9bde18201c5b8f4e1d8945604338c302f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1e5d40e98388222ea8472cfdb4f47ba

SHA1
6514fd60315857dc4d85e78c0b13f32e9e6cdb20

SHA256
ad097fe315f9f7dbb92c97f9b2ef119162b89f6cfcf8902e5378b6570b665d1f

SHA512
12ecf0926b1706aa3198672eb568b4572cdf42c5ec6980bab70be226ab3c4a34b592d8d19976fe6461eeef00560ca8cb7a88491c38c7f91d7f38965937d69b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
482430dfc9b92952250d3686e84d76fb

SHA1
4ce0be3edb52126365b6114ef40e45f9808e2981

SHA256
025c3fb511e691d11bc5539f5b8275e546dd53a43d3b5a9a22ddb866b60112f6

SHA512
0bc1a048feb85e984f85143cdec7dec557a314c126405f4db2baca3e9098feb9396f5d9bd91206c2b823b683654384fdcffacbb75aca0bf9ebfb5e2249a99634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68669603b54e643eb8e6de62046cf407

SHA1
8e4c88d45c49ad3724cd1ef893afffbb27e6cd1f

SHA256
320162228c89f2c272ea7b4b9c92b57e40645dca3da16a18ca0a0898b6369f99

SHA512
73aacdaf8be6fe5892cfbdc87e47b8b6ab995acc42cf576a4dabc3a798bffa7b28bddde4e8eb8e9fb140193a612db670e551f23922ec9abec00f443954c2660a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab94D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9602.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit