dd710edb9b9e8ff13704086f9915b1fc7fbc6849f1c63107d779c0eb1969d0f5

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

77a54dd5314062a9be8235e818654355
SHA1

910cc417d03cf8a322730ace218924cae8fb01ae
SHA256

020954137d17bad470375786e169ba9cc42f92dbea8291babf0ac5ac0258ec81
SHA512

f36530b30ff21123bb2bf7d8415b7da7271afab6209906a89e0bf83c781bd161becc39ac53fd253734b986a9fa9d38d617d40dbd26016592a1d79d4152ec2f00
SSDEEP

3072:SAHmJuNnKdl8yfkMY+BES09JXAnyrZalI+YQ:SAzq/sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C00916B1-0DCB-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421397289"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2836	2232	iexplore.exe	28
PID 2232 wrote to memory of 2836	2232	iexplore.exe	28
PID 2232 wrote to memory of 2836	2232	iexplore.exe	28
PID 2232 wrote to memory of 2836	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a8652709a5606f72d1468865918872a

SHA1
72fcd8f96c057a2d552cd6cef3114fe2768c0929

SHA256
5e7e9d99ed8914c8f84b253bdb41042bd0d95efe86cee58aa0cdc79af99cbc56

SHA512
6c4bd41df1279978484b74b74c4aa12b17c97df85f64f814533400d067ca75709aacbc54900fb02f1cc4cef9e1459a4ae7661f56042b00d60db8be2986d70310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76107a691ce97ea72fc8d303598e5fe0

SHA1
80200c0457fd2fe46f46729b48c6ca9b676cdc54

SHA256
52866e35e3ce226b1afaf174a1e2b2a474defa5a688bbdfc5d118ef1fb4b6056

SHA512
cd0434aa8158407ebc9de7dc9e7e23f29c4c4e85171cc7d2b9f4478439e773d207b444ab3359f5af848a0a49908f41254def8f6e2955d7d689b60772f95d9c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a12943946a3c0d2d96966684a3106a6d

SHA1
3f09a08e5be58058e9bbc007cb73e83305053cdf

SHA256
120901caca6c720ca9623c0b19edd16f24d43b6b19f2c09df156e3c0b1456151

SHA512
3d28537ce98e669df4a34786b7665fd645d8d3bdb270106b617a7fa838219567ff522acdb9f828220b928a4871b0e126cd1a77d78740058c82c877d41a942ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c20d3ded62c217a082c393d956f839a

SHA1
4eb278680f5cb70775c135a62d69818a9e28d082

SHA256
2701f6a81a5b48b75798643457066e8d24ded67faea19b120df3c5aa02878de4

SHA512
6b25fff3ac233cfcecd226bdc25d236ea34ef38c0b1c6078b8040825e35d7b720df16fea1b5cb112503d25398e8557f9f93b26b4e648096e881dabd1adb78b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
748867166719a7099fa435da5b95c30d

SHA1
f4bdbf11d777c5c3539be50a149f7963cfe3aac2

SHA256
37b2e93f871655a1cfc920bcfa312ae3b2e83ec9ecbde3393a90144f42ec1f01

SHA512
2e7bd300010d134402dcab95609d6d2fd1712c9a33c4794411bb75fee45311c1c5867c68f1dab7f6bf70963daf439de5d44880d45801be59bb81c774d9532533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d18d5948e14d6b94420dfc74196107e

SHA1
626fd527a67bc0f53e2e7a3210fa5c3b641ab536

SHA256
2ec45947dd1c5eb04be91847a5b79750ec7c2f79ffda85070550d378f5ae1d97

SHA512
f91bba7ced908f1aade9035ff4f8aaccbd90b2b97f6de61e555169a93d38ac0cf5b701e874717f8af5925a3883204c58bb511aec55204efb18af86f793cfb63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d45fc247943fd90208cc67c9901e27c8

SHA1
98bce29da4a3cd6ee657a4bc558d778d461d3bf1

SHA256
0ca06983dd12825c63fe388753be197246544d11eb7c07740121360dc83d619b

SHA512
82e6db3a4cc15462499bc64e63e640bd8bee9d094c8679a8f7092820566d681aeef34a9b44b80c0995ec1d0c9adcc8e21cfdbbfa436214f94c81c3195522228f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8da8aab5c185d166215d5d9c5c8eed92

SHA1
ee7d83016554e1427c98c1cb8fb595fffd1f37cb

SHA256
10803020bb75ae6c1cfa2d6feaea357cd1325ad7f487fb7174b16a873c001490

SHA512
2a9e25ba729ce914a6346625838487bd9c415e41adc1c52107be6ee66d0b1832e9a807239f7d7ba9c4d6e450545a9f6b21da59832b06d39f075208f8d34df223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91733de0e17c3b6aacd9098ae0935fce

SHA1
f8dda2e6d182a9216f66fbc3b7893f8cd0446140

SHA256
0b7cee34b3264120dc5c66e976bc9f3d8c27e26d40f76e191e5136365295105e

SHA512
b5086c356691b71b0bb8784790f567acb753b953e1185e7151e2dca5acc053469a8f200a98ca53c57507380c00c6f3d137ec84ac875a06d621ac1470e6a487ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58d118c36f211d73e141e405dcdb3de9

SHA1
08841a2b8a0b67cebfee6e7d1d0c6fe26620fd89

SHA256
d33d6cee6e1833c83dad0d39360be082b52d028e65792601bd34e36155cb4fe7

SHA512
b2eec4db5ec9c9d07ed90252c64266ba0075ca7c15fa99e037d0ab19f886931d44de894511f0d59944d8d922f1c4784a60f5550e38e2780273185facca186785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a97e60313c318874040e6460ccc5817

SHA1
610a3ad498fe41c935b034f644fde3625e7c8263

SHA256
d923ded8a81e59f6308d11cdf9310c86dd196e350a8f03a8214277204ec3189b

SHA512
25750f124e34616e3fc949af67faa74db019e9caef43578978d37912cebeede3ed7217639faccc8e2f9e21a40beb3f010bfaa68410af339f18459ccd6c6ce09d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54cfffe2b846041eb580e18932ead109

SHA1
75832cd855d2dfd6b5220354354f0bd684197386

SHA256
f17a92c556ae52fbef4ddc466d449163e861d00b4f74b2addd47c0f59f16cb82

SHA512
5cfc69696ca80ec79ffda4b649a3e35eafa7c0c42356cd9a53a71793cc22e13da19039f0674075477172ff934c768b444db712b9017f99733919d0fee8f62107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a39734667cf67ec76e0dc19904f791c8

SHA1
2351cfd6765ec97924daee46147aee7574228831

SHA256
7a153efccac8c877716bb5c37a8027b1d5cb2d0dd7f817a7b4d4706afbcf166f

SHA512
717f4a92cf11325b6e2178eb9fd515b78a305ed163a8fca1cee792797fa46526bf2f980a11f33f225f05103cd9824bc8abfa9befac23f1aaf63ee0c9a5e4c83e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cbd34a11e30de17d3f0be33405be09f

SHA1
3ae15399147248c6129c52bc50c76beb1d199799

SHA256
a331c88974540a7f71962212cbd019f9517f3d178a8ec239bcb5f0775837948c

SHA512
24728630b16a6556a6a6f377bcd465f2a9a8be9ed7aadddfc790fdf3845e50aaf5c0358b43f341d1d5005ec0a11f551fb79408026c6e6338627305ff59beddca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
617cfebe680617d6c8f3c611e86335fa

SHA1
201b7146726f03c3d7e0101e58fb4032edcaafab

SHA256
7cf50970f81a268884f2bf50c6e63caa4762d2e650b34c63937f775491b44e64

SHA512
9e63d0c4f20ecb57d3df861fb54227277446836d704d48d14b156304f288b2379de9a2dbe6abfc93d4dbfbd43a875075c8f04f7c98577b6f7d999b6b30f9977e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f1421663f11d1f796329ebc4166163a

SHA1
76319b601778996f0c7726025e414f09537cd730

SHA256
72d26691ff1b6a3b3ad122f076efd9f70503d228e0088fb42c88ea31af277c79

SHA512
fd671d94c7398c1ecde38f78964370c51801a4d32662f19e48469c42a0b7309d7d5a0617e218f09207614480b1fecd7ef1075aade7f10dc99aec54f5af313f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab7d0b3edac21dd88194a1eef04a0e99

SHA1
910176c63f4428cbd33dc57d0d0e4f764cd45b8d

SHA256
dfe06612002cee9f1be01ed7fee01556a9c46defeed3030fe350d29ed3c652c1

SHA512
891bd3697627aec0bef8bb2fa13db10cd30ddbe0431adf83766513642f7215de742bab39a2a1019f2db5eab88e02cee46f8972166ca4126ec52727c2d164c541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8447cdbe1f7c182a3d78e79e144075a8

SHA1
8fcb06885fb6e00bf4fa9b9eda191a8e22124a84

SHA256
ec7fc3d8ad3bfe9cd719bc78a9a636fac0106747d4df6b576fc5854e4b3a30c8

SHA512
f196f78775b5d68603abfc0ca26dc3f3ce10621c87c109917ef57302c6fec5a1febc6b9f669cde2546bd12c9b0d83f476457f6840773dc57ec806c14e7c03f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab232C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar237D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit