f9953f3eaacf51537e6379fa2380712535d137cfca511c69381ea997523a17e2

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

75b77809e8d410e13859ca16b2d98c78
SHA1

5278064d3d37c13e65ec6e21f64d99ac2484d5c9
SHA256

e8ec7dbbd68304acd12e1146c34534fae67eb8442924468fb500c4abbf858450
SHA512

7ec6f169ec64db170c5f5b41349f8cb3efb1eca51c2d84faed665a3648281684ccdb4d4d46b2d14a66e4d1ca8495160ad39989d662bc2533b2479d664feffe09
SSDEEP

3072:Sot9TBfrU/8UZyfkMY+BES09JXAnyrZalI+YQ:SopDUf8sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4A329C1-0DD6-11EF-AB01-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421402048"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2904	2056	iexplore.exe	28
PID 2056 wrote to memory of 2904	2056	iexplore.exe	28
PID 2056 wrote to memory of 2904	2056	iexplore.exe	28
PID 2056 wrote to memory of 2904	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2a6cf54cbd119fe512c33055bed164e

SHA1
7fbe7188d5c5fde1ad71f2d025080d585bf3b9ce

SHA256
5ed84887f97d82f1b32cb90e1652fcc1bc54d7fb3555eec7b129caee21235223

SHA512
41c9bdf0c4bb51b3827658dcf3755cf753bc4f2347ef33258eb37cfd57971878826ff2b6fddd0eb27c34499689cf94a5f8fe2fb780f44d7680d585d4a09d0f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58c5b2706fde1628ce3cd64f702b03b9

SHA1
2696f2bfaee3e49646880ffb58cf49f892022ce4

SHA256
a8fb5c17b6d997be047afa3cba58b97edaeb1f40520656c43c0934480bbc7c19

SHA512
7b68a4f4574c492f8cc775cc7a1145624c39959a80c0bccf0786a0af4e3a1f82477023f4d5a16eaeeb125e095a86e6988526c647c677570da4648fa34e315518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed6ef57a89488ad8bd0b2791d4a83d0a

SHA1
aa883b2592912d75060f7d131edee7c273ff44f1

SHA256
33333ccbe9b35c64f3a762943fef68765d48c22aa0f5dd9bd6861e56e48f2633

SHA512
5ed4471eb4ca8afcd418a8e1a4a0a94ac970753fe9c8fba6918ae12dd5a0869dd723eff0f30c981e69713ad69b1b682f8eb34d9592bacca2f4c1f0917a2eab69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f884c66060493f72bbd845844e63b27

SHA1
a2720fdb77648d117d7c25737c388965d4049ac0

SHA256
7b5f2864c60ef7f9f22e2f0861ab8853c0cef93c674f17b9196855fb77e77b41

SHA512
4f2599f575b74ffcdeb9eea6526d9211e9c9ea48181287cdb3e5b2e302b16ace97c5154335ff195767a73580ae5b0f5dc26df44ae32928267889c0fef082dad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2a067cd65496162f5bf92006b5e40a6

SHA1
931958436f084c9808e4b9bbe0e7e07cf9ff78f4

SHA256
927fd13975df90fbb32d957601c008993fb2dd460e5905a19555512789f9986f

SHA512
fde5a01d5ea167faea72c5215827d4ceb268fd8aef24ba7fd51c8e21929dd662fee5bbb3255e232b26e779569736b3dea9e4dd23070c6d125784e6942bf68587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e07585892a83a496b5ef4b873b53bc

SHA1
29e891c14a8029c37f6ec9964c45776e4f738a07

SHA256
8e924ca58ebec158418dd548d13e54c592dfb3f285da6d61c2fc5419c5293f1b

SHA512
4538eafb71360a3a6934209808e27b21277b7ab4870552c05f7c0d435dcd9181b8ba06e9f3ef21f43c39c5b25b8e36aea9ebf3c7937f15ae81c4819b3540a76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77d5ea6c8d3cb6b29d7d2b19a5e81b89

SHA1
8b145a0c06d595beadd9a2817e91c6a53c52b755

SHA256
0a11bc0e963b3ac1650f929df9d1ad58dcba0bf32e6d537949ba5fae22276785

SHA512
a54fdf2a0e718862cc80b2eb4cb607bc81d89bd428908be4bc6fa5ddd364cc13a7d2831a3a29c3281cc13921efd6c6a055e5d7bfeb6b0e933adab3f860cec748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b89b60de1125a0aaaa2d0768690c436c

SHA1
326d1d790dbde2bf67c1d41b5067b9a38e8d689d

SHA256
822894d0b8ab46d1c1dc87452d7fe915db12599e0a0ea1cb903cd6394c5d6dff

SHA512
6035dd3d7413e0112c8d826e9c99c4f1a43c0b96f7d6d349f458588d65ef8d32a427f405b96c8115309c5378e2848dd849c117c5ac52e9fb4e0fe877cc8c13a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1f8f6201e7068b1b8bdacb04d3fa4a

SHA1
188ed0b6b383118b0641e285dbb70dec10575d6d

SHA256
f512c1f7c81a379aeddd5919f8adf67d6b98bc9f3b90647c6c6174b0829f67db

SHA512
65d640028e2012f551d5815e1e9ef8d0b6371a2ab434ce3f6ec44c54af72b2df21dc820dccc31c07216c11ea917eda5b21a961e27037811dd06360e2d548caea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a240b57caf987d59f3f6b2820f6022d

SHA1
9336cb75c4f06dbb676089e0b7a15e29b5908ec4

SHA256
c464d2abb21c283c503527d6898297001ee22ef3b5b3b5a29df2e396cd0ee493

SHA512
a4c347817b59b8b823bbefafcd2cab0184677342b0e6ca9f62079678eee3da5428409f5c122f68c2d86672252234d1e66e2f26db49465329a8d664353d2fef80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4cefe91a4bbdfba6797ec2a818e2fd6

SHA1
1d80a71ce367ede93128d3c4bd0b3a81d39b1256

SHA256
cd248d470f1349df7cef90c40d9bc401d5ece17fc4d5ed7ad5cee7573e408337

SHA512
0eaa79d1a5f4572f3113be58482cd57161e889d95427cddecccac6b35f702fd6f43f2e768da3cf22df72154e34386d2b6f6e25dc7b8a7e4d5b90baa5b5410676

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20BC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar210D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit