e43118b02ab9cf656dca129cf5bcec147212305bf5cccdd9476cde9f8bd80c71

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

89abb3c84b7c80f720270a8552fd47f7
SHA1

899183cf9ac190541ba50a3d22c1ecc36c34d0c1
SHA256

944e32de1dbfd4b89ad5469c693a086a0c712b20ee231101153e905f40b0785c
SHA512

179d3c6c2bce0449446e5ed2c33f74980caed56920f3f920797cb32387ada929d00ca1b131f1361bbcc5606e50fa71f3ff5028c68de7678d4e2f4891c22f35eb
SSDEEP

3072:ScF7Qj5/POaqIhIAmbWyfkMY+BES09JXAnyrZalI+YQ:ScaUXsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421413758"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17BEA701-0DF2-11EF-8AAC-6EAD7206CC74} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2736	2324	iexplore.exe	28
PID 2324 wrote to memory of 2736	2324	iexplore.exe	28
PID 2324 wrote to memory of 2736	2324	iexplore.exe	28
PID 2324 wrote to memory of 2736	2324	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3936bd0ae7d237196d50f687ee8c3aab

SHA1
72033d3ffd15d00ef6d44686275bf34f35eb881d

SHA256
517de1c85f2e694d078a440000b1ff58cdc5c3f282bb4b1327b3d08e78f534a4

SHA512
d21c5445d7717714b961df2027033ab8da180c26b19154c4b3422574c4894729566819d7e6273e180baa5cde9e5c7cd3d560418df1f8bd4c2c1e950c6473472c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598dbac590b2b867b68055e9e75e1e42

SHA1
b033f07365475da82e95d4d4cd27bcfa2c38ed95

SHA256
d09ba16522ff79f0a5111e009c785a5d795df3658fbcd62ff3d18460c543e167

SHA512
c6e9ac011d37764f9e09a3e32f802a39491fa0d556b2f2bb1235c17ceb404db20887447d0fa199627c854f06606a3f5de134452850ac7a8721111f5b241a7d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ced32e4d9b818917ba5b5138201fdfd

SHA1
472dd7ab48c67e85803cc0c08cc4fd5e230869e6

SHA256
eb980e5550c98b779ff8295f67f2b4afd8ef52a3597a75706bd83dae359310b3

SHA512
3fdde6c2c3f779f2b785248e5df0a88401e2c54d726e3451fed2310c58abf6f4449a5d34b8c5ffd0d98326fdd1960940481724918084f185411e1e667da4acd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e2d5feb3839279811a6ec7d27e0b1f5

SHA1
00cf4d124d9a6cd588b59bb92dc16a04834330e7

SHA256
108dcc79614bb2d3796ce5311c9404d5e55cba15ce56a314a5a57557bca19fe2

SHA512
8d6105e3de0ed54d15a47a110fad3415c9a670e918c1959be28cc0b0df6a3139a6f5d525b499d8fcda86ab1c79d4a6c24993795299d14df86df201368a026999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cedd474ec96a10437dbcd8572a506799

SHA1
5f0e0169b5ac91f84c337e088f4974041123dd2c

SHA256
0f5f4026c8a1a56a25e7476e64ec0028744d398912ed57d6c15ef11987de42b2

SHA512
af78a3e5ca23c5dd57d3a447facf852446ab184330c73b844cb4776d2e956d09ac2855d103f309f6ceefe4717472cff261ed1145fac6825e7333d831270f7abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c6c6b5bf5a318ba428c1cf74ff3fd6

SHA1
640a3dd95fa89989e646cab8ee1732bb6b419ad6

SHA256
4609aba45aaf5269f86bfd348d4727df8a7ffb32cff843322665ca5b0c89f9a3

SHA512
7054412581c435fbdc833d8b53c29bf233fe987456bd8173730a39b647c720668196edcacba78310644dda96bf57f3c8fcc1b763fb23e0241aaad2d694813da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e92bcfccd8393abb717a47725e449a33

SHA1
508b8c02bc9c71dc3429d9352ffe8bf439bcd882

SHA256
57afcbb229c7b107e147a0560d246d177e5b6ef8b14e459b7516e7338ef6cc3e

SHA512
e565afb3662fca8e5fae86c1184d2bdc924b47ba67f9f27574f1799cf25e9787d9760e6c5db79cab6b3d506ab49290c1e7db4fff9b054e148d4c4528cc19eace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6be03d43b45881b1c2130ccfa9c6bd61

SHA1
503855ace7ff8f6ed1ff832d72a7bb53e07436ed

SHA256
759b26d1e6ab707df5b58abb61713c84e79c483f0fbb4dc5faea3935d34a33bf

SHA512
082bdc68fdbb99b3d5079ff4a481e861da86ee3eebc3bec9b43b19042d2d1130df9fe1b4c2631637c3fb20fdb8460f42f9d005449d36931c57ac38a968ee0f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9571b17a0d8cf761e57e80a1db41c49

SHA1
18db82c7be4e3f3cf4fa2a38d7ebd019111b49be

SHA256
d7d751517c7c4edbb269c75d3020847c167d64fded10f74cdfcb536ca687a74f

SHA512
d89877d069b5a178a438334fa630e417fe8556bd7d9bff6f78addb3204d5eec17c90cf2a524e463931d46d96e06eb174acb2755768347561cebd5ae2d4a2b90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a40e93dea6aafec19f32dcd7f665e827

SHA1
1393c9ac49b36b0c6a532eacb626b2d75ee4d258

SHA256
b19a307a6f1974eea752b1ed3dc46ebaffe3b6df61e39efbfa1fa31e462798fb

SHA512
4712d140aa676ea948eb371d0594bd82fc6f98bfbf6e3d22d8b1124b03658b5ea72ca2b48d352e7b9cd49037bd957fd662e933c36f5fb12ac9d6e21da6bb0963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50ad2871b458b6ea111794af2dcd8d6

SHA1
688469dc0c690bfd205ce6f97c71bf12157788bd

SHA256
22e7a86bc8497339b83c9040f1756ffcc4a235c6b8159b3bf99cfd070efd3d8c

SHA512
845f1af390ee4c3ef37e6de94194b9f57af31b491b3d1bec1658031eb346718f828dc5446fcfb81884656a2b6257deea3dae21d88077a434e91e657fb28b7231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7af7fdf57f367154fc446721656450

SHA1
0447162a189b8dd4baf7eb1a112b368277eb9651

SHA256
437f6a90c25433f1fe531d733ff67e27b486a7149e0f657a563c461cdea0491a

SHA512
f25fee3d273e9d74e3182872a825d708ed6612ec979cc95a4628d822f85b784405dbb65732425a4a7d2051dce23b59fa9ff1a4d7362433e2622cd0575b9454b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47459954e84ded40910cfd42163cb237

SHA1
bb6d48fef69715682fbefda1bcac42b567b58590

SHA256
e24d7b9ee07a8294e76dc995637d41b5e1c78ccd1cffd4e4c7333b2ecd959c01

SHA512
1385ff9fd6bf6c2ea368f38c76c015e62a79662641363d251da747ddae848e25648f8d97a820dc0879720a3f244199beac1b932fe1df99553ee4f98a1a56bde1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97f062c03d76f76663c29d98379e0724

SHA1
e0a81317693578ce9691946f843f1044e03a2028

SHA256
944ad41b421edf51fb78cea550f421dbfaa3ba505bb7e94c8c8bdf15cad819d3

SHA512
02294752f1cbcf8426a0268e39ceccf25c9a81d034250d26d561618e582bb6c928f3f81a4a15f0b820ef15e3669b25799e5c173543fceb6bd5bee2482b51a4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f39f469d5e0d7407321a934ec5c9fad8

SHA1
cd2f5298b619e8715d1f1083b566857cd3c38a63

SHA256
7070ba652986d10d61d8cc037f730ee7415c1781871cd782b2ea96c6075e34de

SHA512
ee7a4f140f2e3fe040b86230c03a0860ec97d7569b1cfd8a94c3498876aebed3272da3ab08fb2033a21b907d2b1f4536b916ed5a8951f6efdea6065a324e233e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
534f18d72a3ea37193d2c14527b63b1b

SHA1
142de931af7f448a82b73b2cb1a89561dd24b070

SHA256
dee0ce4c44773c6b11fb8135cff503ff25ecc083ffe27970b92b3126cbdac015

SHA512
248210aa524b3b2fc0a23001bd183ca69415030e7ef7c574095054facd8a16940bebcb3a0a16b435f7e2355fc03d86caadfca035969e9c1acf46744d08b09a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccbe3b8e8a6ebc93cbf2dd304a856b3e

SHA1
7658cde55befe5e795428e770384aafef2e44e3d

SHA256
ee9ea6ac5ea6f48a29dc003755fd75d64e2bdf2a17a14b0feca68203e405442e

SHA512
9dd5980db378f206e313d4bb9eb240b44a4f9d7db4b6d6ea9d9c94b63e1ab7149c6a939f19a8c29db1f0a5c9303f1e108468589d66ee4f5b7ff47aa11c0b6c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bac4ece38b6648cdfa8e4aa6a47ab7c

SHA1
057b51938d17e48e35507413291fb05b352e7733

SHA256
a6e5f00364670bf269a6330f9bd2be0fb602ae1a654f01afd74dd53743e3c216

SHA512
de5fab84128f0218b0673f943daf0573dc4e3b9597148fddb2b310507bea971d953f7ae2c2fd3bd7e4ada1a41a823aa48f04dfb2532b13c752e421e3bc1fe1c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32376e44f4a9b882a024a01cb3f96b98

SHA1
3b830191bfdf848e9adc59794baa730029febea0

SHA256
2d13bac7ca86c7c3ce6b735c59264ad2059ccae001e03c43bea63303dce2f41e

SHA512
aa9c76283c23d68be87e5695ecd435e27e006ca6796e89d7d5e6fa0cbf3eb473acd6629262f68391e0a2907e057a8e8a6106fc5c2a57fd156615a002d41cde19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17B7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1874.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1889.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit