3214c50d351c8e7f1d65944f06e9c298c96cefbf9ccf8b3b5b360d6471280b23

Analysis

max time kernel
133s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

70a058185d0e26655c3be692f7b4f0f3
SHA1

5441eed215c123c95ed49d2686d54ff266de8b11
SHA256

4079e759c60ba1b4b3cbdfc8dee083f726294dafe70c64b5353c13611e88bf18
SHA512

07ad7eebfb86d752f1595e7475f9732f9614171b54e1ce98dd09a5da9b872bba552738bdbd4f5f158f0d86dddd80df112d99c1b72d26ea9cd5dec0f2c6fbe8b5
SSDEEP

3072:SXA3ImfBOrGKyfkMY+BES09JXAnyrZalI+YQ:SXOfhvsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421539175"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15EBD181-0F16-11EF-9591-6A83D32C515E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2528	2968	iexplore.exe	28
PID 2968 wrote to memory of 2528	2968	iexplore.exe	28
PID 2968 wrote to memory of 2528	2968	iexplore.exe	28
PID 2968 wrote to memory of 2528	2968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f4b72a8ac6cdbfe3ed97c06e97659a

SHA1
132337505130909b0dc6edb61d839b1726404d94

SHA256
7e49c39701e79a18f23dc0224bcd4af24dd1d0531b0a44e5862e5582f697e41b

SHA512
ba0aeda74bfefa1cbd11cbeb20cfe4df9b127d754f84e0efb5fa903c0dce0ac8562506fc7e8881b515e5829a8684bbac541f6d32f8d13a4ce166310bb1d358a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58b981ddd4adc77b8cb2015e5f179a3a

SHA1
4d685b2d9959656e844bce3c6dc6440d2db1fb55

SHA256
6f166dac6e7b1af0b4bebfce6b4536c241abbda779beb413168c46ffa367cc9b

SHA512
a84667a84210e7944ddc561670380bcba1827ea641eee5bf860dc5a580f9f8fc84dd0be7d560c0b66522e6001bd3c8e3a9ac370992f417a1938c57c0c2786cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23a5a85129d917e7552b06b258ab2561

SHA1
d34ec0c8535004960dbefb8df889460877c70de3

SHA256
e3b460f1b5ba037d400616d6f73c987cb55f9b268601a545cf1c533624f9ee66

SHA512
690d45b4e153d6e4b5cbf26a9acc9c39dcc9be5ad56bff94be052b94bb62d81314dfca97067125b1b4879f326998304a03370ad9ecb42f4ece37b9b90a7c97a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d1bb3d400808ebeac1452f4ace135c0

SHA1
db4994dc744eeb41b7cfa3c2715d64deeaab7039

SHA256
64edfa7223d863deccaa6902243ab301b70e30c102aea082f3ed21854b85556e

SHA512
e5e6632467e7db3a12fc64dc629c3b33e485d3ad52bc76bbb81b50d5479e4548b5807e0b70d34628ae246be2268790d51c5d674794fe5d88f4dd0419636f178b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f62055c6d1e4293fdbaaa90ee008c78

SHA1
14563acc185b805756b2737a084db3034f782831

SHA256
b6ab46cb18814725ad95efb2bc0e49ed3df305bf7913b8aec2a4348443ccb608

SHA512
37e95a803f34daa6b2bc3549c6519671f63833ddf1bf2cbe1680d0e500e2c0af065e15cfefb6cbc81891d6feac270608bfca4db6bda44bd5f3cd26424dae884c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
711eb67d7ac23109ff826e59cf927ee9

SHA1
277ebe61fc2d83249b6aec767651e4e8a3fa285f

SHA256
c1c81065efbf19478cd7e4c51c00050c781ffac00cddb92321a1927b11d5b25a

SHA512
460541a259f11cb7fc685b1d15a53a3f15f535d7f277bf96490ec73b97ab2f7eb8e8da2f0d8032c0abac9e734f6b80b74bb7d682de040ea350c55e4885bf1ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
193adf40070145dcad07cbbdad46ab3c

SHA1
4155c1d094a4eae4c54813aaa5fc691199b54dc3

SHA256
46628aff47d4bda2b85b0f19f449712d7e85cd16e7800240bf83f18c96e1feac

SHA512
a684c04d6920f0247750fdb55e2ce5fa31ad5df80062d817c25c022ace76508a81f9b8392d11632c83d69f3208a8cd29726025543390262c402424cae1689245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aab4934c34edf1718723776838cb218

SHA1
41074e3d7da46070fcb241400672c057882c3514

SHA256
5fcab596a6f02356235707f4583900f85e521c505c383abc9aa20911f11d53d9

SHA512
d6af881e9a4348c7f397ff3eef0dab9c4ce6359ca3519865a9b4b32b24acc7a37e5e6732c0600af2beaf2727e03b96728c9bd1fe408c790a8de275bd5dc4276b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02be8f80e6f42404fcf056fcf20208b9

SHA1
1f470649488410823461037e49ddef19ede00ba7

SHA256
0846437ec7c713af6f1d287255f035189926b0235a1f789a05561b89c2435a2f

SHA512
8c9d01476c3b85ddddd37f8ad0ef21172440e47d5bbd70c3bea9d3ac9772cb736e101d28b71c8c20c1d71e32f5e58fad6836c2a6b33994012b80356aa16fb558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac795074523b0c5f08ff1e7fe320e0d4

SHA1
093cbfa0fb7d54e75e4701804a5324ca15addc87

SHA256
75f1ff724f5f385be8180605b917778c5692479f735c06934b51dc50f041045b

SHA512
3454a28cfc064086ad5c18a01600859eb9ff7014c6297e891e15989a3ea98091d777defa20e8dc27681f36dcaf803bd9b69440d6dcb7c985ab6937ccae3b6fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab167F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17BE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit