46fd87ca7291b4692bb73f6f5771380c6db5c8b6ce549635e25849a86c5f95d9

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

74a5ecfab72d1d553d83b051cbf9be3a
SHA1

9cd4b4a058dea870eba17caeeaa0f524243a7046
SHA256

38bdb12a29274d81ed883bd479d806303acb87496b7468d9ab7769212aafe354
SHA512

efbe8337da154cbba2f64d143807085bd34a8d36dfe8a9f912d9b4128103a2712a7a022f7abd6a0365b816f9ea25abba5cccc45fe4f5b8c224950e10b6ceda57
SSDEEP

3072:SHOJa+lq35EayfkMY+BES09JXAnyrZalI+YQ:SHo5/sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2645321-0F21-11EF-99F9-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421544128"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28
PID 2420 wrote to memory of 3004	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
657e9c8e0e56c9200c467e63e0de62a5

SHA1
e36c2d9b94b189a37b0308e18a0a56494e5771af

SHA256
5dc54dede38508ee710b6db6d744c4facc786ebdca652afef2d44281aa3ba6b1

SHA512
c8beb71a89ff42b5c3192330a1063a65e0d73352d2c768710bf8e0d64878639e4e85d4cd35038cbd5f5446764c8457faafc5cd299ed2557de735c0eab4552622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
238c28e185eb315dab67dc0edb9502d0

SHA1
2b10a03aed03f6879643b01ecff596cc894b2561

SHA256
02612c44b6aa843af52980dda367c5baf0a283d5792b8b8013fea45f1d77f079

SHA512
6f5dc4d7c97fb63120845c06a16721891aec94d5c0d8f0afdb0fd0cf2dbe164c45905d39977c4ceeb95dd4659dc3a7b40942dfdbb1eb3b873554de95ad099fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
990dd050823cf7c0aecc5b68175446a0

SHA1
280bd1d56ae632e1f446971fd9e2f45d2636413f

SHA256
465928b603d26a9f75b783658fc0480164a3fa01fa6d059aeb8c44c31b96fc43

SHA512
d21dbf4207b4e824b041721993eb0bcfec0567f1c2dc0e2688068e30f06d630b400b907ab71837ec704994e3c9e5b0b1a69b764baf6d2bdabb46b2e918c69231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d606a71aa59427304107855c4e3c1d25

SHA1
02c7a57961787bc974e786bfa0791cd09f0e5c3d

SHA256
5e2601223485faea1e804d22f8def353ea9eee575b6b794d63be6e87157670d8

SHA512
509c6d24898cd7bcf3d1fce5154f102d3634a29d2f4782cc7094a628b0b6282557d11b3f2ed9c1cd69b6639e621d34320447a766c4d4c58611a14f8d7731fb43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49642edba74e293a6b53304534b709ee

SHA1
7a18e5e82ad4b72f7e4ef39564d9fe6ce84f45a8

SHA256
dd583e2de9b9f605128b37f67345f9e0186b8636b3dfb88ce0160e0e51bd0ef1

SHA512
069fa267faa03b5bff8be2ca5190213c7927a58c37ca12063d10796210fa05e871d43356ade8c509c310d17048514f49edc840599bf04ef8fd4aa12275c34528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a8b5264a65572cdd27d4568e58c247

SHA1
15dc216e4c1615cc7c891ca69349bb4b021a4ed1

SHA256
67b5375459435a31e29e1feca370ac0e97fc59b329a01faaf4152c540c209564

SHA512
cf10f1dcd7bf236092afff839b99e31e4a7bb91b22018b20a795493d77b4318ff4701e8b7732064924a39fa69a3da0e27defdd58f67d6bcadce5ef14daa27eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a520f45d773c54508175a983f6f288e5

SHA1
8d78fae7b606722d37911b177f0fa5dd0b8ea6d7

SHA256
3970b342a9d63642d557e73ba85d79c20c7295332da78e5dddfee213d186670a

SHA512
cec43d2b0e726d32cb87915433a598c7e962905d240d2829a92c756486a7ce731175aec6e0e178daa474eb467d5a69138edca3c570446680cdc637c8e8f7a1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be23912d7d18d6bb5c03fab473a30203

SHA1
632a287995807f5e25314eb439fe5907878c1869

SHA256
cbb7d0024e5df104da4d7643982a6eecde22baac63ab6f9671f6fdc795d3ed44

SHA512
58fffcf9e2d0e07d9ef9948f3590de77d36a05e3eb94752f07d21a5053a57b0ee4d51a7de3f6793cd30d3bf9c23f60b0eeec2a8e0c73543da06cda603ea80bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
266da853602890e45fb0f7360aa75c85

SHA1
27e4ee8e09cc52a4fe498a830e7709e944c07f66

SHA256
4b850632e5d22327f37c100d1811da4ff492bf5c7063ddbd8442fe35f08ac7a2

SHA512
d981dd54756b688fbc9fba429f1c9c18f600c098ee5169952d259acd27191cfd2f9a448d937c432e460f8e7743cd5e5f9125ba627255272684a2c2487babd65c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92d18e670f91d099f60ef0889a02fc87

SHA1
1363129933b7353dbf5f581c706a9781e11c3b99

SHA256
dac0f78ebdba4d03dfd01c8c7c75437723a93042e8bf2253df797db525382458

SHA512
aec6b297025460bd4753e9704686330ac26b74dfa407fbe711574ee9c602503fcfb925ce4f2576bff389979f9f3969278240dafcd8f8801ee89a728560b08adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce0b6e19d307f9b4906d6f6c57d91fd7

SHA1
86a7dad227b26e2bb07bbb0279f5936ef537ca21

SHA256
b3e2135d0aaec0b47a7442551446a55d08b59cc1d2c9b5817a836cc6a7e245fb

SHA512
86b129af1a3f9a399cd3a5214871066e4d9c54bb9333d71ab57b9209f981c80445435337c96b35fc6057c30f3b0e0d8d64c3f76d35601e886df52e818439652f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6570bedb3f4159b1719d2163d5d628c5

SHA1
12fb2037040e69d836551dd7e7eb125c6d2cc448

SHA256
b111d6e5d57f53a6e903173b26da624da2d5606a7fc4eaa93ca953153fea6c29

SHA512
0974830f73be53e2973e8b2b53077f0864e17ccd1f7d32292f3724ee2465e1433a903015c163cc775317a4c51a63c2ac179f0def6c8320a778535dd75ded1736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343c64dce62b3ea07d0d2066b1177143

SHA1
0cee2542a9156b0f355614471c825fec779e52f0

SHA256
8b759c5cb1745baed9195e6114800a52df1ba8324ff3588b4d03fd5f20e5dba7

SHA512
f2e3d54f2bb821ce4b2e72f979fdeba9fa0063baecf1ae07101f3ba5096ef448ff88e7bc64ba582c5c11e69c23c122901c1408c725365436aaf0782556bdeae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e7282e45a33b952920285737b231a5e

SHA1
40570510d89b1910030f9b30b56d2088a40e4f88

SHA256
d7339b4c3ee5a677cae6922d763cb02ac9555f9947b0dcd72d61a914edd0da91

SHA512
26d2389522304e6d60d7f2c47692932553232dcb0d61cef1632dc364c51a189e06dcea3d14f2c793164e08085313fb6caf39e0e3e0c2be5e3eaf896dfc1d0999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37179668854d1c0ce3bae57a81399ee7

SHA1
46c56034c07fa00bfe1e1db77b110f4e4841819c

SHA256
ee373966019b99cf733ed7af74a636d5c26795c7b6a228b07099ad44553a62e8

SHA512
68ed5fb11eaae7d73ce42029ae5c116cdac4357b3bf028d6b9c8008d703d4629728bfa230c7bf5d99633ddd1917417aa87ca5ddbfd2237aa84004f6c471d2b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
613c1a2436ba341bf4dcc9118927a319

SHA1
1ffc4d5ba26e914d344c335c349ce590467fd62e

SHA256
52f653fd3a5e9d0e921fb195f3c56b27a02a4bd3b53a9705311b26504920ea0e

SHA512
30539fcc94bd58cfce1583d26484aa15b84d45b3c4baedec0c2e692832640bd1a22bd3196e5e1e1cc715875a4c5b97506d219a98e749abac0d14d20034a84f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d56a04083144b1e2e150ff3288d15e10

SHA1
178cd7455455da7de2f24707003b086825f12635

SHA256
c337dce8204933264f931341b86ef3f2f1ee07bbcbb1e3d357d30322566075f9

SHA512
e5598d9486d16baa260f750c41f9f953a2be06cdc99c5377dbc01a97ea51fe0f670aeff5c15229b939164619ff5d4704cad9faebe9a480f8ff20fa8a31a73655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
466680912d60684b6ca1d9de8c3b73f6

SHA1
a34fa761d3e0a1696e712fbad82c79be57e04eb1

SHA256
046a21223aa3ac50a537adfddf6dd3075dd1a27fc2946f581b12a21a144cfccf

SHA512
8c76fa906a00bcd6d37e9c1dbca31a18c3d5504dfddce647a848489c9f56650d2224e4e2da3bbac9c0576e08dba9baf033aab2349910c90b86b49bec4ae02825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aaac185f7c7d382e806a93b44361d1c

SHA1
083c8cacfef514031722e9fcd06f06243ed8a91b

SHA256
ead3b3fa5d8ffc411a28ef04c4da409b5fc1bac8bb8e1ccadf4e37f4426cf9e4

SHA512
4f73c4777b30e6ae767039b9ac3b148d67fa1db79f022bd7ec9c92f15e3a62d9808ce3b2d1eb9a7c22556f65413728b68b1890450d579fed43cfd3b27f3d5500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581fd805d95f444a2be90d172b16f7cc

SHA1
1a5bc78222aacba8cc9d512bd036a6d3eb728f85

SHA256
330cd93b9ecbf0dcf76d601c77c6c65baacfa7cc26a2b57fa1719bc71c26a688

SHA512
07410fe29f0cbaadb460125ba9f9f7686c20ffa53b3ea4d4b6ac87f31c64852b4d42f7586ccd90b73906884392d95ab1e747875301cdf3a2e0bf3e96271e3b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFAF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit