280b21c5f8cc0e28dde6a591641de3de2d8bbe1fe82d9d47fe07fe1fd4b3d33b

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

b19b7d3e678ac87c33c5ceb7e420d78c
SHA1

3f0b3a87f78277b478f96f4731cce98f69ad3829
SHA256

485974c3dc02453d1215d1227ef08874e82740810afac6ae2aca2d71d6468ea9
SHA512

35cc88472891c808ac2175c5c86a07f1adf233d48be196685b065f3306a82dcb526701a9bffc6845441e5eb64cb8843cf675e0a3b0f2e311856aab470f972210
SSDEEP

3072:S17CI3N7oAQyfkMY+BES09JXAnyrZalI+YQ:S1/FNsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5430F221-0E6E-11EF-9DE9-520ACD40185F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421467117"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2760	2960	iexplore.exe	28
PID 2960 wrote to memory of 2760	2960	iexplore.exe	28
PID 2960 wrote to memory of 2760	2960	iexplore.exe	28
PID 2960 wrote to memory of 2760	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad6ed0f0550512c61ffa836a1ecd4c15

SHA1
7383d99b47de963bad6061d3aeaf8b82821d36a7

SHA256
6c76092793f28df6d53374d07d40cec310024b47ad231d4cbb69d38dc21aa2d5

SHA512
8a764d56894314eb00296d33bc173bb0ce4642ab373454a96918213bdd1f6b5993b20b610cf9c5ebac46e476688fe13c11fc49fc2e057a1c44bf9748b60b582c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
470bdc9b7db4d23de2e60e3b303eb640

SHA1
191c60f9a417a7f9ff09cf70553fd5790612c39e

SHA256
6e2fe225fc8185ffc8cebabae293f800364da1153400fb277231ad933b2a40c7

SHA512
3d1d28f03dde2403c271de51ba26f0f70dec58bcc235555f0b586014fa47f38a7d02f74df6eaca0513cea247b8238a321c0b15fc0d6395aaad92440c69ddbe9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b512062e2067a10fb9a08fa25590c18

SHA1
54b87e22c72e5f18f9a0a306fb50ae0e7c6a3312

SHA256
1e7479ccfa2610fd40181b2b234a8d86bf63fd5c8a3714824c85271257ad5d31

SHA512
792551ccf94531c8c7bb938ffdd6e01c2a7dbb24e9635e0c3ae580bf8813c7edc5292f6aa020a4dd3becea351ff84d0a4465023bbb79aa93949d9123ca95ae50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dbe5ad90cc50a0b83286330805cbd7f

SHA1
a4cb7dcf6e9252c5dcb97b859bace10050a9b6ec

SHA256
68324e8367391b782c2b3bc30bf850f7912e3420a7ebb9d4a8867de9469a071d

SHA512
2c658bb056b0a0130c863c03154bee0ab9a12c3c2db591ffb422d49004417789492b2ef7d7f4a65228e62c22de0e4956a8981127786129b08175b6c2d4ca0b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c754f3a2ecdd7fa6a22f25d77aad2f50

SHA1
ae7c5ce2cce4833da4e9110aa9cac64627522079

SHA256
dff71c47699138cca01ecb984e3c239bc7b65532f9783ff277ac52d666f5d45b

SHA512
951ab9962d3e3d156ca927a00a683d5bfec00efa200644ff237956d068898f815e03142c4483d9f1ec14a8446e5ba5f9fcdb8fd7c3274148bb54e27470d53978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0a760f5381b115b3f2e68a3560f803c

SHA1
e60f82f7ff94054ea9c30ee9f6c95bb6bf90643f

SHA256
fcfb8ca3a93508ad3b5809164e2031a5c50b3fbf6c54da4a2eb7b1dcc03c000e

SHA512
f9308bc6935bad7326412585707c07295e5b7774c80917690d3e3a26be1b71403e8ebccfad211f17ff98576684ff704455d38c29e5f06e3fdd0be353b1a4dcd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7274c7d77e9870ae4a8e37e64adfade7

SHA1
21ddde5d1ad0f90757b9b4162d2263bc0825b798

SHA256
9d57dafa5dd3e45447aedaf32997bc5f0ca0a167285f70685e2c96af161bc720

SHA512
321e9cf1f11c54d95b87494f6eb5f15f4429ea7ef439d576bc4d4175f7ecc3ab5159997895e1cee187fca1c000970fb559c4e3fc06174361fdc355dc43a45148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06671e3318a08d6340c248e32002ed43

SHA1
f7a008c72f2bab3a5dc4407627599e4258c1a61b

SHA256
dadcf94e885cd9c65c65a00ba3ebe5707e60a014c02715715201306c7b578e5a

SHA512
ad83703ab6f101a3886d9b6624cbf4b9be6385f8e356d76339a9399c3e5a32244c431db7193ac432ec395e23fd1bbec16a44071561354266fefc67ba43229eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c58d8eb3645d037ca778832ce1c41db6

SHA1
291157bbeb97f7b4d8f97e0785f787b5ddd48828

SHA256
5437404eaa1aa0f235d18836cc0f8d57faef68b6fc405cba1f43a34699c3b7e2

SHA512
f26200eccc3f1b1fa75aecc556d40b479d514bfcb92023072ee80f8b59f4bea20689fbe7c4436e0e128a99387be986922ed55ce20c3f126875a5d5fd918df347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9126efba445bb419c215c8c2d3a7ad

SHA1
d445096a96266d28ac0e085c75b2f7aa9807f62d

SHA256
e8efc3896633e969d2c6ee300925b1b6aae1a0c27378c7c09bb5f2b5f3f5f75c

SHA512
e27af10a293eea8123af41e8d9a24bab1fea2868dfb667827755c927b0c97d9b89816f94b7c6f6cb935200c4baa4d1abdc10dbc4dbad8af88c4287700690fe4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a163b39ccd4eaba4b1e2308c2894286

SHA1
f40675d0a89134c16254115b6129390373f7757a

SHA256
80820526a6da26a579ec44b208db587bca4bd71a9f4dba7edda27925c85c2387

SHA512
1fb844bd0de47715493785362aaf5aef4da89f9523db8707524a0e4896bcc8f6e41eed28dbac7404f4c0db64e27bcdc7582d45fb348ab62216f86e1166930e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f09ca81a9e4907af091634deb0ef588

SHA1
5c50067e9a2a9014100cea94a1af5c94dd808782

SHA256
3e2034e9c13296b80d4ffa624e71dd404b762b6bc7684c72a37ac6825d25ea73

SHA512
6358a24ab4b37af0a2cc611f47bb7d80eb453e59fded17a44af67bfe0430a3c1318f33fd6d41c2de111537b8b0efb73d6debdf4db387c36dc4901146f8a89221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bc1e366430bf25a84df2c50a21939a3

SHA1
80a25f4cc3c8999a79964e7da2e6629518e08aa2

SHA256
b99b76683080619d5edcc94d500a557c385dd847cf36767847f19a1e42e797a8

SHA512
1becfcf4a0bb28d2173da3576fe0e15cec8d90448ada8d93c93a7dbb8abbbea33de1470fe2b175ebd87c70708d46c6b633277fb73bbf5de728a73f7255e8f756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ccc1840d0202d5e601427e9f9a11314

SHA1
5d21840c51a3b6c15af2d46349625311a44eb194

SHA256
6af085304c947257f2e5af30d07fb1e864f3efb2091855121ebe929bc6792363

SHA512
95cdc9987283fa84a557ed75ee0a36047f8fedf3189eb16b7c58afab592ae419cdb30f6c2852525eb77aa9582598853e9926eb0da9dabce294b4ab76fef112fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1e415d986bc7b2d9ce880386b01cfd2

SHA1
a58ba357492feb1bb4fe6a9f9e3e8fc598a810f6

SHA256
4e8036d80c6107a059d3f30016c0be934d86b66a50c99506ed83962ee12c0fbe

SHA512
98dfe7dfb5efef74caa5645539882fd3b8adfa9cedd56e1d9ca07d2ccf384689a67415cb37a6d39836733b2515d0edec8e67547f2927ba4303e2f9d95e9fb939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a49b5c56c7b6b296b2ea146d4561bd1

SHA1
fef7bf0c07c3fc6428823997eba3e1fdb7d659da

SHA256
19e9b8bd210dbfa90d430ec544e9e6f092d5919c01be54be5a4a0093084c1be0

SHA512
551d2170f8ac66a4608c201ef08cb11aca36c596812688c6614a3f3f2dd464a35ed12e0ec3cc93f55855b7919e41ec570a58922705f1c38fa631edc8f9de20da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4cf01fca77da2df357faf4f340f413d

SHA1
2be5576244c0905c77300c52bf6139dba4ffb94f

SHA256
3431eae55013b822f4a9ab3e8413cc6f77ab6d54669380d5fcecf2e0db96ab23

SHA512
69feb4e35833bb660ac0aa05bde0d0d747ef3c6109b00b588466a07a7d16e099fecdb2615cf42c5b5d0889be95143d4d17da4371effa5326b6273553e9ca5c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4138de302a888448be373428d47e3ad5

SHA1
c8746b6522bd5390b640e495a0b3a4c0977a361e

SHA256
b8a157694b76839223a84c9694d7cf4e8373553ca9a60228f8bf2222cbbd16f1

SHA512
311a816931a0dddb99fff63d861392f827a1c7e408f8c41c7d0d1af50f699b82dd0517d76eb4728ebe9ccf3e2423b9226934cd04df55c821f40dcbd38ae96615

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1354.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1426.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit