62da5b59e3630ca7eb6d562a9e6464583a81d53e18af159f5699d7c965d2079b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

4535131d01213ad1d7067eafe3d421cf
SHA1

42317d249f6d786dd673488af813f67bb4514c1b
SHA256

f18b74471e692a7f765ab8453bc34064938c836acc1ead4715b1dbafffd668ab
SHA512

8ad056e42f19ddaaf93ecf5bd9aabef9315a201209fcc677a6087e95119be68c94e732d3de57bb2db5ffbedfb3a08dd537df41ca32c7b867638f63ae5c9edd8b
SSDEEP

3072:S3mmMlPjY5It51yfkMY+BES09JXAnyrZalI+YQ:S2mSjzbgsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421478936"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8D0CDF1-0E89-11EF-972F-E61A8C993A67} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bda5e5a7dbfd4e8fb2b6fa70763aa698

SHA1
8765a67621095cf45e623e7d50400b09b5a1c663

SHA256
b6c940e8e7be70c5c827ff822b05a238fe5dc914a561fc5de86d20e6c94de62a

SHA512
8578a380ab268e034225f685821d6b81a36b032838e67a4a08ad520e4d95b0629864abdb0e903a0144c0703652775021173846232731fda71123f8d609b4c784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83a86dbedd6b7216f248dba693cbc259

SHA1
0c653565969699285d5197421e35a64d57fa9c74

SHA256
4f2530e599d1e2e45a3ee9ac011f98ff775af669c8cb1e854ba35ec22fb06ed8

SHA512
c7c709e232dd88bddadbffb0be1f13685a70d87e8e942c38c324b20167e9e656140f98918b367623291b8646682ae41f90812a7f78f95d7bce42d9e1b9fd8fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee51b246d76737f6a2fa77768dea93e

SHA1
6b69df5474786204eac92f9366089376a699720c

SHA256
1a51809a63fda5f3590979ae9ae4a01feb81230ee6e69f96e8dd0e4e3267d224

SHA512
f1b8c2b1a480826b1d34dfe24ed1486fdcd8073a069dd6520a2012ad19928dfa12576bb777b5e72b53807de2f9d200f963a82734a393b1066913e90d9913ff8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a36fdd0b2957af8d42d5fceea8746a91

SHA1
74e96b29105b5d956a65f00af38b53ff6393e355

SHA256
8ce7afc06dbe2c60feebc704494244d4bf649b6390eb7a2e107fa79f0287e60c

SHA512
8911a21784bcc54b908805f0c1f1734bda4c0168baab70fb392ea1abeb53da8f88410c81909f34350db3287d1d6db4f50a0531da6575f0dfbc534881f46d45ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8d60a96a983005a320fb70fe83298e3

SHA1
c86b5ff65d181e856f2323e67016d268823cd361

SHA256
a144d79984262c5cc8a8f4f3d91c8aa150779e97ea81bb9d2de284aba7610990

SHA512
e4c337eb5446de82ca82b5a1059f65295cd6484713b6806c571199537335c106bca8cb99f37d8661c5252ba21c9b44710bac3fc68a6f181b54cfbcdf47a8f22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b18290cd9bcb42ed31ea4f13a9752901

SHA1
90672358f4bc532e17746ee917f164c90a247a36

SHA256
d62dfe27ab725d22120e19c6ab58abd69d96d811735be53229c33ebb4ffccbf7

SHA512
1e9dc38d8f609010dcf9d8dfbac4e38b2c2086379c60441f4598e99564ab6cb973733a2f1e46d6f84ef8de92724585a2c30856d9de269ad75c3c50953d0ac600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3202ba8eda01f74708123697a8538c28

SHA1
159666b8e91219937281c774033cbde3fcf34658

SHA256
b311b53c019886d77d94bdff1ef12fda6639baef37f98ae3b88db29c43b026d4

SHA512
61697f4c67a064b12750b01cdca28ec6d6f6fb4fcceaf1027e77913d44f87b344c6f89394ce438ba9ee34ce2adcd8047003e0ec282c8c18455acb845f6ecee1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1df608189aee903b32e2dab67482013

SHA1
c40550301697b214e755f3df410ef8bdf665315a

SHA256
1777b6d849e042d6033d7f31763deefdfe4a2406155e654b0a222932b8890e54

SHA512
6112cfba4a9555d43b5f60b63dcdbb17b4e07df035f076e17aab1fdd722cceae7e709c58478b232aa5b13fcf934c6e28f724a92987d1c6c124d012c1b16db66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
800a6d2acbd41c51af4d009436b1547c

SHA1
216861ed9afa85b9434491021a2704f29d6faed7

SHA256
ca3a427dc7f21dd676df87e1df60ca78a9f278720137c936638c371d6a95e3a2

SHA512
85d5769eb5da6241bfd988aa4a88df9c97e750acddd5dcd24c4b0539a37b188037e5b68d6f006840da73467562aa280ccab325993b1d2970bdc219cd787fe16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91b00916be5b1e61c75f9671e2d81413

SHA1
941ac176115eee29dd7a483e031f91002bee1adb

SHA256
c26b9813e82d7d1623d8f2236aef9b6f0943d171dfc14f85b4c1381caa7d6a2c

SHA512
0e9fd701ba861334da61d9e5f2a67fbf6596d9cb1ada0a2572466d7955b068fbd30cb82760245e513f874ed5008269e7617512ef6ef98539d074de253f540b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cef918e7b5951e6a0d52aa4868de8b2

SHA1
44b7dbc8452a99228dcb9802094dbaf07e460a23

SHA256
9137f14a88b7de010ff009a6545dc387696d59e18088bf014ce6fcdc005345c7

SHA512
3123ec0dc2a1bf3141353a5645a89909f081edb12d6f5a5e04c4b4f0ba29ebc0e736d8fcbe32f98772d9d4e47d66320311de6bfb7c05bfdefdf02767428eded0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
387ef0fcbe79165f63a1057ba06ea7cb

SHA1
81792071fa85967ababbae78f566fb5f65061d5b

SHA256
8dcd359e5a163908d1e808ffcbe06c56e96c9b1ea69c893ea5f1b8c9fd4f86c7

SHA512
5111210f6bdcff13c155485ffc6305dc242ed3168b28840a9b3e7e08951c437c4c637c1808081443e38935e19b27f8bcc802dcf3e9c0bb6d9e8cb231707bbbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0806f97cc3562d9ec2d50cf5664449e4

SHA1
5fd6b2b1e457ab83c1e522ed2c418591bfff962e

SHA256
b7def0ce68ce17a1a2fa5621dc71678a2511399f21489bbaba086b46e6466cdb

SHA512
d7ec244eb3203d9da1b3fedbdb60c955edaadaab386eb4915974ff1176bc7f84afa70fa2808c145ee54bb1e698d5573090a64e2f6a7b4bf9d2f49f0084b668a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5779e6f5b5f097ff5d279a8e22f35297

SHA1
55d644093833d2202eb75bcdaf120b1c294f650e

SHA256
cb539adcf954b78d64e8af3825242f325ff9b32adbd87bf681cdee11a5b518e1

SHA512
24c4cd098340432c4d0d4aab988b65b031cf5a6c90153a2a4efae3e215fe6c1d0a7cf933a9d85e9952b1939e916b26e3a08f70101237551c0a7d4047abb53cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a11e2214ff96d73f8ff1d44d1bf355

SHA1
9c6982477a20d5b0ccd255e2b46d99e9a7ba2888

SHA256
284f92c5193e89cafbfa9d440a100c8960b8f81b4bddeabc749ad657710c59c6

SHA512
c3e60d54540fb94499593a00683c94f5962efabb524014769ecf8284459cb77079663188951fcd70d44a40149f76b0be07162e1ce41094444742032adf0dfd13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24db10d9543f6849be57b5e5342d63e8

SHA1
962f004860ebe553fb84d9910f1cc6a6b01afbb3

SHA256
7fb294cb46526272f243f49f860467aba8baa02cb4777a7b15dc9bb5bc7ac4ca

SHA512
99c27e7404c572e922f63e51d3f89cbbd95eb0d67bbaeee619f86eb93b7c0348facd306b74ede9b96962d3206f04c9181c63776ef9066fc9c6d143780388369e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9491ca864533add6f28b673c8a06baf

SHA1
a1a8cdad327c44a5f13f88ab778c6ed06b8f6451

SHA256
3d324b52bbaecfbf3c9a85912e114bc62e320982590dca04577ba5b55f422126

SHA512
36ba6ce37e555a6d7bf43d87d020ddf56b562e67df47f2e1e12956b9024d3326bc5a90731632b7916340e470cb2b97d4e5f948eb2b5bb5924fae3c635df43437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11941bb0b25f4097fa5cffb620b78137

SHA1
8224216268730a1c34de30cdae67b75be49f0569

SHA256
d5e62c04ce70c5042c3f033ea86dda00c1bff786169c227707249ad074bcea7b

SHA512
f9bf96b1615a8a07dd94fceda5673da8bdb9ae8ee275455ff8e5589f1ac7869e91128a4e34d44a6c6217e9e51be56354938c43f94212c681452b99659b749c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1290.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit