a3696e01266f2f4ea5fa7a173e4c90b99df2d9d9100169f75a7671d70f1c3499

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

b9e0630ff685f1593c9c5bf52d4410fa
SHA1

e09e8a702e9a7ec571efa5ccd38ce41aba67f7e3
SHA256

f0bde809ed27d1a825a924974dd2c34fe59b629632527515a59b390819fdda2a
SHA512

e91b4e3b08a6450d4adc63ea43dbb3a42b41b3a90e1d4b80e42737bcbf4759c01c870c5d2367cc772af02abe94fd9e09f898a73b156ab703bd02fac6aa76a65f
SSDEEP

3072:SEChXimPou1cvA2FvNTFhJ7Iq2lnolY+r3YMHtdLdUlNRYYshvyfkMY+BES09JXu:S/CL9B6sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421501215"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B82D1201-0EBD-11EF-9DB4-7A4B76010719} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1224	iexplore.exe
1224	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2916	1224	iexplore.exe	28
PID 1224 wrote to memory of 2916	1224	iexplore.exe	28
PID 1224 wrote to memory of 2916	1224	iexplore.exe	28
PID 1224 wrote to memory of 2916	1224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cadc9ce9b7435b2206344d67950aee9

SHA1
fcc0a1f3e4ce92516f537709e5b187d1906ee231

SHA256
069474b55f156c8b475f03c6ac2947562ffdab796a464088795c00ddc3c8046a

SHA512
7d5afab4651033fdab8b3776528938e837e1d24667a518c05e627869af92548179bad0699e8e107f1ebd92526438fb3a897f2037f5f97ad5692bd2828c1f7f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff3cc2285e538e53869693ea78e4b580

SHA1
483da92094ea39224983ba36e359751050d8d50e

SHA256
248aa9aa748b4591cd1ea0756ee912d6eb53b48d5bbe24525adbe3bbb7731eb9

SHA512
6de2de8b0b657989eaf3c7dc8c1d87e9f8f2c87bddd61caa28d972955ecdbc7ee7c551886fd13aeb4b20b23f2eb0341993aecf27cf0f281e70c3ff9a8c685f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9577d99a3a75ceb591fd7556691ea927

SHA1
1e0d827c00fb3f43e8ffbe937a1db202e32f4c9f

SHA256
f2a70db074236f23e426a8a156a99f62c121781f05e62ae7ebd9ed099409e693

SHA512
7b942b3991778a83428af953a8b01388507d9b432c52002b4b1cd89e7873f52efc4b795ce66998d4afcac645e2e43a1623217bb0d4b70562ca37ad1682c9669d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0858ec78ec07de570451ebf5a3d89141

SHA1
bcb31d16558027fb8caae71a2afcf7a07ef4a514

SHA256
5503e87958d2c19906fdc4afde6b23fa87c66909b80c8aa4b7629915ac14528b

SHA512
fffdb29e23178cb3be209e203ed23251c857e4ad22411b8497493664046a1fcbb67d86295c7880da5752a6f27f8a3164bc1f18eb3434b726501a5cef1c0b1fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b445f46daca37d5f81ef36e8eca6f3

SHA1
238d2427062b9b688e77ffe26206211ac0e7ee5a

SHA256
d7ea2b7c34d138ccf8987f0cc6b9afb2594bb9340b6fd0ad6fffa7be398dd286

SHA512
21b6c66f380849ec384786cf6f81337e4ef0930329f90851e87a22a560ab65dd97f8ba5176789c82b6c159486e79550a969fd24c80a34eae44b26c18055deb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fdc081425340e5f4976612e5eab7419

SHA1
5266255c1c8786dfb6ed80fa13f5dcb59f7d423a

SHA256
99e59dfe6ca9d0dc4b6b722e45551ee5b46ab2b672dd35561ddb40814cc8d0a3

SHA512
7f7a00e7eade3c4a881b1bd4f3a71c6ae58ef04e7a095f36c0bd698b562ff2ccfda4755dbb8df9aae106ae1d5041adaef4c82ed61e89219275c89f0d09a88c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ad17c1784db00aa0c581fd70bd1b2b

SHA1
e2e6cc6b41b673e0b956757ec769b43b47a4d597

SHA256
538aec33051b5f441fb58327392482db99d8977a9e94d0b49b132523799d32ab

SHA512
717f60c5acc33aba8b2f35f828ce7a19e0b0b75067026ff9181fa64e385fca21ca6c8d2d07d1f558ad2a9d67c53f9653fb26627db2363ee3647fd39eaad6c9a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbc124dcedbcf0528cac457df5c257ba

SHA1
904fe3f254e972eeae094b955fa72f9870eac825

SHA256
858fcd5b1af6adf78879fcb4bbd92c0a772ca42f161d3fb2ea5ff405870346e4

SHA512
559dcd63f568b6f98a882f5d625851a625f0763ee1a3f06bc358dc0b4012eb866c29c6cc2baacea3a5e13a2c1e8e64d255161b5d77f4b284f26b57f6a22eb0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa86b8d83dedc5115ea57f2b155e3fd1

SHA1
da1a79d78012a9c3166c8ba915840e077d9190bf

SHA256
80d52ec0412fb118fb25062b7d071fd517e0d3a812ecc440af5c06e878b9abd8

SHA512
53411ef3059aea864bd1831f46dc44d32659918c5cad5230f39fed97806dd70a77c8784802bf132bd0a311389710d739cbf716050d935d97736dcbddb550b508

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30C1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3143.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit