5aaa15c3ca361405eac6b6ed0b81a7dbc86820a70fabb58e3b620ed48382f6aa

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

4f52497d3677e8dfc2e79fdb2cb7368f
SHA1

4619ee147c749ba14a5f23029a14200b4b4dbcba
SHA256

515672659237aafb5c51d8942a560f3d14300d909b66326796cc8667da6a945f
SHA512

04e49ea35d4adcd5115c84c6bb14a78371797068403e30be1134baed1ab5c42e52ae993a8a2182f51c42d40bad7efb3050524fa3f0036d23236ebf5141b60b8c
SSDEEP

3072:So15bedlrpHT3yfkMY+BES09JXAnyrZalI+YQ:SoID+sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421597336"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84C517B1-0F9D-11EF-B44D-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2608	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2608	iexplore.exe
2608	iexplore.exe
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE
1392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1392	2608	iexplore.exe	28
PID 2608 wrote to memory of 1392	2608	iexplore.exe	28
PID 2608 wrote to memory of 1392	2608	iexplore.exe	28
PID 2608 wrote to memory of 1392	2608	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe515fa5c956c35b50d911aaeba9879

SHA1
107798f7b7011d1af22644af3864fb54f7818202

SHA256
37eda916e0e1f8b6a09c3bea97f7227c547de67b43ed28fd88e819f38c81c143

SHA512
e02f4b95baab7b545385dacccc1c4a39334b2f047dee0c5d38544265c4a7e144b9704c58eb2f2474f3e6798ccf52e3772e06a7e94d5a3b4d663ca43ceebbacab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fdd78d646772e6ae9abf01d2ca48171

SHA1
eabf772cc292db33ab401723b79d3fd0a97e140a

SHA256
bed3f56aa86dd55796e94b2a413d42ea3eabd73e622d98c4f4a43492eee6eb52

SHA512
ef4bae74c032703250833ed1faf4d543b81e0bb289ffdbcf2f1f51f931ee456b613baa07b470d38c13df66ccfee261ac59d06978cda0d1c88174e49a62233836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4530372470913786556277185e01fba

SHA1
996b04dad8f97b0852ada4c37c42594c2ef4a467

SHA256
b688277f444f7142a043d2b60d20950dbda651ea13c245761b4e1df9e4a60528

SHA512
3420a681e3f016683f5ceb683cae7c76569f967391def284398fe72d1a6cb5d8751e35e3ff8e29ccda42381387c0bff9569f520e9d3f14eda4b0e87fab078c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7b3375aa3e919fdda3490f506af84cf

SHA1
77c97a60f907e4f436b8959fce673ae604f55edb

SHA256
ac317ed3024a21015b22dc1fd461964dbdfb9cc59512bc3f58f46a7e30beda8e

SHA512
039d1e71fd26fc3bdb56ea4035e2a4a5c3ffe873297ed8cf4717151e20d12ea09918c297ad2650afcde64f67149ad71c70c529249f7fffd215f1820d5f4521f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
293d4f47351ab4bb72abbe08f8e4c695

SHA1
9f7453189fb3721a9495cb61d924e075d64d2c44

SHA256
641e186b6fbbbf329975d6f0500148c78dd21dadde87221ea7d4b5fa319feefd

SHA512
58165d1e4e71883f27dc777f0f03697182f6b4ab9a1d85666a49cbb3895eb9b6ff01d71f3a4af8fb0673a00f193f40998ad187eada91f961c7e250f5d0e11002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3382ad074200aa2acad271f6aa02e381

SHA1
7324dbd7ffb5f4bdc5a4e1ca68a5a1f77a8270d0

SHA256
de225d1b8ea5ee9fef9f2a1228a7c21ec3a80714bfab1499c4b2bcac7f491b75

SHA512
1328db06f7aaca305751c955fb23245cc148f4b11f037873a7f3715f1b54332ed74e9af3de2abb26fc7967daa27376d66212e504a000e75e5dac1bdae10aafd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
514e9c095a1c5c9c4706410245e1cb50

SHA1
e66c490ec7c9480f9079051b36a5173998d7952a

SHA256
2c29cefd9d8781a18471457b8ff83b18cd07f34d2650a7715e2684e458af0703

SHA512
f20b91b699261a738feb346221129d88b9c413b594d6b31fcecfe9f78342c022e2ca1cc05f1802673a02022e6fe2e400a9c78f1a4495039da67a09a473cab1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c0fab2889f7632f992aee92a24e7674

SHA1
501520f100a8dcdd3233110502907bb470759257

SHA256
a449b621ed4f5cbed6ad25f86d4dba4b03aacf28ce24e9f8acdd9fd8455f96d1

SHA512
1ab93dc38a9237157b526a871ce92c264ac7d5b51cce25d722f991e4d5e5f465c294eb01c198e05a5224aa654ec10a7448f725943cf3abf0cccfbdd283d557d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab3220c5c3ee0144b6cba4eb1cae7304

SHA1
4058d5d15ac40d66cbca755d25f0581278229381

SHA256
64d5d8d9ae287ffa325d2dc8b19bb5feebe23d8e0af5df71539f1448d02eaf2b

SHA512
5a796c39113538439a2c9da618135f2e5bba354a52180dc12c05b39ef43823a544fa1dad53cc66d056c6df73e91f5aec20b1107529a7d8184fb0cd428dd08b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9e64b25ec651d6a92cda48ce2d3a53d

SHA1
1f78289e7f714d91d3dc4788bbe2e8fdd44f681c

SHA256
4f8898785bd5e5357f9bdd1fa368c9fc24c155b65bde29754661b995e82f9d1a

SHA512
3a92eee98aa38c29d0f63130126b06c8a7b7dc32125ca28a6833e276ba8900b7b1ace0f869e43410f61260a073c5715feee91b1b1d39bac881b04807f0c37e47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dda5795e32f7426d8021e83b807aff56

SHA1
3d95a600ef2133f99745c809c734e564d4613123

SHA256
ee7b266651f03ec4d45add75eed7b9bab3c4bf1ed14b38c6c35b78eb94eb53eb

SHA512
ebd8d9e259a7d54e22e537adfda0fa31adc6d0e278fb9962feb98796703c3b339c6a0eaacdbd0f58502f82c0885c0e65be3e3a7050e5d6db5b292f7e1f459452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb6200f0ded3d7a1ad4cd5854ea869ff

SHA1
d565959b625a24e440abd9fc6449abbd5bfd9eac

SHA256
02477c5d383e621d307b939db06a2d81d22abfff689e8f3750c917d926124cdd

SHA512
6bdffae89a7f4e3e29ad171b22ad63b416fa0384960975c8a292ca39b79823361e5136cfb7b19af225cab59c5226909eb6ff818c7e1387d1a73cc5d25a339591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80e9b122a7fcce8d69de59d0eb844139

SHA1
4bc2e06d4ab0b920874fcbea119d6011506f36c2

SHA256
299c326dbccdfd6595b2f7f3e0da140842a36c8900d449d59ef40ca5e8a3887b

SHA512
545b9d1a96c21bd4bbe6ff06083848fad19a001403d5f3af903ae5554415d7f19d673c6afa00918e832356e62877dc36fd4a50a0f6fc126474d65f64462e0718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb37aaeb7d0dd2a9a36a2327e4cddc9

SHA1
a1ceffd6fe8b86f322be6dd76e4be61d9f138d04

SHA256
63a72528624bc231704a3816601b42c3cfcdd70044122ccae3df39f93da4833e

SHA512
d4d59a77783666b4342b4913cc7a89e989cc71bb62cae060c745ba45e3f6476e59a31aaa6ac38748131c7716c06507d56409f6f406b3375c47143c6ef3ab53ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc876dc29592158399a5db0939a784ff

SHA1
3bfc8bba9d5d4565d1a3344e7f1eef33b1aa2c4d

SHA256
89bacb0e461ebf5920692f186cdaefa3c78d8ece18cad8419a0184361783b25e

SHA512
226ad6c1470a0e73064122f357086629bd008dfc1be0a02945ed2aa6391962dd2507656d0bf0ba77642b919c26420aa2c89608fd58d8df17cd698475119a75c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
055ddf84e31a2843097f1e8628525ae9

SHA1
371a1ff8abe027cd2a8c879a40e81b0c6d10b718

SHA256
925a6687a382d0f0211bdf02240799df969ca5a2440946ac13af694654e169d9

SHA512
067c1f0ed83ffb531a7fd09dd80f8e836cbbb3a5c575ebfe64b8bec133b1cc16bef96751e2803efec2360587161065e30493f8c6927ddb339f36a6febcb00a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e3dc5db4f298a440c2aeb92046e39ee

SHA1
196b56e7a65a4ddd8ba0a50552c7ef92cb66f2d9

SHA256
2f0cae83e5d77ef268d9f08e14f30e27d1433fb904e106659a5642297fd4ecc0

SHA512
576c87956f26bc31f64eb530bfe34df6696cb3dc27b79832d1c6469d477cf8a84bb359f06917bc0411450c808cf0b56fadd0fe056a23843b546309dfe46d0816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe60ac768ce9038916bb2ab66640d33

SHA1
abf2f08e53840c0d9e56b4299e63a6c06dd02a7e

SHA256
00e635b6ff7ef713377993822df6cc8105f7d55eb0508ad8a9f5475b09ebde87

SHA512
ea80f2e400402f0227925fbc14b250d16aefb2eae9f329b0ebb6f5d0faf2a64e9e721ea6309ccd9a4c669579263445852716e0770dc3913e9bd1cebb87ace238

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2158.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21B9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit