e9e683ad0cb9b251263af47c998e8d764874df8b4e89db656c5711727d9404f0

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

a69f60b20352c74e85b29d807472a5f7
SHA1

462215573e9bb50ab8f6e13394745cf561fdd7aa
SHA256

2fe9cf36d49fccfafef90f3cbffb2b16f1fdc26939cda9dd46cac667cbda9001
SHA512

3e305d54342a32e45ff2895309cba2af97aaf4fd589102b259c273e4a8a35c50438cbf2a7feb522a46e6c8fefc2454b966c0efd36429e8516ed6db2931e2287a
SSDEEP

3072:SiO1OR2uCh4yfkMY+BES09JXAnyrZalI+YQ:SiX81sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421665528"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A4F9391-103C-11EF-8A04-E6AC171B5DA5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2104	2360	iexplore.exe	28
PID 2360 wrote to memory of 2104	2360	iexplore.exe	28
PID 2360 wrote to memory of 2104	2360	iexplore.exe	28
PID 2360 wrote to memory of 2104	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49802b476e11619696da9407a7aca406

SHA1
f936054dedb85ba5ada190d44ce2e00d4edd55a1

SHA256
23eb79a13ff0399499a26b5b2ecebf9a50cab5b36c5dbad3b709488a8ebbd7c0

SHA512
877cb5ba7bc2b5ac2ec67acfcb4c4b8ed6af25fbb5c70ba196d466efc9f9a8b4e08fc23fbeade0dcf82eb4a9103659cde5005000d0038a8a0c88b862ece12453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3689f7f16a157ec63ab1491e4ee15ed3

SHA1
ca7e5f154f973f5fbe10e062cb3eb51a56e953b0

SHA256
278ad1a2ed61eef194c8ffad1e0bdc22745693d6e594a19dd5715314dfaa9319

SHA512
e2f3c7544f1f59500046ddcfc255d98ab0ec29d5be1edaf7412ea6c88a4fd58265a088345cb7e762f964f7b3e40cfb26acdb708f9a1d2d5ff26e350306aff133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21aab602e802b95c679cb168401145de

SHA1
e3ef2c1b6c30a3b5cc660f2edf10604fa3407569

SHA256
fbbd9ee8b7c29ef54ebb8c9b795429183aae6e489426d402c4278b4792999227

SHA512
0d2ddda3e5a86795ed920e31619871e25e8b3679ea1e8a0dbf56ac22ea7dcf7179061fd064fbae8453b640953f474aec5ebdbd21ff1af358877bce1dfe66c5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1134823088d1642c55cf0931fa7a8085

SHA1
b2690dfa6f86875a33597485a2a21b76c7cf1440

SHA256
c1a3380f64e284769cb62d844cbe969713f2ea1c76bcb9d30fcbb100ee212034

SHA512
0385aee47ff91c7dbd2f9258015417992c5f6f32f572c06ed6f224ebba1d2a66ad28e93798034d4e7de2ba9485b8b3bbcc9f9f0fd32b827869a9e685b4b278da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d02e52d005c0153860c1d87928bceb

SHA1
c75115db119558eb9758928acb25e31f52ee96bd

SHA256
c0db7c5c465eb88939fe1d01180663070f057fed7701d65df879bdca52536b2f

SHA512
342346ab5fc5e4725d3ac51c9d75a32f19290dcc717e5b066e39be910d80c5e0f955284cb3376a5eedb5b5fae186dbf9678165ee87e5cfada24661af500e9832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95f6de95c2395ffd53a5d14965ee5a31

SHA1
d6cb63dbdf662f67e05b7f2eac7bf48e4eb86beb

SHA256
4743a4a048dc33cbdcc581439cc2e312a0b5db7174c6afa15b322bcffaa64eb0

SHA512
331484a2976c21ac19be39f8fe1e3af390ab423df253e927a5fd07090b2848d4e763899a1bc7e2df2bd99bc092eefba1f2fc1f528f8996c1d80ddc73a5842dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83156c7c5e7002adadcc83f9f3b471e7

SHA1
c9969c5b42d6ed1d4bf37d656369bb2c3f022766

SHA256
b2af934912937e06f587b5a2c59bbb2055905539cf3f3360ae265e82c2cfc02d

SHA512
a2fb35387790a88fb173d61b7dd2da5361086d9273d3985c93231b9e5e545b96c10dd6a315f0efb1a7d45acbbfb1ad29486cd71a91e7fd78e25808fe58c9c1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0962561705a95123212e54c7db54e331

SHA1
f7e2994dcf7dc9d58b24fb2e513ffa7d99d372aa

SHA256
42a4d0766cdae98a067d804a22ec8c14836ab4e88e08d8df79c6ee4695bee345

SHA512
86caaf188c2634d124958ec15c18ff5817bfbf947418d55411516a392eda9652ad7264b23527284c5d7978e025fc938d38f6c4e4c85599e78ef5516ea23a827b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf1b409da55ce943503a2f101c6be22b

SHA1
4ce57dece879e87b2abd1dddfa6f545e7ec232ca

SHA256
02b217cf03d02042d36330d3e54cf10d3152c6897351f0c3598ffb4a0b1b98b2

SHA512
885234a761463ecfb28b8fde12a16db949628275ba6bc978e5c5aa5ee480bdfd93da00dcb7dc0861796c699b77e28e9147c90822eebc72f9f832c127bf088c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc12b443ca03b2489ca64f85bb13b7b8

SHA1
ea6bd54408ebc3c090b6cdd5c61bff48b4298031

SHA256
27a703803683ff82619b7fbd2a6710b4f6c140eb342d11d8c7e6b1c2b550aafc

SHA512
6e18a69e487fb3a57949920bd1971e75784df7b93fe81b5954225f4303d9ef916a20a88ddb2677b3ed55b8a93109443b6e6f5199dd9ea123f3ce6d540a9d6431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc8c97f546419c75e9b90f3cfa90a0be

SHA1
5c67955d950086c22785c98ea6b115bb06079f08

SHA256
0299d08980812aa6f99c29ab6ff3409c48b3137e30a5330949ece35f8194276f

SHA512
091b01d7a39003726eda2e788e5cb796ef41e964cc4ae062b6bec87cc7207b5a399e107136b9498cd2e339c2e7cc2382ce90f0140cbae6d1fca6ca2d2f55344c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd661c0301979ce9763d64a67006093a

SHA1
cb90f6f4fc9c9037763cc1243abc091abf36e8be

SHA256
3d3e797e4e4bf232a6a5b787d8e2d4dcc2ea21f24e44646b0c44d55462dd2e3f

SHA512
62d5d1583e2c2a5b3dfb38c1952ce321e32c888212b24a5200bb553d36dc57a9827b07bc6520754dc6c760a6800bae97962625c2187289827070812b6b19af16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70531ce13501802cf9a0db4648d51a58

SHA1
e4cd727ca48db93dc5052d0453e97a8588e1824a

SHA256
8381c22c952369ef65f7972ca2c0f8c11808eaad5cfc75793ebc440435347dc9

SHA512
6010708a8c7c85a080aee569173e8a22e06c28a8e6dfbd8a188f97f1ee47377e0bf3d210880fe0697ccf9aeabb5167ec63ff197e551f7cea49bcc5d67a84ed2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b32361277a3c6bdb1c7637cd2412b0

SHA1
69d3882daec57ffea5c572cf04bbf1ad1481e7f1

SHA256
684436d8ddd2af0d2ef3c5bb0b79a297d153478941b0803687c6e3de597b9d3f

SHA512
bb667c37c8701de71a5008b7a38f1989ac75bba4834b90933e610874a26c8aa78453faaa7205c52d94ff42814dc9162ae9a680e5d5ecf82fff8da02efb6c353e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25acc8d776de4369755e481637a394b8

SHA1
eea9d5240c5cec7e0a6342d82327c63f1a06a09a

SHA256
f63b43919d125540fe8d79b36bac342d7e239c12eb398b6967db45c124db8fbb

SHA512
0baa34789dea621251ce6ced897d1ed4abaf83a1ca889fd1ca4a41925732e01c74c3639999d6dc86623b5d603bb3f8e614b7d71ec28d0887ceca66accd2bb6d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6f30eb2a4e69c607abcabd946b07488

SHA1
c58d48d21d8aa2f95624c4447a592582064342ae

SHA256
193ebc17f2ff2d3d14744a07314f4e635ccd84a7c42c52590cbe54c45ae81758

SHA512
75fe2323451a51ee79837575e8ed056342ebfda994e7600b0a56953c3fccf8ba31e5c51e06d4acc3e046e63eff222e9246534ac7d5d631224f620dc5cb4bce16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfd06d335b50c46ce39faa65450750c8

SHA1
2d778769e1ae0dcc95f176412aebf300398e0916

SHA256
dd6a45c0583e49e86ac000be272f8d082f36f52ba9ba96d85c40a2303e929c40

SHA512
b2b0174ccabb38da3f95e36f416dd0fc50efe976a268c02f5723c1b67ac243acd106bef585ffe563d35ddc2f4b4a4d577b831ffa84a22f9e608e7e13aa51cef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08d4574a7b49369e0c88c5e3dc8d044a

SHA1
1028423a0d70624c180039fd600d2b44a3c3b492

SHA256
1a46160986f47d88773b67677e8c6708c840f12a577e9773e743312645214258

SHA512
d6ca4a8e339e6f350722cf1bf00b780eb796b50ff2fe297db5c36bfde8623f0d10c44f3b5fdaec9bc46831b7b62d4447a9d4e1ec0b68295a6ad93e84c88bc50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit