99a772f06777f821772aa90f5d9e4e660c7a43eec46d4382109d2f06a4c345e1

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 06:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

e08afc74cb3152e8d348478144ae4925
SHA1

c9f2d9ca35b7d79986b977954dea9357b96ea49c
SHA256

7db5991eb5b73850398db866ffc379590bcc3bdfd61d078f19ee5df1855b0339
SHA512

54478259003f3930ca598d8dbea555966ebc27625bc93916a6a46ca4476e37fb5ac2e1ae75146081e85e6edad3aa573907f9c186b7c55f35cead1f70c4d67c63
SSDEEP

3072:SGD+Vg3/EoQwyfkMY+BES09JXAnyrZalI+YQ:SGzEtsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421745259"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDB71F81-10F5-11EF-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2548	2312	iexplore.exe	28
PID 2312 wrote to memory of 2548	2312	iexplore.exe	28
PID 2312 wrote to memory of 2548	2312	iexplore.exe	28
PID 2312 wrote to memory of 2548	2312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c5b3ca54f5e3cf56818614ea3bb569

SHA1
5c7223a227d1136060281d8c979bddf6ff003a17

SHA256
c0f664ca43ac5f7f50a5393560d91d2404ebdc6f72b60be5913cc33ef4ff5cb1

SHA512
897f2e8099fad9e63a146529278444603714fd05a9b4498962dca5b60ec3f0bc386ece454fcabb49f615eed61936133bf0209c07b1f7e166bad561f5cf86d0f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15e90068fece4569c02052c1f54142ac

SHA1
007e55aeb2b4ec7319fbd7d966485d0e23762258

SHA256
814a6225c548963f0310479001261fb6b0b89b08f7a201168f863a81508bca12

SHA512
a79307f88643d3078bf00267fca6d0b9f9c8d7559bec14d2c81bcba6b3fe0989f15916cb2fc0ec6d0f8223caf2a8727ea60019d737211ac102241fc1b5ac34ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7adf18a1ce12052c3f97124bf8f2cb65

SHA1
fa0f812b22e89e5c0dd435cbf146e427e7a5df56

SHA256
195622549ad9e984f44231114ce644f3136db282a55f9f1556aa884aaa56cf99

SHA512
1d7b4266695475ce26be36e392d760d3266cd8d8756008c8a079374f7af8e9e766df06121a606f516eda6462e1f9cdeae451318ce43856d2e6a428bccdb1217f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a00d11e060bd44d1d8f641178c9ac35c

SHA1
810fc060b549137e95c5525d4c3bef463d3b1b0c

SHA256
c8716b29eed2ea8bb666f790cbe21fcc8611e05dc8bd5652ebc63610993c06ea

SHA512
be37f54c24d35a09d76013ac1f11b40aaccb20dd8f3b87f5949e2616be10ea42228a44474685d9f0ef4412b0e503ccf371f710aed7a4b28565cc66832dc4b331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
903a2f455f604c6fcce2c8c5fbf595d4

SHA1
9476b118e65912740b260b51e5004a68c690243e

SHA256
492b211b2380440368abc8f044bec0162cceb0765a846e78cb077526777aee2d

SHA512
88b29f7b1cdcf7dee80e876918b22909dd3a4e21adc50f28c69e64dd51cb20b083d5a655aa2a4a9ac8e5eb201a054020a607a2ad667fd2c6fe81236e23fe2f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94589df7a24d853af3f34450ea870c03

SHA1
9a62097f3248506c4b3c35dd2cca24d3b9427120

SHA256
6d7b310dec17c1da791d0bd28ecf5d59f43529d8bcf280c80dfce5ec20960e3e

SHA512
a7e1f08bca45dcc6348bb782b2ba4d7b4ccd47947fae413b3fc14c531aa0ce7885e9d80fb3080a4e8b85ffb79d5f8352a738fc29264f5098a08643ebe3f43c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989b4db3a1c718f6c28059572e150cce

SHA1
14598141a0a1689bdaa4adc6cf95c4a04a5cd4ef

SHA256
fc39dc11ae8cc6dfa386c6db76d0a965259e789d9d7b219bf6aa9f72dce9ace0

SHA512
fd70c28c5d44593b77e77c67221012ae964a12cf5a0ddc3f66b83427561a11d9c1389c250ddddcebfa2ba56d26de80687acc505d68898f26e08e24e596752520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb556aee71630c4163c156ba4aa6221b

SHA1
12a65f7bd7a52e665ec0bb44f5fb8eee3588432f

SHA256
a02499237c3cf4f20ecd8a1590d99ec8d703e27e5e38188ede96f17b018d5cea

SHA512
fb4c8c61bf1180448d6b70fe49b85fcf8aef11221b2e1407ced0e18bce6c0bbcaa367726c260a28d272ede11ce8a87cf8272cd7a78f15f29e9ea9977e8224de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32bbb7bdfec0452ca185c1a00f293a2c

SHA1
e70ef3e038cbfdcf667b0e2f9cf4bf536d49218c

SHA256
839130af4064776730a450822ea335cc1f2a5cfb7cf30bf2c3c4245d504f14e8

SHA512
c920955f69e23c595db41762a551847be2269a819aff21208e6e8c56a552fc38483c8a7d10bd69872add18e847ea8ec56ec2985c9b211628afe676f5e7e26b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
055133393ac64ea9625d4b39d0f9acda

SHA1
c3b1387259b0342c21d46bbe43b1684fbfee2217

SHA256
b4113873dd89220b6aa9a145bf3c24f3640268bb6dc0bff5999e9b06f4347ec9

SHA512
728c410632751783b074574127f4ff3ffb95a167294be71765b309f52149c4dce09e4a9f1072fdc27019bd77fc8eecd11c47339827a7163f242f27e72f0ccc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af69bac888b92644d555e33ce78ad7ac

SHA1
b644dc9bdd408f6ed3affad49566cb26fde757fb

SHA256
c92e5366ed641fe644b12eed29acd75777acd8640f701a04305ee165fb029182

SHA512
e55dabae46d6283fc7007abc1472cae56ee3c1f5790c2892691ef9475707513eaed990412c6e3f7f679eb32b3be880ab75e592e2dfd74dff6590f2b135bf5463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3456b1aa5b92021de8ce93423deedaf

SHA1
9a020e72a211f1633f224f7c63156c97293b481d

SHA256
81684ae25ef417edcfe4bfbc1ccaabbe42b56c74fc3b797729a066914ed41366

SHA512
8df03c468740ea4b3d53693be2362ca3a60d6bfacc0e6284d0edfc7173605a4f8e2c9ae46db6a7ba82c8e08f75e6f214f757e5bd3a757fc1cc3c8a224c4453e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b9f13bda9ccadf70d34d3c6eac70c26

SHA1
07a83adbb366276bf39e94c1e1c4c6e7749be0d1

SHA256
86b8da34da5900fca81f567779b5e45207d5b0a8c789341f92f1733deb435e80

SHA512
569e73888568f7de8c9ee5aad2fb3c7c331c8b44c20ea53a0c1bed969ba67d3ecb28e38cae569e1f99ab6a99234396fb55244d4c0f4fc5964fb3ce74787fc382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76dbce75d1405efc65cb38447d9cd60f

SHA1
827b3f92a607c8e40185179f8dcb0b213d8b49c1

SHA256
29977e61f3a156e7002d9fdc5874ae48f48767324e052da3fc8a32ab0b4d1365

SHA512
9312798bf054a7a5bcc960ff5d88a45f6d382236d849e4a37e03343a84516bedc6345527690f3065b8c612cdb72c99cf69a2b500d9d145d466162a4afbf4a051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1fe4f9b8198b4271207f01bd1b290e1

SHA1
33e0a9a19549510e09618421202003f4eeb1ec3b

SHA256
57e9e6a5d03be9c5df5c75151a8789923de26db465faca96c9cf7bc67fbd9004

SHA512
f42c84323be8e26d1081385f4a21c0bcc4beda8b79036803704c0bc8a0d3d04a5544b146ffe53bc3e9bbdef28740e492acd5e63a80519210c1600f453eda6bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f20d4a3238dc7566dea336f74ac6fc3

SHA1
25ff4370733d22b3155ee8aafda8349de7cd8143

SHA256
620709990bcf03e62d919ca384f0ed0c938558d9709d34da1759efd760bb98fb

SHA512
5694d5752116857244bb8688e618a5937bbb3b67feef0e01daa47cf4af61d127c3ccafe0260314359663e6d5cf2281c56075d67f0c0f7bda1c23f42753b5cbb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d60a1b86de06a3f7d99799372a157d39

SHA1
5fdbdabd663dd5890f60bfd1573fdd66bc12c4c4

SHA256
5dc42daada34a884b3a0e1ece0eeebdd58f1070b1293ed275a64adddd5e7b205

SHA512
8f8b300a56d26797f0168a162d778ef7e1e31428f99fc68649400b3b37fc0bb8b3ed68b02e1ac6c1306a7842095375a71049fbaeb6886d1b945b9250c0f8b8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11FD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12FD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit