c958a1568edf0f4227cbc580f7a60b3e1c898cb09e19fb1ea86bc429d14c2f2b

Analysis

max time kernel
136s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

39KB
MD5

248fdc4162405a5dd659346fcbebea10
SHA1

3189d219d85ae3d22b0e8be4eb76d6b1ea169ded
SHA256

ff4b416d4c7c9ad1a3b42741a23db986905f587a88113a59ee0d2ccf3c37e9c7
SHA512

8d0fa4f6f30884c8bb76a77f789fb6d8c83800b3b1c5ded3971d37a696d6c43d25cea4c4dfada5c8cc0ecb6b24ea21936208b11ca43c8dfaf1cbe60998431268
SSDEEP

768:SFhj9RoJiBshs/vOFHXyBc3Z8vfFQ+MANcTWJ+bT4TCXd+csGc22j+9qMAKht+qS:SFh9RemshsuIBc3Z8vfFQ+MANcTWJ+bG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421763487"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0814d702da5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000089db3faf933eaa4952edb65ae0a8a2f76dc072fd01af91b3f0c8d2e9ac3c1304000000000e8000000002000020000000fd1d80d7697506ccc4640746e8829ece095ff75043fac59d8636ac1ad61cdb8e900000002408c264afa6cccca28a6b940dad45653cb71bc85616106456c49c71b5f91f61e3d95080917fb271c17c02715536fe934f0509042987c0a464338d4ed19e6985472a2022d535d529b1fe2ca0e559b01721b25ff7a51ff5b0afd50ffebc838a9f728b5dbba231ab38790fdf4311be22c97d9da359dde1bbd2f904b2b74798dc5aefb23e34421821402f58b843b78f3eb6400000003e41b603baeef2a31d52cdde5a3913f1973d50413c903f0f4a04c2b57b6b1e5c76788fc55f7884c039c6d82e4d26c8945ae51b2f041b014eeb18952aaa4b3f1a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000038a58d25ab10f94e7c6e083004d7acb401593bad383333e428a042deb60279fc000000000e8000000002000020000000ef437cf2679a317597f3f495d72652444d0125bd0f5371ec7c11a116c5a03b65200000000131d0ee7a81e0621574ea79608e479a7302e703e60e049ddf65159d859f63af400000008eb422cd318afb3bae1e6bfc0230fbeb58b190dc8aa23cad739ac716a0a065054e5372d1208a2bed04f5be3574f4d2f355a166d500dca79e585e37aac962b9d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CB86221-1120-11EF-8FA5-CE57F181EBEB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28
PID 1676 wrote to memory of 2308	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d37895a38da92916eea69e18b3e49193

SHA1
6e6f34e2c5a3832d4917412490099bebf5f55786

SHA256
7ebf2492b8eaf45f4925532196910ea330220fc5b03d47d60dbc2414d21aee65

SHA512
f4e620aa6d970d05ce48d51b6e335b12730a4b5f41e639b8c1b1157123723866bb8bf11ded69a04e16c5dc50498a735e5005248c22e8e1ef7be0e6dbd8f9b245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d49bfc231ed1f80b62d226731a40157

SHA1
950ce2146dc796c3ffb7e13801fbcb9936570abb

SHA256
c2a406b49e1ba2bb9118a698c76bfa1f8a64db673217cf0b6bf6a522ba6aa250

SHA512
75d0e9193d0c2449d4b6e139e82e9c090816be703bc53fd01e2bf60c0af5596fecdc6b1a502df25835c5f796f54224f08a89c4d8b8e3928bf17c1d75d0461085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1738876c61c95f1321dd401c4d15d24

SHA1
dc8e05f5c441b34ad3a0f48119f46a43191f511f

SHA256
40392ff44ce2474063cb71fb8cc4a8078c0448e6715503b5a6eafb8a5ad2550f

SHA512
1c060fd48540ae68a278c8dd2f1e29ef21dd46ec48291f56ee0304270e1043e8332fecd4d0ab5d07888720b944adffd78fc4fb4c602c5a8e9725d0e25d74b492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3933431f0eb7abc894a82a31b126e830

SHA1
2977fe8fcc5eb68ce1ea83cd9c69b8696c8e6ed2

SHA256
856c5e6041134865f9f63b8a71c4072c7d512ffee7e7a583cf5bd947d2b458d6

SHA512
aa073527860a50c5b6af729e0dc92a1aa600629fafc1ccb4486bd7472cff8859b0b0132306733e1e3cec3591ea1af2edfa85a0322678bec6a516ccaf6d9b8eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2788b4e66d8c653051add40cde8b692e

SHA1
bba75fefe1ec6d59d3cb1c6ee05fea4f7b16004b

SHA256
d231d17eca17f0be04fa7d052eedfcf55415d821a8f86c59d93b63131cd5c2a7

SHA512
87160c54a22702bc13b17a66c658c9f7dda5c94ae85d8c0effda38bf41385bc13cdd24eaacc7476269af3982ab7521795e1ece0354a9428ce51680dc6ef842e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8829e7db13c9154338f5e78bddc21609

SHA1
ed2a29dff7f284e80219a2b2f074165ca1689f68

SHA256
7ccb0517239bd35b4a026f706bb3d028d9d31d29c766fc334c0504317a88ce32

SHA512
ac4fd6a9b65e8464794c82a7603155fdaae7b57826dd2b2dcdf044a5047ef31b9b418f5e7b72f2d9de55530b8b2282b02e187128a87c177c72e54a5474fe2abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0866c1b0e6a39d51b4f85ccadffdec83

SHA1
145021fedb14bd1906b8f8dabca6293ed76969ed

SHA256
af0b4ce421d9f41b1ac4e849edd77f5db816298d354b9af06c20469543d7834e

SHA512
92d3587571219602b2000c474bae971ca1139ea72b4674b9054df427b260843e0596f368437bf20bf65f66bdab9e6ecac3f4b6fdc9b10d6e113a3a8ac0e929ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1545620c5f0eb84b1cc91620929c3a07

SHA1
e96f1c1bea1e2b0ba49e838817c17f178adf91a3

SHA256
69010171cbc4c39891f3a8f633bd8eeed98ec3c1ab2a0472fb189374923d64e2

SHA512
52c0dbcd6972790f9a16841d7c1dc6d28f565f107cda761afd8984b16d835e71a1b22d843991415d4f497fa39999a52a19bfe3c0241c344e4b7ce4b7d88f6b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f24ed7c721cfb0782cb1e8078e2e13

SHA1
c6ad4d6787bf755b24cf444d936eae08413dcf01

SHA256
f0a2759a11386977cca0b5c550aadf16ce4a1134e4190460c302ed16da9ef93e

SHA512
f9fbdc9d01f4111e6a8efeab7d6cd52b6d89400ff1c11cdfc9d31d8b2f7bae1fa5f14d36124045c05e900f42c74dba980b64534edaa864aab7f6c644744d7a9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6fbd0b45f2caa3bbfacc62b1b5343f7

SHA1
578700d186356b4f00ff6f60843c4d35d874cde4

SHA256
9bbdf1135a1cd297d02406659eb22f04b1f2e43a6fbb74d594219749b728c9b5

SHA512
69a2679abf9b3bf582b2db695114f3bdbbaf7ef4956b26f9799cc9e066b0309344d67caf913dc5395e1340650747749321930f4b06a24a9059e35d1da0be2831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279ef548c86dca1eef7a25ca02c1bbee

SHA1
8ea089c975741629dbd9c69b71798f8d93ee9d9a

SHA256
f11ab7051d80b7225b2393dd80da208d0f80bb934049ac749b76ff23997f58d9

SHA512
073516a0e9b58fe399492e1b34d08e491691b73d61272ebc64a2976b34184a4f439987c60e09aa6044103c60b447ef7b9de3a4c18287c114adeceb7405b4e3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed133e15056204dc1526464bc3c666a0

SHA1
228587541a9023d3f7448d7f4cb5fee0963dde58

SHA256
b1dd4da7d9463814f1419b2af114c81ab67226daa461bf5d51f6ed8a79fcc830

SHA512
b17bb625d5b111b450b473d04c8e41fd2fa5766574719c18c2fddd0fa98ca9df51a6c650c72c3fc7c5c844470802602c9fc53c691875d9542c4aaa600c24f09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BDC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FF4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit