5ce304bce4efe41603734101f0cc322bcbb118e5b9371d418af38d1f3bd2789f

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

71bff001635a5f4be15df6ecd8db04e7
SHA1

e19a43b60c3afd341b2520c4e7df100dbb28a540
SHA256

4873505f0647736d7379be75c912a540a85ac3d1c016af4d8a04accb0487bf5c
SHA512

d802a14d7b09dcb41d37ac17f8e8a19898539581739ab227d8cc386f29739dea9dc208bfdec55e33d80c4e03425367840cbc7ea47499974e46c85d24739a9f8c
SSDEEP

3072:SOqQnaZrX/5JyfkMY+BES09JXAnyrZalI+YQ:SO6x6sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421887015"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAE31B51-123F-11EF-91A4-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1252	2936	iexplore.exe	28
PID 2936 wrote to memory of 1252	2936	iexplore.exe	28
PID 2936 wrote to memory of 1252	2936	iexplore.exe	28
PID 2936 wrote to memory of 1252	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f24cd83c1185731b5960b67864a5850

SHA1
89fab23cfd9c18377df48cb909cc12536a662215

SHA256
15aa5ee6595a726050c05a3edc7ee80651f1f99b1e12d79dfe3e55e7f3837fa4

SHA512
8571fad82476349b2215cfc0058ee05fadb5b4dbf9a9691905f2dc500f57d3355e9305da67cb1b2d502413482eba51d773b7bc6719aade667a145e0e2a618313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35564844a4bab1436a94b6b97613030b

SHA1
3274c964a3ff0ee06f60e97cdfa2897046e112fe

SHA256
f1c0c92570979deb64b76177a9b666c9d1516778888b217d87076e542b5c85e8

SHA512
69f650fdaa4c727ab642def5beaca78602cc39169162b54e2b27b0f5a910601310b3ebf9cc86fd8eb8d034136f96eda1eb79e278e6f43fc6d48bba591439fdbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d8b946a1f5d072a6c5317bbdc8808b6

SHA1
fb41637f2dc3e4c1a7536ac0defe32c6a04deb35

SHA256
46e86618fc29d638b405bba00ea6895855bad46d16a4ae8bbdeaeeca53d97eb4

SHA512
4423493956093a7cee697706e91d049e5c1f43e0315d04826ca1c65d5332e24219b0bc3793271cb4a805115e5b29acea8d2c5b1f5856fcef1f07c8cf5c4253ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96468654911e99278dc432c9d68ed620

SHA1
fb64384146358c0a67d63a2ffd3f6611aa07d6fa

SHA256
ec81b7ce79878e7c1ca23d66f5d13bdd2554d9b0af6450b0897c5cf2cb6aa6cc

SHA512
564b1eb369217e7bcd6d17b90edfe4721470257ad3ef4c404174a6c0033cd5bc9dc15f30d731bf326bb8006be54a7e4379ae57de93bc0e4d32d76ec8dd2543a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12b7a7b68b9757a174d889c5f9b7e83f

SHA1
f2739b613fa89168c57a362a76369a11dc64bf60

SHA256
9515a926b2717caa87a65510c17106eb22c4596a6b71a194fac8d56482d15c92

SHA512
d95813aaa0e36ac8aaa84725b394714662a9bd879479bd0da0df8c529b229c8753b47a1eba511477a94bf3c2e384d070f661cfe17df0cdb66f0404a06db8a0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c16138c5302e58074a833c90db113500

SHA1
d0642a030b193d3474f67c60fc8ccf57d4b4ae23

SHA256
6684bb5e9d2f17e70a205577be49e481897a3ac6e19d5aed22d9aa79f072e77b

SHA512
4b5727ef02a2829c1154da622af9076280b4cf63bd83a8799594148855b2587d8dc10bde888ec460d8b5a443076a597ea540e8d0ffec15364a4cc33b1e95cd4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
562d3ca70420272846e5ff3d36dbff21

SHA1
2d770776f13199f9007321c34087bc200a2b7890

SHA256
b61eacd709fcf3ea56e897ee2457377705aa330c8b733e154b269b7ddc6eb401

SHA512
572f8a16f840a35b6ae79769b544ebf8f07100d9796b4772ab35b3cdbd782f5f331f97dc5eacab314832d7a392c2d4eeeab611fd1bf1bda3f05c792dc7936727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
382e5cf9d79e96f490e818f046c194e7

SHA1
7fc0050c089dad7b5c2d6160648ce124a605a3c5

SHA256
497cf61374b82da590d21437dd5f37bfc43dcbacb2d74a39123ea430b9868ed0

SHA512
82eae03fed22b68e0d515a425f9d73254b2f745c27b29963179a8bc455e51841cf387fa07d22c88b031f04cf53cc359ad34e4dda74ce9417478d5499e272af72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52ae5a6fb563389d70c873612c144804

SHA1
47dfbcc071d19daf3265e460ecdf2beed6fe0cf1

SHA256
4046952c1b464963eec90882aeb83bc77958a214e939e3b292566b371aff4c36

SHA512
c70dc2e942c88bfe426f85e1296f35a6ff93109fb38702b5725cc6da7fb2072b54f9d1764c7d7725f33638d7114b5dfaf6bd529afe7a2d1041ce843f24a6783c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97f79b81305a43ab2c06346be9456cc8

SHA1
a1dac208064113238580a6c3da7d4c357ebc1a4b

SHA256
1f26fcac082a0a4c910e5ee756963876d0b23f3e5ae07e938fe9010dae085380

SHA512
9ca5e97b15bc9670c2bc3621449bef8912bda025f3b0445d5e05e161b0abd9049d657583abb0b9792cbfc2e03411ca7338f6239e5176060df01d6c88a1888cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1f6729249c57368d801fa9b95376eec

SHA1
9a7e43c364d40391eba00eee03c0e94205841c0a

SHA256
b968be4f52c57a0e239a106b6e7a5521f070f6e6e3633343eb0a43a75ff8828f

SHA512
79521f10475725ce52bd29f1932671515f2baab673ea78f853fb248f9dd7cf8ff71751a273bbb43168aa313f27eeb929591b03dd3dd78f6d5436c52a908cb8e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd05a31e1468dc5449e48dd488e9b38e

SHA1
cd5f0a592f889b912e174bc88f6a1a7518bc63ff

SHA256
9ab0be604790a32b0812c3b9d641ffba5bc389a2610355fb9d4088ab9ec23f21

SHA512
66c0eefe51e711992767535b1cbf3507a8c76207c00a214c37d330d28fa75ee35024f911d774a83fb11c509960e871e32a414898e80db4a429c26e2931b03f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb4687f60b6d08975f71464919ac71b6

SHA1
d414896f4942f426e3f94b2f47058a498c97f90b

SHA256
55732403b42d94e7659df55aa813d0ceae1b12a0f20b0b5d2b9e08a08bc57259

SHA512
d9e638cde00c4e68492e89e4d2237de86b58cbe4626577794a6d6f60666336b345e1c9688c7c70f3fa995776b2d5bad815c66de28bf1c82daece4be7c18b3697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efca481b89419e11d7fbd1b60647e9a8

SHA1
643982b0a56d66f380c572704db8a647146c2ed6

SHA256
27f9eec88c13cd9722ace355add5a6cfb8978d3b6f1220a92043f1a57f426a83

SHA512
8fd2904317ff19e33e3a935568f83d168a804a1c5fa7b6a82a02883788f4cac0a395e4127ef198118af231d429070acb62e3c6c5fb26cc1e6618358d3de1f9af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69c14802f4cdfb7960d5cb7e1be5992b

SHA1
ade9c498fc9fb4f8950883e73ca33fa035f787b8

SHA256
084fbd070655cc30a0658c37ecc956927c2f459cf05a7c853400610cfc636af2

SHA512
4e9486f02b986e0c56dc5e8800153e71081318eba1339daafa458fe506998903cce8f48731185d18cc75bd026b18a3ef564be17accd1dd744a985aa187f98c35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d05bbc57a0cf563ecd4764c081f700d

SHA1
e7fff8b5b4b4ba9f568584d2732c8c36875efaed

SHA256
b4469fea20cfe434f5d689ad50435c8faaf0ac22027a3688cf8180d048704140

SHA512
2efdefda50809770006044b5e47dfc693367acd20c8752b7970421aa8535ec83de0cccba38c0ca6c617a581536d183bbff049d7a2a19976e157fbb68bb6f54a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
802a5e43fd701a53bdd3ae10647e1193

SHA1
a38fd7bb6ed23f39583433b677b78b9d7a25c687

SHA256
86a59e8f28d772785fe991aff1363a2ca9a3767ea4dfdef99fe4f7bff635a261

SHA512
c4da657bdf413bc1d004513d726dbd53416f60b9c683cdd206c54437ce1608ebd6135383016512c19bfffd027d031ce6d2d34b52b75057ebde9719ce3ab99165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e139c523dc258e93f216561ee2e03470

SHA1
756abc39550f5c2ac0023169f172834a6661e10f

SHA256
0033508aa9e4f6a18ce612cc5fc7190d7b60b80d3a96fb7f925318b1fbc22db3

SHA512
c1babc42c274c2d096acbf446d0c717e0e588d0de351992c7d77279ce1834479db5b152517741dd676c92d6a1cd3e1bff951ffe61e5b3a4f24fda2fea0b726de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d024fecdd988009b92ce8485c080a432

SHA1
781ccf02411e926662cec7cebbcfe7e746ff7682

SHA256
33827406fbc7d652f702895edd8ad9162ffa7bda03192056da7f109cbe0f5f71

SHA512
032802331f3c8052c09630b236120eae2d17ff8d129277ed5a20962e8517bbbaae26f1344dc16f2b1d9fbf6a36d9fa2a612a6c5d8dd2dea46e4e51bbac6ac111

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1335.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1426.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit