ebb61ad827f90f3d665b24988f818e6c4286171f4ee3e45662fa9abaa737b8da

Analysis

max time kernel
136s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

1a1a0392c016ae52559f7329df14b531
SHA1

3504ed136d698f640e408033f4c892c83d9c7241
SHA256

c8b8973a54c2e8955b8616b53ff25ff178ec6851f1a59515fdd5aaca6d4b6def
SHA512

66402a92dc41c588d2f0a820d4263a510f974daa188ae5438a7547a3bd89fb7de28b14e34ca61cb2c004b24e41d23a7d39bc4558bda32c744d66489fbd36c4a3
SSDEEP

3072:ShiuXJ7g3gqsuyfkMY+BES09JXAnyrZalI+YQ:Sh/xlLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421816827"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EF62891-119C-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28
PID 2804 wrote to memory of 3064	2804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
050f9e03aa348fd24ca973c49cec83b6

SHA1
9364b5643c85afbe238f8a7ff98c1b8eee9c1051

SHA256
3f30dae40db7168abed62f57da8ef4d5ac62afedded2f066f677f77684e0bca1

SHA512
5419305399349052fade9ad3a7e676dd1c39a729a8599d7c09a8a1aa9902429f1f8f360eca6854dc31b8f5837ea1530332176efb066a9d55ce089c7ff4b18586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09d0c082a7a9724e3d59b1a62e46621f

SHA1
5b25dc824f04d54cea75fa3da9a2e40ba4bfaa92

SHA256
3a33a9bf50ceaa110b4a411a3754ca812b397f29826b6dab4aa6a29436ab355f

SHA512
a1693cba5537983f4b740136a47514d48f8eaeadd62803151201e677de0314a9def1157c1d23c8909bd939bbf441b92b6558d10d812f43ab4242bd5ffa48fa97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bd75de69118b6b854bd56dcf2192256

SHA1
2493edfa61fb7c108243f743d99ce7e04e7008eb

SHA256
69030470bf1144d8e9812d209e06574149d286733b9edc7371fc13c576b50acb

SHA512
5795b90dbb837fd5d1646102fd93747ac53dd49f0c3a75dc95ca387108736d014da0598b97f3b3c530eb3ce4a7eb238e39dc244dd4e74a77e031bb0ee8d49dcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5091923228156c6ea99b2cc5331f4b01

SHA1
43b87a1d97b579860dcc4cc401822172039084e1

SHA256
d96cbaa89c4d6bac18bdc5d5dd33243b1e0f7ab9dba9774efc156acfc02f6251

SHA512
ec802296b77f5c6ed5c5fd7b10ab61397cfbe4f4932c9b124d7fe4016e2b5dff4c38dc38a6fd83d8c0998b317bb18c27b9444e09e1661f771a5e8590322481f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
322f8b02255777b683c18d64073ff0c4

SHA1
f47ab7d6f361492fb332382dd2fe44808b5875d8

SHA256
3d901381a6ce4d79c5dadb83f8e4dc20351f6b0e8accdb2b46c7ae686364a849

SHA512
cedad54232fd58749fbbcd02e1110df27c57233dbe891c8f274bd177bf3c1188ef8d117c1707dd36420d3c7ce8e03eb0e65e82f43075300fcd20bf6f70e6411e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
958fc690a797b8830c0a7de34d2f0c92

SHA1
08d4b648ad6c2146deffca5b8d7f60650f50dda4

SHA256
931226ad05103f69190a9ac6c81079c111488de935ec7fd028c31b26ce6a5b77

SHA512
bd227fa0852e85c31876d13345d58124d915ebc664390948f228001375b01bddf18b65b6fa02aad53b452d865bbce2f069d628d2736a01e2d05ce83fdf635829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5952090a3d1e315cf7e89732c9fea359

SHA1
6f43e99cca4f0ce5797f83075bfdc0ba2c0d10ab

SHA256
6462570b0295c94417054e189283d942071395e445a4572ed931fffe82e09513

SHA512
21bbe9ce2a41526ee3faac5eea7cfb66bb9b547d74bbdabcf08461a3301d2bf27f66abcebcc9f85d087e99b1db92d95c3308339d1a7e48542656848ff8fa694f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cb2b53ea3b445ec98596149a7d0f99c

SHA1
64302250a4495f5b5495c243f9883212f6ca4c3c

SHA256
087c9d8ce71dc9dc7f3ae70c0f159e73dd2d9a2add51e96efaa7d022484830e2

SHA512
3e2265295a8812cbcc99ec70f4f28545238b17b7f52d39cb1a553b1a41177977f9a1d2a7b5fa4d718eec7f537ccd343ae081874c9f7ceedab4540a5b7e4c9650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aac7f194bd35d3f42fde20e201830918

SHA1
a10fb01625a84ad66f47a0b2f2c6a436ae4af8b8

SHA256
09bbe595800c564b0cf689d26bce6d055cb70747968de637a28a9fb5e2d23814

SHA512
7cd844ab7e8e52003e57526cdfc8744054c592883f23e249555adee34f51edde2601fe99aa3269202c9f20006f7b8b3b218e04e0618a0aa0c256f86a061f14fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a04cc41e9e8aab3d60378ef94640a2d4

SHA1
1cc6f9d331b56bd35ca2a56201613b2aee79cf9f

SHA256
8d071be050e31bf21e37fc8841d2cb65d24b2b0831b506af264a5524cef13ca7

SHA512
7df52ea79312a423b34a4b7a2faeec34753b3f069ba0280a3de349598ab211f4a62d85a691f93c9d2899dbb40c546388ad8fed2b68a7de3c3a14dde4e1b77f7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
805af201f9ffbd86893818e0fb30fc6d

SHA1
1daad230f2eac81f7a7353908a9b0480a2bdfe72

SHA256
1d0cee1a2d676a52094daf6e2a71f3d8f61dc2abf18a81c831a8328fd3a7348b

SHA512
009e1af30f27d5eb153b5ad95410c78500a803d9d8fbab289b9fdf973c4e986e0cc00456803ac38584bf85c204150fc0088baa197bb5094bfcff4eb6712af418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cec7aacf0f0e7d848965473b69c7ed0d

SHA1
8bc92871180675313d9e880fda2f27dac4415cfe

SHA256
79a3f3af501cc880a4957407b059087ceeafbf01bd8dfd0e073cb7a70baff790

SHA512
1eb8e84c879ea41ef76f63fe2f2788114c5a03cf1dbf9f77d400b9f6b46cc757d3640f021cc0e86e7829c1fb6ed603ab576785512fe61538e58ca06eb88bc731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
117c873ca67e2b26b50b4e7aa3a449d6

SHA1
3a77ee9d775da8d081afbf72dd1ed21c5a715bc6

SHA256
ce7bdb2a18bed071c2ff8c98537a6aacc1ee8d1617a5cb913be144fe68c90a67

SHA512
fd84561b652dd48e829a9bcbd41b1420a490a28c560f8255329f8ee95be1a98bfceab1393ded8cae975b659f928c1655737cefca979d980da7deea006ae796cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e639ae806b60b3a089710db0360e7e2

SHA1
49f2055469cd59b72a10d86023acd4df2e81f6f4

SHA256
3c0b67e66104c88ae81d6c9ef27438f8662047d7f2ab6e3f47807ed716bf9b26

SHA512
8b2575c8109822e8feaea5a1f4526f81812862effd2030aeb5768e7080061b92230618e98ea71d41ef8cbe0a3a914c33c0287e89d4fe6de3d391d058115f0426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a7e1c2bf89e715aac215e6364d728e2

SHA1
99b9edb063f1e8c33f9e7df263140f50573ea44d

SHA256
d8a2fab9cbb23809dcc2b413c96805a47d4356855039a6e237938737931b0c33

SHA512
4d8e0557a890e83eb920ea3ed879cc0dc459a3ec4ef457579d994ebc050d3053c3b3c2b2da856510e21e64a1160b9533b5c2caa564a5c6d07bf66156c75bd390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f492150d6f721d84c9abb16eb7dedd06

SHA1
df5d575d32f0b93bcccf79bf86dd1f26cbc19b1f

SHA256
dd4285fbde6d4a8a6562766f71b6a7ae4108c41bb4c889d4b77847ff775d50af

SHA512
274baa8f4bcc1d197f1e6c5bd77f7f32347ab156326d443801f99cd683d8fcc0381ec079248773b129d2e52e3d02d989764b54ee3584945379b9156664a1a9ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13dfd9f5a4d1e0bc83c3bda8b99393d9

SHA1
01971ffe59f938f56010110fe11034eb7de54873

SHA256
2c9fcfc81dca0842472fe4d132b4c4741a75bc94a15fab29896a9a4814bf025d

SHA512
7e255685c4cfa50696bd3f277c289d070268105ff773af40e6f61e18f5b3a0d2d01b7179343539db5f14ad3dc0943bc48e3fc48e630fc2076f894d6d5a814bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddcf871b5e6dbac60a91f1ca345da0e3

SHA1
369bd28377f5db718d73a7b0ec4b0081d388ac96

SHA256
c80de2593d43433ce9169c365521097950edf335fe0819f5dad8311252d34175

SHA512
d4d18cf0ca86cc2b1ee029127572e29763f6ac4eb1707d477e51cf35d5d0f002629fe02d2b438555716e89772b7f61af1856d676a6e1147d3eb3bdf4f30e8f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1683a39247e56c66387c6ce119c21ddc

SHA1
1c28ec5c7d933671c40ff471adb4bd00bcc99e02

SHA256
1e4aae8b8b5b8ae9f35eeb17f3d0956346873cd4a0352a54770de2d84c2acc8a

SHA512
440f6002f05c2633416f3cbf94fb4ca8c9e0b7ce2d7a2954341d1c7fa0da56bc7322eddc3fa6da66c5c96a0c7e03fb10d3d6d1543e3155b5e1acf914d582d42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E34.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9F45.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit