abff154dff95bf6e8b364e0057da33a6fc25281702406d1a2d5b8e92a4b1897a

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

3861680fef892046d67645e781285c27
SHA1

debe03464acb60b89f90a4a1729890535b541380
SHA256

ec77c019402af5716705b07a2b6a2b358de2a6cc7187013b0bf091e6ebc59ed2
SHA512

65a090c24c60c126f1fe493525e90f448a44bea9cf5d555ffe1514f34be7304242682ebaa88ac172f666698027bb3d5b2a3043637bc4045c95f9a9a1ef8d914b
SSDEEP

3072:SV/1l+9BYta8auNDyfkMY+BES09JXAnyrZalI+YQ:SVj+w/tmsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC188171-11A9-11EF-AAE3-FED1941498E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421822512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2024	2260	iexplore.exe	28
PID 2260 wrote to memory of 2024	2260	iexplore.exe	28
PID 2260 wrote to memory of 2024	2260	iexplore.exe	28
PID 2260 wrote to memory of 2024	2260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db115b324dfc6042ab586d5204874d37

SHA1
96a56d5ab4bf21ddcd37bff4c51b1a0029c401b7

SHA256
56151bf63289216237a7c3f43bd369d2b5094e9214151d1c11cb3fdeb62a8b67

SHA512
bff10767fae2d2ac57ca1f45238cbc52746338db0a297f212b321fa7c928d9247373afca71078cdd86e658cda4329342b49f1eaf710b6b7267d1dccbf6c8cda7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26e94ef1891caec0a6ce469d972388e0

SHA1
92458156d618ff6d1a93d97e330bca971f48f9a3

SHA256
0275f5d38032cd5c2be3b21face24bdea8b40e2866cdfc0ca27528ec1a642068

SHA512
68e3330d11ce1cefe56c1ab203b11fef22b476e417db797aeea7c785e56d9ea8025cbb6875ff40342f8e9e763f6d2308ece1a97711e97fc120e916bbc25e198f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da17fcc52536ce08f02ea767aed5012

SHA1
1a5be9280e6b3b2fcd6a6ed4e7cc937e8087c4c9

SHA256
9d78f7e9361374fc5859570138c760c0dd3044f4d72deeffe20659d1b47be8a8

SHA512
7d9480411a7e58133388442c159c938b32e0ad3ffe7921845928b79d91f5d1f75f71c370034e2cdbc3e442133c5b9cf5d64a8987316f83f8e5ab5d46135f2370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc486958707c2c7d98d1cb68a5424af

SHA1
786b27373bf99cccd2d3891a46bbcf1f68aa629d

SHA256
24f08f83164157ce0b858752dbf51358a66c1e7429b039fe231e847d0776ed34

SHA512
ec11bf45e33b10dbdee6f1214bc6b3bfbad43cc0882a50a6a0e1121964a3d3af08ae2c9f342687365fe2498c8a67fd25d2208a78a984404928dbffad55de10a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
645e2b4fc0400b99c83e2eea53bca967

SHA1
89238a1ee8cd0a4679e0d9f0f056415daf5deef9

SHA256
8e05029e5dc3b8820fbaa4a1512d0ea5d5c43fca42b775ce79c1df77f18e3c9e

SHA512
6f36752472569e7654c7676e01704090b67d191eccdcadddfd77c8c787e8ac17f3de387bc2d85500d37c838ef3cb33ecc6e7086fecf052c1d9238e9f9de5b7c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a118e5a2c621b19ecf2a103497846ac

SHA1
b9723c607851ff62ec13e944e72c32e9fb317514

SHA256
40f4957b10183f69e40f4a05475b6fe3890ea66d6daf695c9f16ad9dd2ad816e

SHA512
af5a86fde14a1c9c68ab8399235b88a1105099f6f11411a5ad75b715a8931080775b117ccfb8bbbf701343f564823225dd24854ffd2b8bddc218612f67b9b658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f94eb5de76fbb00578090ae2bccea2f5

SHA1
152981d83149f55bb24a4a7d8b38423f484f1c06

SHA256
b3617c9dfad821d0c10a578706fb23b23109d645969bb03c04761dc26a917d59

SHA512
105a0637b1ff99b0469477ff65e871ef3766d783b83397278705201b43518b1f72d66105218aeedbc5b1a06f4ba70947d6c10d17683fcb64e45c55b3431848a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3725b1d0a76d0a2354e4ca23a9e1f205

SHA1
744549ecb6dc071f12065a0907b81f095bb184ff

SHA256
3743a0524991f100dcbbc73d3f65594809b9ad57c4dd3ce508051e1ad6c456e8

SHA512
3e9fffb94e683c74f2fcd8eb542d8ca0a6f74f78b7725735da4f3a1fef36b2d788bcc0d02acc017512b91f97e156d57a60d23d6a84265b86c997744cefa45121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26246379ba045c2070bede07a4d99273

SHA1
80523e23b256fd91d1512dc76fde123415b0bbf4

SHA256
581b0565230795fbc90a5839705bcee8768dd9d42c8f5b4407e6fd5778e642ce

SHA512
06a151dc117e7c69d392cf4927e23cc78c6aeeab98517948ab89ebb1d8122104d01c272bde651e46b02e6908fdaf57708bb8d75ab01eb00e5aa5012a29b6acaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4cfa6327581b1f86550140953604a7

SHA1
dc4c90ed8fccfd7ee1d9b8562544df3f2e29f3cc

SHA256
36cd2a7110e91d9aedfc53258c98754872db68eb4dc498fb96ba325a6336f903

SHA512
056a047586b83a4bccee4d8125c469bfedf91772dd2b09d522f09722890e4c2bb9f5de8cfc44845d535e6e171d48c363ef58c4f4dfa83b7b6fc6f503c22ebec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92981e918b234f72711287ad2bdbc436

SHA1
ad0d524c56547d7bdb3d28bbea7d51eeb9d52df1

SHA256
77190916302399aa67b4a8300d998def8e44079c1e1c0a07784dc8c5e907bee0

SHA512
b7393cb5c061d4fa07da4940a7f7f1ed0031e1583a07f7cf8036df59d0ef3d3f2949a1a75794fea638870b66465257c4da431aad2aa756939413b1a1141fcefd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aecc67e1c7c507e07a1c074367c2ebb2

SHA1
761b14d53b822c6857f59dec0a72e42f76eb2c81

SHA256
60cfcf892e412356b058183c618dc3a42a21e24850064b9d54d1ca88f661c0c4

SHA512
e58000705021a7bc881ad314233957087871fbd833462dee3da50116cfeb408c47b3e5220d5a7ee7d9eec4e048bddbdacbad2e802f19af01ce640636f217a38b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
105ee981967d9417e721b929ad231226

SHA1
a77ff13d7c50da9ffa18b72b6e8746e96be4c467

SHA256
082a802749dcb5df6732b3137f9b633cfabac5dbd0d0b576fedc698adf889996

SHA512
09b64a8bb3da8d5d1689b835f33c780e588f4e8b8c1684480c532edcef4896853e353cd827eb2fb63bb603c37d40ba13aeda64d978cb2031a8cdffcfb70cda3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6b3f8f98ec77a827ee27ed68157dd5c

SHA1
30d021d7149e1806b470464a24fae856c87d8409

SHA256
fa9c3aba59c5a5ec506b098007d2ffb805fbc484880402c35a8c44e22ab38453

SHA512
c447ec6bd51cf79cc3ecac1ae52e86ae11bacdd72aeb5d50f4e46fef275870d36ee6e8025257e629ec509949f469ec00ae4b4559f312143e476bd57a0d94033c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401707229f5a0edc82e67fc78f94b79f

SHA1
e9c133831f5513df2031c9050cf42845d9e9af99

SHA256
9963a66296da68d5a58de8431ef3b26fad836d82a5607870460b9c452642a528

SHA512
79789455ffa1ac1bcceab85f5de00bfce6878f4b51a96efa053ec9c78c8d966de595539e056293b8507b664f57d3d8ea5460b0875a7d5e586fa22c0593c27fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0c977fde0616b29fd9c1da32ae2adb4

SHA1
47969a1ee037a7d0113d687b37b71f6cfacef5c5

SHA256
a550b98f36e78a9d312fe451459422efaf0625c995e60b05668f79fce4f2cb6d

SHA512
08b9d2d31a6958dcf6b08e6b149059270f6647caca87e92349ce4c096952e0e0c393e8f864380ef22b4a0a8e121bc78e498ca5802ac413db0324ac0acedb2e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1547.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1629.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit