494d552043c15e28c724ec11e4f47f05b8802c17c93d3ac67213d5dad6238ebf

Analysis

max time kernel
136s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

fa470c62d56d430e32f9da2f7d5da334
SHA1

bbf221ea9846eee94196804fd017a54ad89a9006
SHA256

bb18d83c9c865bcc12e9cc5cfe8e3cded8e8656807a899f43c5531d8d75cce14
SHA512

2c774c59f661c9f4d52af1604a6dcad474f3e5184c09c8cf1473f972ccd14512bd4d2ba91523dde3e153e67475237b4a36b18b7637dbc5bff5e3d11cd303269b
SSDEEP

3072:SgIaRt8AY2fmyjZyfkMY+BES09JXAnyrZalI+YQ:SgL9/8sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4655FE1-1228-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421877074"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2744	1368	iexplore.exe	28
PID 1368 wrote to memory of 2744	1368	iexplore.exe	28
PID 1368 wrote to memory of 2744	1368	iexplore.exe	28
PID 1368 wrote to memory of 2744	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b45b84054686c10472c8204e2cf3a953

SHA1
41bd4491ba41e66fc8e1a68eee77d3571f559022

SHA256
94d93662ab707b39206902cecda3ec2e00fd2a1d0ddd7722a0c2f13c90591b03

SHA512
6939a8465c82fbd706cf0223a97082cf69b838dd09fe7fba1637f1a2974c0f197fac5e066d65ae1fe18fabc754b8a440424842f80aec812ebf65ca3d0e16effb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c8ba8296e7dd96bc1c6de271faafe0c

SHA1
c86a03d4e169613e3e6a5c6d3efc485e0690d7aa

SHA256
7796bef42f0171a4029d40df07d99e86a37c068d42e509def1e14aa3d22fe277

SHA512
31dbdc71c38497abba653e20d04684bdd1cea3ce403a29d54f28c8e535b7dac7496406a3ca37a1d2554056cd977a509651fd1316a595db2b6f56594450c6e8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a633e81032dad9be06ed533f776fe23f

SHA1
3562e8c62cafcd643ddb344734d88b852076d60f

SHA256
c3f84b33e8e2d7fbc272bb5657454e7a96f8ea1559e152adb4f0813e427fd7e3

SHA512
119e180caf71e2824fdc46015375b90f9ba4555574a1592ead2366286564c12492e5d08f6165280dab7198a93aad0cf1e3810634778a25f73502d6046180ba92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e0859edc5c3aaa47b4d5190def503d

SHA1
13d2c2c91a606a17a5e98c1264f1c32e051743b2

SHA256
1544adb769445693491c8c6d6caf2628e21f760f8d770cd22775c6728a0083eb

SHA512
14deb12e1bf0814d60b757d875fe3bbcf5dce4c29b6bb80e13a0ffbd2aee71590db4b951d747f6ebd0c5f90437d7f97f075d391ee8460bdca62ea80220d0341b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86530b6f7fc586fedb922239449419d2

SHA1
29658d464b9d7f897ebb50a23516dd268b7cceb9

SHA256
28b4c69910232988d3374e388b563bf59aa7d22f126b0b8875e0740155e63468

SHA512
cd9895fd420daba731257dd3c50e608aa296740f22c30b4879ae3050fe8845b542cd89427ee9402cad8697352bb4cfd5419d8b3f2b26a3b0c4ca1cf888fdca0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40402be5016b39448dbf42af151a4413

SHA1
3818c9d8f2e5469e1dc529530fac6f9d3ac68f9f

SHA256
a55b0ab9c791414684c0e80978b40966e25b4f802b77361b27792d65d6e66ae5

SHA512
fa3dff2183597c79f865e2440dc8cb46d0a1c1370905b03935e79cda9c20f3b9b0e770e2a8349bef8d3e33a87e735cd7f27cf95f9e18f60d24a4783118c063e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c286b6aacb60e061c21c294215ce21a

SHA1
27ddcbb4b0aab62d49d2abc3122ccee2b98b86cb

SHA256
8f9a72f555f457d1171c81d4bd1f325f12049534dcccfd6c83287a67c4b92359

SHA512
f2bb1945b523d6265313d600b9bee6a4b7107a18d9864ab48806df8539db4e643bc10667c32f6f5f55495d24867ec2d6bf67915fd9a09e16fabf04924c114c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0daf3483b98d5dcaf1e40ffdd64617af

SHA1
31bf07b82d5a28fb9f2c6fa131758f013a8bd7ed

SHA256
65b807e021197c490956794d5efd0ac4a91cc1cec4eb245ec9cce4d588ae691d

SHA512
48c682dd4ede722df0c47aa00744af3d59b178deafaf013422fb80e6b3791528d0e87d7a9f4eb7b6cfab41261fd012cae57b0e6e19546d292fbfb62986dd7a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53feb81e1e30ca6dc2b6549fd4064db5

SHA1
8ee0c8b16381ff05ccf02cfcde432114e7cb8faa

SHA256
78def9ccdbbb6d1adb3521acc0f52ddae1c5680122a9b8f33960984ea6f5af71

SHA512
831f6b0253604de9d5f184df1eaa7173014c4ea29d529f93b12c4083b80c02ed58861b20718f4b76b93a74ac5ad2f48622bf9595459f3452fcc97e8e4d702371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7ad249e48b922120e9406123244ff01

SHA1
88702bfbf7c20fdf360a32759f72e2d8eca91c54

SHA256
bde730bf754483e9c25ccf5e400c275219d7570eee5b2abd933c0164f2edf166

SHA512
e3b31d00aec870c0180effb5eb7c9ab9299238659b7b106a6d875ffb79c1e8b39343223c5ec06ec70ce27ce0f19520dcc85716b326518efaf55a3150c29d4097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
007544e1d5d45a54ed29c08e7d10f75c

SHA1
ef770326508d51d1142f7f02644b8479f7cd9630

SHA256
3f99211d559be54adb3dae19a45ad8f8ed740a64c8dcb4cba0c8c344cae09082

SHA512
884fb5473605b1cb98f1a08ba384eb813c978d2bc79082988b2f127142a876b91c67b1098fd01a29678948d819bfcac4683dab6a7e56ae99f17e62cca0284ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe93d41c0dffe7c6a96c21444d4591bc

SHA1
78d94461da26eecddcf3ab94c81e1a78aeb0a947

SHA256
1282f05168c15663397bfdb4f380f15b778ab56aac0289157c092f13e22a8698

SHA512
48e874e1e1312fad5595fe89d7a7c3b5717770ee825c6354f5356d42a4380847b67eaf3757e4580b8863329e4fab3d4153889ab352781d452aba8af7a067b623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede9b27c4a2c20e60564d222105f9d02

SHA1
01554a772aaae97cc76630cc457d1d176d7e34f3

SHA256
1491e9bcd30e15aa2f7f2773751d9684702e8b26bd1ab9f201e2806b7128047c

SHA512
5101e3dca06a9ef05233dac8aa3140333cce80f5d53133dcb2b5b46fbb167435e0e2669f116ed7737838d8778378e08ae847a4930016570ce384fbc5cc9f4771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd5760d5773b62476632a474a7bd628a

SHA1
7efa1b62da5837adf85855126c3ac537aab403cb

SHA256
d9977f5f0fc886b4cfab6a97556f575c2ca7b3c223957658934593abf3d92637

SHA512
73442db91180f3834c3e5774093e1b5db54098819461164ef55f472d467a139194f7231690d588570f98a937125b922ce9a0475c4617c559d1145987a536cb1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fddf0bafa8b9de32ddbc72ae55027ce

SHA1
0e3a7f926ec9a4be522150883bb6fbc1a6f3aef1

SHA256
b93b2203fb98a75b458ab8ccb0b329000ff45a03ab5ebd97de211c3fc2a19211

SHA512
91edfa0b3dfe6413e12f5232ed7eda22734418016fdf23c7ef94ba5a1aca41a3e6f98c25dc412d15e4a7775d61f2daa35840d757b6dae751a16f52fa099d7f1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12cdaa67c79e6cd264b68491c379bf61

SHA1
56d6bfaaf1596bf645ac037a09f1ddab74acca85

SHA256
2049e13db73e128ddc317f8c0982e028e710bd72da7dbba7dbb4ab124ef942cc

SHA512
dc618614cba6934d3120a0f49523f21bf9e21c8446128e0bd345267ad63151ec9bc19cfd566be917187c282ed56a6f1a567cbaeba750d42955b6381fa1027490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c346675922a34f1472da532d0454f20e

SHA1
b28ccd8be67944e4875ff83a8dbd111420579e93

SHA256
0f1cf28d3dea10accd50abfdc785b383c48fd563c0b55ef21f0ad1b16b2c9111

SHA512
e5543510a4c5f4bb9108b337c240485f5258ac5598b749f924a4713df5f15e05dedeb2aaf21811a382f2c634d52aaa1650e1d32cc0bc8ce959309f69c510b136

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85F3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8781.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit