839661fc437ab34c3f09790f6ae7677989352715723cebe4635043ac7a9d2ad9

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

b89d8ccda377a412177459276c90e1d7
SHA1

7274b78bf852156a985156032571a36695fc783a
SHA256

1b1842de14a382b2dd9928325cd973e6df471e63f082c54c264a6e29d36667da
SHA512

b8494d1d49cbb3d49b0b052b3bbc91b38c7b5eba1dfe7d9bffb617964c92a57131c5ecbfd807de657ce0f9ae02fc7eb16f6be23718c88d87d9c731f95df26745
SSDEEP

3072:SpeK2IGO4mZyfkMY+BES09JXAnyrZalI+YQ:SpZ78sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C82C6B01-1229-11EF-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421877481"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2640	2984	iexplore.exe	28
PID 2984 wrote to memory of 2640	2984	iexplore.exe	28
PID 2984 wrote to memory of 2640	2984	iexplore.exe	28
PID 2984 wrote to memory of 2640	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f58f4c77d0051968af9c3d31ad6b1b2

SHA1
159a2c760f490146c1c87137fe8883fa0375e9c6

SHA256
e08e99df1e793d1a57487002cc343d28b53c451e890c3f598389c81f7f99e0c3

SHA512
2d247e574ed490934f76f23266b58a8fa18852d70d3588bc798a56c7c971547b1edf2249233d4d988a93ff9ffb14401c99c681409065f93a71f8ff751e547782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae4c39e9fe69b436f3d9dbd3261630f

SHA1
0598f36e3e153afc5007e61e637adc2047ff5a98

SHA256
98f220115c63160f671cd5e07787db55b54d63249553838c648e2f3c1c7ad9ba

SHA512
14e3977d2ab9c9a82af5c59863332650774c19a1ae1cf08cb854015b26f368d6872fb707f94f4c4db1f4d4aac7ff1a915eba33d17dbb54b69b61f8dc723ec78a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e60d58079b1e6afb588d43676652864

SHA1
52f6db1e371c72bb1a56bed558bb80dee620ee9d

SHA256
c0b458306198262cff028f08d45c271deb56042e92ceabd1cdf0a6699a1ed447

SHA512
07896b87d0cc4d6d01b7d8604b96698115df580f2010e94db5fdbaefb2f5e2dac83a62d176a3c2b6714b0dce03edcb69f1e584298e93ce29cdfbf2b0bd64bdb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc09ad104c7de68e98749a07ad774f2d

SHA1
3a8c74d2cbf4f5d69bd1657411d159d9ec57e8f4

SHA256
97cb993181e55f3b1ed2c44ec32b8feab61af5567e6329b219dfe8d337c35eb4

SHA512
b120fd70d24b1de6aa3125b3678ade3c1e1d3859352e6e897e5c032ceec59c9388e2ab519e45c655c352fb2d22da5759878c9edcc2bb70f8009c12b61e78617d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e07e1b6cbe17e4c8cc14c5b3eecf15eb

SHA1
a3b90ee74436363f5f2dfe748a06260db2952939

SHA256
beed1a2dff501cc3ce31eb7109dec395b4873a2259d59d95584c7cb437ad941e

SHA512
61898dd7d096929e3882671d09e2f7b3d2c9104cc989961ad4955865951fffbefd8bb490d7a4fed79b303afd13ea9ccc8b215c1e605afc896c0af42cc7976cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8edcb3d71997590e95fcbcf65d246e4

SHA1
16257b7c9d42c8b417e6803991e3d75d61a3be36

SHA256
4aadeb792a06747cf582de3f8e60ce7c442bb48eb109fd48b5886241bb5020f7

SHA512
fbe4b3bfb48f767b7e8f53450555e3d251b30c1736a7530870acf3a175c1816de31d25c83988deefe56325c0e6a967f952cba4938104b16c9cecaa962e3ffa3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fa6ed1cfe06f2b73e45c8d1cadc32a6

SHA1
0def5f8075541e84b462f72dc18539a12b825cbe

SHA256
40b7af01711111336b1df872b1a23b7add6ae09d8b702cc026c8f3194e5fcc16

SHA512
8b22e2f5008f4e32b789d945ef4ecea840e99fe23bc0e9e13cc40f4355ccf0aea18be14e5891a7b892e1c1298eda792145c7acdea81fe13584eb2df2a6ff9cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44fa2a2cb98c73f4130a57866878bc45

SHA1
9a39330a0bc56040ea1e030fea92693983ae69fa

SHA256
4f9e004f160d7a0af67c1789fe8a27595514a8d232132056ffafa18c70a99c0f

SHA512
82db70685ef3c03e293f6814fb6aa137a3bfec4c14bf9ca30c25bec5aacec4b2a50c3dfdea030c67d2d7f9f5f571df8c1d5ed19c00f595b1b97c2d6c739479f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe2a063d3869d727eab7a58767a73a9

SHA1
31a9cbc419c9c594c8a10288ce186b3cb022654f

SHA256
28aa1b6b40bb5294dc4723100600461967e6146f96438df62a0da318297e5ad4

SHA512
4cdb2fc7bd708a19bdc3ced371f4e4a4d292ddad39964ff80be01610a98ef05d928f065dd95d00ea9c287bc09c11b996871c7688fab2edcb71051182d07465de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e713b7e2811bdae4578c55e6fe4df47

SHA1
8771f5a3f7a15fb517a031e87218051739d6f9aa

SHA256
6d79bba1b876b9e7ae167a350eec02436c2aaae38a34de621355113614cd6c12

SHA512
bdb27e4a913a569c3ce06825ca6d1408bde53ffe6aa6e2eab61a6111eb50baaf29252fe2a0461fd0d715455813bcff9152f7d7c5feb1153dd70ff8da8e0a0be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87170d1ec166e93b7a8b05cd0eaa2432

SHA1
4cf2cbf3d8b11797107cde3040c64531a3c5553d

SHA256
7f35be707729187acae36740d28dda924ce4102456b871f2f4f1378f13ea4241

SHA512
f17889cb28da64232aef5b8d5c4a690d9c2648029f435c10435a8729099d16fa93b424b901303e886885e38c2df79a28d4b48dfb3e8cc11a61817faa18ea439e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f12ced00dd80a172eb5645fa491d0b6

SHA1
2389e20f3af30799b24ef51d11e801ece07bba9f

SHA256
7807ffd2980d3126c5ba30e2e9a6544a16da3ac26114448f2c95860a7beb8141

SHA512
cd74eb2e6e011d9ae0bd12d8a61b6d41c860e6dd474e1d305f9319fb32f60843af9aa4bc7dec4ec9a137fa48a3871b1f7fa241682a400eb8da36456575139af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7bfb93c8e87c7c88d450978162fc798

SHA1
b121e8e22c741f1329c85255f7f7f3995f208300

SHA256
cf00d3288640f97a776a5040e44780c8b9831cc63e47da622a8c8461efe9996f

SHA512
092a186578830af4da652f796ad86193339da76ce017f5ecfb3f6ccd30d2e731f9ab8e7fa2faf1a7871fffd76860b38f1afb3e8524032033084cbe5cd3511cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bbe078983db1d948c7b8775feeb0b6f

SHA1
b87522116fdfb26b5cc5f51197fe105827831a26

SHA256
d4d5683a90e33472cd8e011310d289e2a7d79cc374a379e833ba8d5d7568a8bf

SHA512
e83302a6c1bd6c62411a9432ed8aa0596c41e4cb359b18a104cfdf020ae8f5cd88272025eba08a6d348c64ab78100aa550c7db0fc143543d29524f1986179857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8fd93810497e3181ba25a5f74a49b48

SHA1
ac2613fe3f89cd632d404135a3b1e1a117d9edd7

SHA256
16f7a6ff21221ef86088277e61fa08688a6253874ae78fcc8491ac38c9332462

SHA512
5fa40dd3e0745c0a080ae1613d99b347ca88137558d8ec7d582c0e7bc8a645ccbc7f0969d45685bf2ea957bff381df29a2c141b0e6869b27060c84c2e09c8e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6307d9d16ae8023e569f8fb28f84488

SHA1
cbca3a7c7e1b3558139b7c59269adfb9dba95770

SHA256
34771d6b924ecd190da22f8f417230cb4bc85d72c69732deae8f0ef102d25070

SHA512
7c75975338c8648a00321f14fb0df60faa7f828383ba27d827368ccce3d76839e5d687568719cfe80aceb3cde3c735ce087e205a492830992c670c09cd59f270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5ce165009cda294aefbd30c6c0b46f7

SHA1
70fea156fa1d05f5bb7c5561891522a8313b8b06

SHA256
24008d0e13320c1c583109a28dfd12b23dc97f735fde2608df40fb0896bb7960

SHA512
147367b07d7041080db922c8f3cac2d0e6fdb3346d3aa97b5704679d503212133fdf03e2230fb945f4446fbb58fb1e030013bd91ab41d00ad1b6bca9d179d101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a5c952bc4a58f1cd0e8d5f41ae6c3a

SHA1
0ea0479670a1d59db05ef30d9d38519309eb1634

SHA256
0d570da2daf882aecb6ea375070517ab61b6cac97b03123f70e6189bc1ac7fdc

SHA512
c0886fc2e075291c63dcf3c1f68165906dca8e11dee96ab5e63ea0c16ff3263a2244b62df3bb1bdae2fa6f15723c8891701fd389ff59fdce24900ac195732af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD7A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit