542768e47847eb1a1e0f69d98ea36d0ececa920507f6c92af1435f1deb6eed72

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

a3421e6b9df9bc1e1f170df0532be379
SHA1

6ad964605358d884729ec686ceaf85010ea14fb9
SHA256

f784939ef3e838c610dabfbc945f6805591a135f6f8876a822a013ba9f04f574
SHA512

fff988eec4c0c2bac0d2dffbe79a7cad8bd02a78170e57dc8d3e46f841f29205270105b5b68ddf51a06e3a8d585de41fad55fbbb699078c65604a0d55b8efd7e
SSDEEP

3072:S1BgSw+BdfZ32syfkMY+BES09JXAnyrZalI+YQ:S1Bw8bWsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B90E451-1234-11EF-A7EB-E60682B688C9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421881943"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1692	iexplore.exe
1692	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28
PID 1692 wrote to memory of 2616	1692	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84f197522a75efba0a13790acb4b377d

SHA1
c8bcb0bbd905fd57342fe587aec6803c4de43dd8

SHA256
1f449195ec83604974110a419e19baf84498a458e2518d5a3d43ce38a30bf5e7

SHA512
42a052836778101d0559200511d70d428043a197abb17a7232a363e81a66a49bbe9873d0a8233d6ca333ed8d16e49723bf58fb92ad5802a10262bcf96c3321c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5912e84a57ab9d3dfa62b18ba2915d57

SHA1
940e6016ea778e7ab9ef206d6141fc5439457a4e

SHA256
f16f0b08f0f82765d9097b265526fad73dfd852cba2ee9191d5d06e9e9e84aad

SHA512
4552b2356b3c7ed017b2313efe6639b8a23a104d8da2ade1eb3785cc3850d070aecd71939d343cff919958acdbaacb29f460bbabde73ad9a4198eb19fd0953b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2df45c52c89bd6734175efc0f3e4d8e2

SHA1
f3716b5ae7b8302d4c01a7b43435dc3946bbb6dc

SHA256
fcc8f3ddaf7e8e96ab30b886fa01d6882a4af8809c866778f461188f96f6e5dc

SHA512
fe9913779671fefdc27b66cdb41e7eaa5f873ccd5a125d879c6d8fdbcff352d00d9be65e49342c36269bd95d10d54d38719481f6f84956b6190b7710ce51ae50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0857185bedf54cd795af3a0fb6df01f4

SHA1
49afe0eb3249094dc160933d5abd43e55737f4df

SHA256
b1eb85f0c7742a12c6e729140ba7dcb88ef2ac8eac5b7833d427b536c0ef817a

SHA512
d1949a0a619584141371b3772aaf242f0a0d30195d1c570bcdd8aec97f9af3eca5a0c44ff44e6dda4a67d55caee9cba77bfd6eef85c30f21b37859439d64df7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcae28911c7f876c24cbac75d6c9de55

SHA1
86ac02e38257e8082c03da3741d12e2f00721af4

SHA256
d63ee632645b1c1064f479492689f6c3ab8cf5eee66a55d0632f4229dc94c4dd

SHA512
13f3accdad3c4e6f0fcda47df1c7284715e007f8ad8ead48a9986446d624fb8cfe69ec9a37eb07ae8b708b6454f599fccfecf4f45d7bd766a628c118fc9857fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ec3a4e367da3e67c4e90ed872df06e5

SHA1
2934cbca5172efc92d3ac41fe222dba3a6757d35

SHA256
9da7d5add4fbaa92bf7ecd6afd227bf8c99b8fad85c003eb3b7fbe43d515b349

SHA512
e2c36783037cd14cbec52ea8050b3dbdb759e1baae661c406a4d20079a12d54ef5489abf7a8ff31afc7400aa18a0b494f292c29684945d2dc00abbd2c9a39357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594cf49f478d75bc7095d584618f87ff

SHA1
01f549182aea656d8e52d73e7ce69ef5fa8a7c14

SHA256
96c089bfe950b16ca4dfaba3ccf0ab584ec414a4f71455d5df87fc1fc3444424

SHA512
fd322aa839f217c86cf1f6737d7fab1de38226d14e11e82ce4e4f886c11a0862e2247bd142814c0fd6de9f3481dc5d0a557664edf0d0c88b46ade8d3d1bfc965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2488320249cb4331984c2100e387cfa3

SHA1
2a733c54c71aeb5618edaf845bf5a92ad0b9a44a

SHA256
38d0709f1818494c71816efbc99edcf8021fb5b8b9c0c1064208a56aa8680a7a

SHA512
f00cdedcfee78ed8984422fe6c69a908f301a27b3deb7b564bf93257168aa113ca48a6a7f642c3519aa3e98fc441d0a8490e16551a710bffd7d80102d1f23ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b086ae088701ed636939b99803b64e87

SHA1
b5e1bd3386bce0e51351546b8c7b488ba318dd66

SHA256
22d1f466eb8f15b67c7cbf3bddc7dfaf4e1740e9e6a7a875aa341926685fce1f

SHA512
18834aed1b0c731b19805c355939f12c632c2127874e874e0a3cd967b1da8d86208b676a1e38fe711247a807f46730cd7aa294b7c4d9accbbdca17da1ad84f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71a09c0ac898b22af54b0b1d2dc179e0

SHA1
82fd423e3029137ba1bda8de05f23cedcb5c8620

SHA256
839bb84e2ba1bcbf1caedd4d9ded9682470c98d4693c2813abea630684ffa730

SHA512
44c6a58339c5202cad2568d0187355681f78d43bb7d44c9fff886373b67012a8023a9f7b4f0d720e0c76043e5530f96e7888674637a656e0474ad1db9c2b5533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c718620ef04e4ee604955ce5479ab732

SHA1
0dc47bd4b6ffeb60e901d850431a593274303eeb

SHA256
5a07784d1c0a3dcd309150c146113b02b5ad55e9665c329b6040585444e0e132

SHA512
6e40c288b9d7d226cf20d084971fdbf6e2a3c0c86542ba316d87b334b5d15799cb7ab9b3994d6f2aa712db85208bc70235dc624cd5ab14463335b9c82b5781ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a0c4063137bdf8c7ff85eb989665adf

SHA1
157e6bc6fb68575576ef8810de8045281b4bec4e

SHA256
4ed3debbb954f5cac90e0135e1bdd8eb74055b92db5206f976585587e7b2b33e

SHA512
5121382039bc97d3fcb33943f44e4c2af028a602009277f0800b5bb3bb8ba6e22d02f3f44716a2f955e58b3d930526a8046957b3564f19b3bb1e94bfd3c18a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b2c7c3fb01f4381b9812e72354e4cf4

SHA1
e9b0514133bb0c64b68b0face91a5794bdb9c0c0

SHA256
2d723cdf2ca8e723f918f9586e538dd17f8eca4b7002af258df7ae75542e891b

SHA512
2f7fecb2db9969837d5e5e9b4ef83785da3f9f09c047ac94a682a88515d48bb27f06f7e605535031d029d1e456adf2809d2a67dbb74d74648b3fac99cb934d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
685c74c03e70f7facb9338dcb73ff974

SHA1
de9e7d224db0b46ea85d3b8507360a4e4adf7eee

SHA256
8f33764b41dddd8857156d7a7987012a0189bb8b1936decfc13dd514a048ffec

SHA512
eadf67bb44963f70a8f876cc397cd7556951d48ec8355149754707b50d2b69eb0713b73dcbda79a5ccbb30d52bcce6e61d5c924b3937d618c17f2485eed1d56a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4edef91736242643995b2e368ca65b0f

SHA1
d712e3d9019c769eba0822dc4bd5f3b83d9b7e67

SHA256
b1b3f6daecfc56f2a28ed09664ecafa19803e34903f160b74fed30cb76df6249

SHA512
69b9af3efae1501942050fb5c413ddf27fb106cacefad02bad037d12fbe64073321c317243491b3688a20a370da8fdbda32e81fb170339f325f24764e67a8ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ae8a3586aa427d390134b23c8722d58

SHA1
65c31ede3dcea5f8febc9b4bf1c3ae3123a64b71

SHA256
2406aa1d9836c550e38a8801ce05b2f97d4f12726488e8609e8cc390f94edd29

SHA512
cbc21a4f6c742e7322b9b72d2775b9880aeba128bada30cd3902914ba9c1cf93e9af696171da908892d40147b1a37dcdfc03941dbae343b8b6c0c92c7e4bb2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83338d04328a0d909d72c15d8c900b30

SHA1
89bc5c88fd867c27563344a436b9308aa144defc

SHA256
a7ba05b3336546bf07d18172f452bcd6ce5c4308c077087d9bbc77142709b88c

SHA512
1955214ddb90cc7f139e8d05626c640ae74acd78edf2f7d33560c8d18867a08a70831ad29606c24ddae0fe9580520caa6bb406d55e9dbbc6659a06a66040ce26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C5A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D5B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit