8e890cc173b3bd71963d0ee0646fcc2d1bda9cd8f74ce0b8c2f8c7788ae340a9

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

50fa688dfff98346bc081edf16ff6cef
SHA1

fec51950d6f8ad3915bed844e1d4362844abd30e
SHA256

8f442da520d9aa6eab4769d63638e0b26e743dc6dfa8f6ebeed135f5e8dde0f6
SHA512

693a7c417719d4b84d703ec8f944a10e6cfd10a9b33867a35abaef3027efc2eb5a5d5ab3f63b1eab25cb016d0bb49762eca403b73dc15c00b799de99456c05eb
SSDEEP

3072:Sku2H+RAvZMi+vz69JuyfkMY+BES09JXAnyrZalI+YQ:SkuJoUvYLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421935777"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83525891-12B1-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
996	iexplore.exe
996	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2520	996	iexplore.exe	28
PID 996 wrote to memory of 2520	996	iexplore.exe	28
PID 996 wrote to memory of 2520	996	iexplore.exe	28
PID 996 wrote to memory of 2520	996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a8d9fcd9a3b80786ae9715d28867664

SHA1
5baf3351127919df76ab540bf8e1ac11e336857a

SHA256
4e0fede1d1e37a8008ff5129d8a14c475e5661eb554b0fed36f159e9e2848222

SHA512
c011bc139a1dffbb3ac3455d61a9a79e61c5c7a28eed2e8adf3cf9af64b30fe0bc5f4f545a204fa579e987881cdeecbbc0233c636a1c9b43cff6089733d4cc5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c857dc413123c66586041de5acdf2bc

SHA1
cd9ce050edccf146825d671b81a242aa988439cb

SHA256
83e1736f93b3bced5b84dd2d2ed3453d5ce2132f256e92c9167166d1178d4161

SHA512
439697172803301904a785cc19192834a93610c4618726e8f0721f745986584f945bfa171ec3c60bff3167b4005514402b303950f2c8d32a5d456019955b4a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
532a95285df4ee7bb1775033a639fd0b

SHA1
f32937fc4af67c3b68f645e5564561df214a20f0

SHA256
b689e4efd361b2d00753c95bc17102aa085a72c6d46ac397395bbcc133493cb9

SHA512
a5c52494a6a8ec53e55c7896193f525bc2f18ec0439110355bb68384f218fda26eec13c205e02f37d00d4727fdcfb938623544c7bc1fcdb18fce063e287e9b97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790f036cbe5385e33b2df545e68438f2

SHA1
82f1dff7c2ffec18db8726188b1c4900a5ef3ed6

SHA256
e8b4f470b886a7056dac8c3704a4c7be2c543614a932c25e4007ff982b0e38e0

SHA512
ed50e9eea2dbb827761da20c9bd7b720740e4924947256a4241634c0b0a122a6c13a2104aa9ba7183f45ba19543b6c5c376f18006f54964962cbc6e6bd196a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b86493435de7723d64ec92f86c8ebff

SHA1
e6d1e0bf31d8a7cb7fb18a6173cef4853006f2d6

SHA256
614d6588a8af2697415de85af8aea95c8fc45195e4cc44bb9436025db248e1d1

SHA512
fb0aac7e1555ebecd3dde8b4ed5ab24c6ede8379c9d54a46a8062b5f6d79484acf85378a9d66728a19ca577530c730194ee5f0d4bb8be1ac8f8bc4fc275c80f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e7e5328128e48d2fc6724f2c9383e3

SHA1
225a607aee4cdab49cbf6258700418f273d5479d

SHA256
28e9c60eff86acb842f703fdf9b23380ddd2c836c0e734bf91f3e88b59100a3e

SHA512
c29c072151bec7239e173a90a5ff0c79551ee14fbedcd3be98473ebf3cd8dd6300f034e4bff8069a89195a48a2b10bae7302b841794b8cd762a80bd5a75985cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0880299b2d0100aca1512f31c2b161d6

SHA1
355d9cfbc4492186eb2b600e808fc5c5b9eae354

SHA256
eb534d5b0c949db07c4af167ecdee4b69bf86fdfeb90bb9bd1ed5b9630361748

SHA512
92a19f452002e12896b4604bc97c2a546d879ae18b5d3eea1bc0d54bc2cb351164fb59c30d2cd75b76616ebdea26491ef89b4316012dc350c560ae963d6a7ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75cfc103c7f1cc467907aae77e6cb31c

SHA1
44bb483b5ab96abed594a38d21c2d3fd87414ba9

SHA256
73ba6eea71c09406e61c672db227834de2197b47d8ef43ebbca41f407bd17fa5

SHA512
ec1c0f001536e3a4fce039e47739ed0dac5e76f5d48242372296efc14c42d94961ff7288be9f28f8480de56f55f6cbd81ca39646a153a83a32c1e42ca725b2be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25e2c596e4b230526eee9f79050bd947

SHA1
b2458b2a329744b8f98b5ed94f3569155bb883bc

SHA256
9ad6427a8f938bc3f386e3012b576b68739429ef96adc48c335179126ac2278f

SHA512
ef5e447e29021c95798b6547bfad87f80d00be0c038add3acbbd22b2139fdc38e55b87dd2fc020bd6c9e881d851e6a103b8da81680417e902d86e403ddf450e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a98d4178881d1010f779d7180edfb04

SHA1
9dc3c923680cd88a07419e52801fb8b83bcf69a9

SHA256
1d35848adeda8e3a6b68b4c433f95abf7947dc33b3edb72efb84730abb8144aa

SHA512
5593790e938579960bf2cd6e35846a44157509d4035a5e51e2c7aea93681a07842a51bb8ed3b485be0009a5a4f92e838cad740973e2c203ec321473370efde85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ffab26de412c2ad1303164804f1b7d4

SHA1
937eadf3078f27cb6d935d2bf70175d8f7bad6c4

SHA256
a7ee4a34d581e45669305dbcd17cc0c52527c2462a1f48c167ff226e68c04d2b

SHA512
7d67053ca9e391d964a051c3222e9a995adf1419a8c3eb8d4fe390f3a8751d3107a8f43723ab8b5e82a01291c1de35caabe4add5d1ec84cdfa4a22f65c6d734b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa66292d2315aa24a0959e06c92423f

SHA1
07f0d0d0001d5783ba3a8f21457c39c02ee9fd89

SHA256
29a734ef21a83fcf4635ec47090eef1d773ae0feedfe97c03920548c8fbe09a9

SHA512
36b5d9656f781bbbccc4578915d74a23be8695f05d4862cde4d85a8d0acfdd96d5216432f911c6943700a32e910d6c07f10a53c311b2c90d280587378546b7e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee01b76b0b948f8cb6352566e4a993dc

SHA1
70d15bdcf898a7dacd9074864d419357d5a42aa1

SHA256
e2e7967561133bcefc1be0d0a666ed6a04171bba14ac73db73ac6899c31d0f61

SHA512
16b74c0b7dd79ec01b119733ae6a72ed9bdb042f8154e361db6881ac0e321b9ac609e17afda764e4a4365b795d67bda08f8e375c2eee050017dc777cbe988d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
876dae562d5be292a3268c6406f2f4a8

SHA1
cb9fc862fafd45ae60e246e5d4f71c55377bd52d

SHA256
fb13ef819fa6cd6d16fea03cbe7a5e52c3768ed3900b4c6664d2c04910ad00e2

SHA512
bb52c3213e89e0d7d6511d403f1e32cdd9ffe6212c561f35d007ffd0b7ed75c15b96d9d2c99a1299a5d5229bb5645bb4e636be55a5b217275c26b87d015653cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb3ddba87d68c77b8b12084fdac28a37

SHA1
2e440d34760d44d1bee7c93c6d5a029816409d1a

SHA256
299cc124ee6ac7bc8ccfe991fe9d39658347256be1d7d04a8812aadaa6175d86

SHA512
22bd2b59def10a566eddb6d5d9576873f15eac1d6969ec4233a75551abf5abcbab2baf9c4c1cb95a65e072434b6b3c0a0ee01f151ce28809b970c4d6e63cf64d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df7bfb78510535484b4667dc35a856b3

SHA1
9ecd83a8a65c241f3b83579349082fa99d9f7a92

SHA256
64cde627e4eec32acf144a99bb34bf9b4f700b9eda22810b8dd1d1dd0fd467e0

SHA512
912b78e1ac67272d5bd1e48f9fcc07d1feb7fb147fa1834573cf6aec29fbe0b2882192f9e00d49ae9604192f56cb483bd636e06f87a528c8391bfdf1cf827161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e44585cff06bf0c13457523df4160e8

SHA1
233e1bb2a04e4b1c46ee28a6ae02272bbf063cdd

SHA256
ba3dda5872bb80cd496e2d0b2955a4fa7681311ff692289f53008810b001cebe

SHA512
2e11dc0a887bc281318cfa5c2648832f3265bbba7cda3c0377987cc39d61c811bf5db2ddefae1f2a0a7c6b57d3e270fc15a40999827f7b813f99dc2a91043198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f3d46d8481a7be34e75cad67cd37a0e

SHA1
56fecb9d59fd54b8ac065d902b514b432789ba54

SHA256
cd2b92b4f89780dd2b9aa35a94869f81f295f521ec2399f2b43f368306f7ceb3

SHA512
9c5aef13e6371b81670abcc84fdf930b754693723c9d141c24e38a0fd21526254062b840f7028dbc4805df5d1de9e0dfbb14311bee1dc5e776246d880f5cc930

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab282B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28FF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit