47fe2c1ab2c22d7c3ac428e288f8f46cd1238f362017e2c14cfddff3bfc8b75c

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

c67ec6ed7140f5ec38581482efc9c346
SHA1

e87abbf909f005e74fbddf942ec7b04921a46be6
SHA256

6634c2217660c84a356469d0a73ca6d933b945f04a486777037c9c059bcd39d2
SHA512

38897085d96616f16cd588150cbf963275708ab5a54883ce43318c598657ad69cdc068d86450e8f1905fa6d8719652aa77c39b064a40bd3c0a5683a4a341900a
SSDEEP

3072:StCF2E+SgKlyfkMY+BES09JXAnyrZalI+YQ:StCxQsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E52DD01-12D0-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421949083"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2428	3008	iexplore.exe	28
PID 3008 wrote to memory of 2428	3008	iexplore.exe	28
PID 3008 wrote to memory of 2428	3008	iexplore.exe	28
PID 3008 wrote to memory of 2428	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5dbcb4a3d52f622168100ddfa93cbd0

SHA1
7c0230114690a054eef469676242e2a44d8ca570

SHA256
c2663c7425856f40e82d857fa9795bc6ee331cd9052f5fe646b31c1b6a7187fa

SHA512
394aa381a079c62a98946868510e9572d4df99dfc06982814936738d0a78d51402a9d3bf255ad7914b5a09b3faf16763f95ea721dec145578d95901a9b0436da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10327c77d846dc7a50ca568368fbb4b9

SHA1
82d72063019e91cb498b4e0d5c1c176386a89638

SHA256
f60d6f722be584c9f9cd69438e5fcb748a3ac7637fbae02295621de79080fe87

SHA512
9bd55883258d83f636e188eb7f5766f222dc08a2ce1524596fc1dbed318f44e7e6bc69309a89ae7ba8fafbb200080a0024293866b58639cbb0021ea467fc0c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f0f79df731158423fbc2e6dccacbba2

SHA1
c7eff3c9a0e1665a819ac4499c79f3cf6f1c1d9c

SHA256
056f692bb8bbd53bc047dcd795c3342102985856132a6bb6689c3872cddfd409

SHA512
6ae29075530a532841d18f37f7dba6ca584cc6afd65f22ea59b809ca8fe94d714ad44c084dea387b8ae733b93df1acc0ac97ae0d6918eed4e0522e2e3f4e9612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b0ae78a95085957835a3de212c90e77

SHA1
f0dcc6bc4fece0b9e4347149f780ed81d5a7c43f

SHA256
3310001dcc0f86f30904fba6a83f92f8b63b4d982baedb3ec6cef30b847a4468

SHA512
eb74e2e48226e0c8c7a5f0e5200b27f2d91b97a2ddc74505b2b38b77198b86970cc674670be9f992ee6e2c0571f3d13c065edd24b527d42cf7925f5e0cfb05a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afa7b11ca19945f1e44ef8fc4ca31017

SHA1
22e8ae63f123d7bedb1d5bd115dce83f0b8d3c28

SHA256
c5407b486b13eb5f8927992c1b5dc7b236aee8fe0694441862369144b464b16d

SHA512
e1788ab055e737315124f7615236c34ee719fed0a10e559568654e04ad03a75aee534b30fa805fc26e109994cf52aad23b47140ff0c2c6b9f050ca52da53079a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3eb5cfcd5e26af736b4f92b2d509319

SHA1
2f056b82293248d7127e835fbc057ec6d88e38e6

SHA256
7c34eb09a6260286f4a1f4c2186b64e0e10070b3b628baf52db0926a59134129

SHA512
26652304cb66e7960a6082991fe2a1255203c69c00d85d846ca98fa52948c7432b3251a7a0f489cbb34cf77620e82f87bbbaed724018383de10fe02736a13b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9066e04bd66d789e7af9c8224e55734

SHA1
108956245e5c48c559d263fdb097f006ff2b832b

SHA256
e8cb44571c917f7b67ce648ac2e1ee1505d6f75db51a23d1279badc6c04d733b

SHA512
486ef2dfd683cafb3e09188bc52ae91a405a6d7e956937c310126b5f3c3b1273ed0b8c3b98c99134a0633e948b755f6d303096559733a5798e491b015b69861a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e45f61c4759fb1e1c5b9cb719e112d9

SHA1
a9424b0948efff6213b31ddca1fa86233c44c93f

SHA256
8c70960c7cf4c358dd3986a46ed84b76e4d9082964314fe92c3cc3082c396aef

SHA512
143defcc342f605a10d2ee31ea142b8032e5e9ee29114e9077522790fd124d95a2453164b61e852e890edf347fb64b8a97dbde10f997bf2058ffd0a707d78899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3dd5d916cc55a986ce5185a01b5df5e

SHA1
d29ab538a51e5212dd097a4da2186d9e2eea05bc

SHA256
c4be7a96d04092a93f1065bed7bc372a823c19bf24dafcd54b213210d79fd96a

SHA512
94c0a35ecda337b4ba5d03c093ab06383e25012ad6a19921f75b2ddab4ddf12cebad94cb440a821726b95c98d8722961812708a1b5ae45610b8fb6ec3b64ef67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3750589e44e49fe6356d826edeadf6fa

SHA1
634cc6ba7d7776a2ef5c7ae4dade094a4bfe7af2

SHA256
fcd7743f6e242b39b100b42b299d251b4a9464e95dee6ba0046fbf455f8385fd

SHA512
13c41f4498d32d92fd5baeabd37e60878b6617e4605faad2ff0db270e8aeab8388cd93a9ee5c695260ed0a250f3c4dbe62e9d6bcd43ab337497decd431ec9cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15dfb1fd51dbca646ff1585cd692d463

SHA1
6dd762f396973d88295000051f3cbde2f9061b90

SHA256
05b12695c410bdbc4c4314c74c912ac3994636b4174a6f11816e1884f6386f18

SHA512
d6d60426937ed28d32a65bdb6dfc99023185de8c63ae30105b68d3533fea5e1f67f4e11f4ab3ef9af726a4fb9617464a7b02ee25b45b630bb176dd47bdb46502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acf789730dbf99914d25f5c64b7e3874

SHA1
f534b958fb9b4e83e49fa75a03143c1866c45437

SHA256
00542b99fd8f4cf6b732e9d70a6d08e92156e16a51c2dd3dd365add6c6b8cf35

SHA512
90504251f8cf6d6f89ab332d1a3a5efe5549f82c9c1d8de4fa0ee8b93cd892af2ecdca1325442a95a371175c1aa3d8d35344b1b415c28896b98d3afecd9af3f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
524615c5b7caaa58cce40fe64f2909c8

SHA1
3f98a0123367c44f18766934bc36f9d69cf265c2

SHA256
9641333745239644d6567dd7a2d310949eac308778a591b757fc6304b9feff92

SHA512
62b2d0eae660f469df1b7ba4d2a8157365962c2a718ae07c45494c7d96ebc2636badaa58aabce53dbd1270b2357ebea6147df2666022f2592f9105781038b500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc91ce611c5587b34e9db729db28c6b4

SHA1
4bdea49a94df0bd68f3b6966b47845c846e0e8ef

SHA256
3cfba9fc2579695f76761037ca8c0346cf689a6a6c98fa68b94486dbad7116ea

SHA512
243d19750066fd2a63cb4300fab5cf7585feebf837b0165714dfdea10af9a8f41442b8322ed48836c5bc11c48d4c02c3d792eecfe8e8cf8a965516824f39e6d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ea8a010dbb19a2ece84c8b536dbd263

SHA1
ea043c8136bad71152e8b066b263392e97428ea8

SHA256
ce6b5d4b2ecb8ef17286008343860734bb6b2a5d781aaa947249014d0569ee71

SHA512
d129f951c2acc138c28394ec438e4041e612109bef7e4714b76816f33b72a410c3b4062d41bc6e4efb01361da482e1e80407d1dc32dfd234e6c77b1e19bf67e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eabd2041c8384485edc1c67f79ea7b8d

SHA1
10648fae562a7610a4e8b753cafd91df4ae7223a

SHA256
8ffc909b9b5689c8fbd526ce5efeaf46a779094083dffdbd8b64ec9714625d97

SHA512
6da86a9e4b4d408bcea3b1bc476534ebb975af54f1102c1a4c64eb897cce7ffdc2f9edd18b9c8f3f05a4e4b252827a6cafec4868ee0de6c82b00dfc1831b1400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f26cbbb61c7cdb8ab86065cc11e550d

SHA1
461a0c0356b3d84a00486b5becc8c85db8ca600c

SHA256
9878ef2e4c9af214245b9a9902f71ceb2f03164aa4c4577910c23a10ad150407

SHA512
92492755ca30bf3f99ed6e8828a87ebbfd66f4d0c93d9ed1847e50cb0a0be284b0a50c01751fb394bc503ecefda8ddc818125b3d547f73af1df37eefa3356412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22bc0e9dfba78d12d80e613199f88f5c

SHA1
38117a60636dd10db769221b288e247c23b42daa

SHA256
a5118fe440d6c4e97a0a014501118e21c7df67e78bc02f99d86f3ee2ef33d459

SHA512
e04eeaeda0e0b38689eb8d89f446612974a4f0fbede5e4647927fa114c9ffe59d9647b6e9bea8be1b7807515881e9af2915cbfa9d6da6a5dda566c8c3bfe51e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab278F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27F0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit