8a3f1b2b3866d8facf5e1023fa1932ce85186d2134c24554fa594c419be0e788

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

52322ac36069df405f5be7c8ec1cbe57
SHA1

5b511d10f18014cdca13aba7050d1bbc8eb0290f
SHA256

b034f2ec244bb97ddecf48ad2b1385b9821ee11cdbb8a9f98d8e8a0cf9d9aa96
SHA512

7f5d78e16be4075d2039cb540134d5a0de376009ff1d0de8701b69b4f217d3df275f2dc84135dc257f008312fae58df87146b959f58c8b06de39f863faccdbb1
SSDEEP

3072:STqbtDOxcwQJkyfkMY+BES09JXAnyrZalI+YQ:STM/rsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F948E7A1-13D1-11EF-A1BA-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422059669"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2928	2916	iexplore.exe	28
PID 2916 wrote to memory of 2928	2916	iexplore.exe	28
PID 2916 wrote to memory of 2928	2916	iexplore.exe	28
PID 2916 wrote to memory of 2928	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c41bf0709009bbedf6f2acdb96de3a0

SHA1
2241361e36cb7a98301be89e7c28d08c350a2805

SHA256
805931d3b05a4146208c252e743bfd0aaae7645b0ea28d2c1cb4072badc3e569

SHA512
52abea21215bc7cc204d2d8ce7c4f550ceb8bf1ce662889028bdd236cd545b44cad9a40297278b1ddf87c71ac42e1dad2917ad97ed95071b569c0a8c565c2093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4b2db7b881aa88734da6af15c8d8ae

SHA1
017251e97406129fccdc9eced0a4b57eebaaaf11

SHA256
b2173ba92bf151b2ff33a3d7d4ef770df92214612c2ee8a83cea3690bf0d9064

SHA512
217fb26ee9ca97ea89b1184adbff5607c6b3b8db402b426e8eea5d6b482f9394c83bfab3f1363fe7e9a1d55f10dec3fca168d7cbc217d62a5db695b5717070c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b378c80819501ba0845c1c8cdebede24

SHA1
8794b6d5cde8f23534f1f96e36208c4f18cb034e

SHA256
cede5a63fe50e65d517582b365e2e7340a9e31a38202492a1461a47c2a88ec3b

SHA512
297b6542e3b1d55dc93ed77fb4fc5d4d80ba4a7ac46a0af8c0a059e443cdf78dc215d3fb196607287704f8547eb901409a11a4c1682098ff3ddeffdb57807df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
282250d761fb11b77ed45efbf9cb26a8

SHA1
3fb2d4ee8d37feeed49f4953da325f581007e1ba

SHA256
579a14a8c79827f476371c42bad4863ee43e0b2884950a4022090831cbd8948d

SHA512
2bd53495eee3bd9fa2bb97124567ed42fcd88dd6a7bccea9fc729c17386cf5066f68a55b3b4847c42b1a6d52147113575746d0aa12e2df883bfbb6ae0921074b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5935b6303bbc9ed22f17a532a84f604

SHA1
d75e11ff0bec2475ea5f4cdd1a146586d42f8cf6

SHA256
cca166155bf0123f02b641f4cb16d9fc27da11eee0bf5f1c594b04d9a529589c

SHA512
06c938763345233f00ec3a7f5297cef512ce07fd9e3a2b5c1743f61b2006ea0fbf41eb259f4f5ca0efff2d342a0bd9b67ec33aaf84aee3c8507e2410348cc2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3089979b035a1c4f4ff212050a2d4c43

SHA1
945f650f67dd1f7ef89c0c8755b0e6016f86edf0

SHA256
b2e43e305c4ec09222fd7d91aa12a258175a25b31db5e1905afbdc94ee6ba4d0

SHA512
e727a6da14a8eb3e0ac3bab69fab5cd8249fc9659f6624e7b4c047a081273d5def703bf00215a7442444372f7f45f6b27f929741821f7e8ed0f31fd4403b0f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39467a9fb6b51dc49326811ea23cb419

SHA1
974b481bed8b81c208e39ea03e74d5f547ea8110

SHA256
3c2a6cdb9b45279dc385cb7130ce2d9d59d028377dc4048e26e5ae72c60cabaf

SHA512
3d5c703260a0971b111ca6bf793d1f1a5b1f00976871bff7367cfa968c297915d5b436c2c0a2d6bb5c03aa00eefc94d114482c6cacae8f495e91f4e12dc60e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc03b9d7dfc66cfd0ff26c6c14d82709

SHA1
292e1bac933314581c53c3a23435d919b4c39bf3

SHA256
e04f5fc2a5fcb62f97432825e2fa5780c3f04561ffc3228e004d6312af21c792

SHA512
156bd78682d85163d36f52fd9d4d7f0476a06690ef7d0201277ae7847dad8dc0f48cc02eaf1bbbc19d487ecd2781d7ee59249fabb47f88c3631d1a34be405501

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85bb850684e6579440f0b4ab179dc887

SHA1
aa31aa461a1854ae2004a2d1685bd0125f4617f3

SHA256
43c5edf7b90e5be845f72a6b6397d3197a1aa42bc420728f29e66ae2463e02d8

SHA512
3b4f90fc13ffc338eee0831386a89ee16bcfb73e4b9023d6762368b725a39e513c4c2755d1f25cd7d8b0de4c14dc687e28e3c1c92fd8bbbe1b2ef35477c24c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
417b2eabb77759b85197eab69838b778

SHA1
4718711349717660f62c09cdcbc58820ede919e4

SHA256
0ff04cf27a87734f04a707d14dff4b7d79edb4086f1b5dcb5fbd588c17bf6e75

SHA512
a65c1fb494ee713c7009b8894baff8370a274ef8a5f8f323e0ed4f3475de5635b2d1a408be27d4c6f528979ff196bed1c771e0d00e22632f9054a4df1537a6bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2213ee0f39d3d1de7d1db4daed71f591

SHA1
7eb4afe060000fddae8f937400441201b56c7b7d

SHA256
dbf7eb8183d8e0d67dde14a2e6f98c7783f99b48476d292511325061420dc048

SHA512
7c6ce1a8ac0f9606e38f9120620b300cab9daa4b9e8cf3ce0b4592185d14b81045264710b0a74a43b7257ac367b53f654c4517af71ed037aa65705c0b23a0a8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59ba75a7b8f120657e008078af355e61

SHA1
0e81ca3ed9bc7a38a493e0958dea5ed99dac8fa6

SHA256
448cfddf17ac93eb9ed7eeaec17dd0829c3e7c03c219da29c97006061afbfbb6

SHA512
01b2abc8c613a75fa0d4cf27d46bcf9c7b641c4b0c727ccd7c5151607c3fc5d7ce1f689de8f8eac0421c552751723810b917cacf559e5a59e3f71709cc091d2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d11fff5a8830b3f783078ea84590e39c

SHA1
405ff3fee2e36791131b3ea901b51f89daa11919

SHA256
f02792282f2605f464984080ae469757cf03e0230ac34a4b4d6d01c6aff85e68

SHA512
1495276d76b32355b155a3e4c2be51793c64cfa75dbd41922cbea2f89a2e7c96fe1c48eeb188a66a2b8a03e9424d5a75bac97f1e7a389f642776ca841a55ebd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be6ab670bcd68f5fc78a79d3d2cd7708

SHA1
b2fbac3ed042ba983dbb9736d533ad4e3c417f00

SHA256
ed237f03b43ed9cba215aa3d11aae33a13d35b2985d8bcf9d6bf694fa1d4a367

SHA512
eaada7664b3723ea51c3ccffc6138030606b205df8d8ce35795a5a1d3a60c7db12ed83c6d1cb206f7a4ff989a5a2c1323c4c8c078ab95b506b338d9177a104d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eea76b9197481d6c1e82a36f3facab6b

SHA1
837d643fd0ef748a271250a476d4473f509bbb74

SHA256
98d6ab514bb78f23fea4ac5620611a8a88f9d9236d3a505c0bc4a7a1d4cac38f

SHA512
01e38ab57bc9c369ffa1b06c07fc1e5ac1912a2802802a4764ed8ac562be6b7046bb55c32edce32e960acd9e8fb4a829baf00ca1821a0d390d2226c903c904fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba8e568f826c3ac38e52800259a34779

SHA1
1a2f20e86348224d7cda1411e1ec897716211955

SHA256
b8da6e3f45d9956411767a69dd6cce2bc68699792fbf9d1caa2e66a45d4f8d7f

SHA512
ed4288a0dd962e22e8e41a1beac4b885337d19037f20b2945b2d13198d277ce5b151e78e4f83df02c1cf567c7bd6faa7c3739d5e4a155d2f2df97d80faeede1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
849ec9233244e105b74fa6530264e5c3

SHA1
c75951e6e89b625522dec811a5a2e1913b32dafe

SHA256
f7b4f4e79d99c0a91adefaa6cf79f959fa6545be4a17c3940a0012615f0920bf

SHA512
7831a4cb51efd0112223073348305be637970764dc2be81e77f7edd1b1180d72e163cda38cbf1c1d4591c5b62d4529d5808b6cf40e3c8f581d7e4b1124a3861a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a291fec30abe39824eae585342292953

SHA1
ab2f06565d44110232517ebec69a2a004f3f080f

SHA256
aed84fe51da078b41f372ddf2a18e16dd51cab08e885f315a1664aa020930347

SHA512
c12fcbc4b9ac07459e7b5c43a0fe1cf7008e4242ded735a10e1bd762e7fa00c20e2c9430c2e6e93ba3d6d2e0b1c73fb00c8a10f83c70955d0184812d1029313e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56ddf3169f1ba3637f4e6026f4e0448d

SHA1
ee67fd1b82ee0a27100fb7a91d2ee6a3a7990829

SHA256
0a1829334857e3d2215ff9156cdc4843d1bc27a34c48c7051e27e96857009c59

SHA512
253be41f6c5c0abb2652fe3ce17d2518652605df0fa19880f8f2f4e960b8f49b0d4a878a97ba4e34f3921d839b2396023fef86b0ce1bfb0293f2f14c5a87726c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CBC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D0E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit