1c0518c29ef941d4f9edefe0629652c97171c4415b6b9f797ee4c7f0ce76ce07

Analysis

max time kernel
136s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

955c883b1bf2ac407360029625c5d6bc
SHA1

498b4561498cc7d43cd43fcd034e54a81accc0a1
SHA256

257ca91e1351663af79e7be22a51e136b0b9297762a54ec4ba9eb19c0cdd865e
SHA512

3d30d80707d5106338b5d9e7ec60d36dc6736a2699f408cb8ab95d500b815ae255c623a9206da6773035617da1113c82cd5cf59330a310ec1909c3da9598cbaa
SSDEEP

3072:S5s6Fjpf/0Bc2yfkMY+BES09JXAnyrZalI+YQ:S5VbzsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422060300"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FCC4D31-13D3-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2860	2888	iexplore.exe	28
PID 2888 wrote to memory of 2860	2888	iexplore.exe	28
PID 2888 wrote to memory of 2860	2888	iexplore.exe	28
PID 2888 wrote to memory of 2860	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e199ea6f770d3f6186d9df84535b008

SHA1
5ef0046a92570d904d9c8427a70d66d34dc917d2

SHA256
21fa0cbc38d43d416ecdc02d98073fea2f2f77492c6a989131c704879d240da6

SHA512
ad2bdb78cdd32c572c93a794a7dcb83546a52585dcae8ede2a446bd88c7bb9bb6f99ed078baf113234d827b1b755657ec7bbca04a50b637775509c8fa8e8793c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91c64de07ddbc57373d8e69d867569a2

SHA1
8662a1ae76b8b5e1d8526fe7a3c8e49458a11a96

SHA256
cb78ab917f36357ba4d07165345875843b213bfcf7d4a04f8f4a5a663bd3a34c

SHA512
abb3465ac3229078a96598ea51dde0e7867056cc62cc607f509ddeb5ddafff5bf917d181744b31597cc96fb09c513376663b0231cafc2d61ecd32ffce1c95ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8281861f348f987bbad62311eb34d32

SHA1
3bc959261b583769a6ce6f1bdf9a01fcb2e3cae7

SHA256
efa614217cad5bf56808c48c53844fa70a3ed5864e251b17a4c9e4a3541f043e

SHA512
a5c4ad41b6e3afffca0a8c30802c138f6fe7672b8c6227b44ae1993c3d74d70dda2b2047bfc5381b6c74a98c71a39d9e1fc4d5496595d23a04b58b5668d02990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be99756090c386a1b8707948a18e3e9e

SHA1
13836c57a597fbd932ea264391ea6417b9263952

SHA256
25f3a2ac1fb1bd0e184bd6e79e2cd7da890007069edc7ffff7bc5d78b3dea592

SHA512
22037525ea6a3f24607f4d476fe0a1ef290ff369ee2e9bb9de4ee2b2740971b0350bfa88f9423816210648de8ad5ded40c6a3959c1a35f093ae3522d45359973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a369f1173ef6ce20237ce0c207cb2c36

SHA1
c96ae80e0652fbb05f7cd4b4ed4209bd87eb9a4c

SHA256
a8f5daeba181655b224c148908b3df394f78f88ccbc88862b6762f21464b88d4

SHA512
7e19f665599e516223214a1442fa9c8ff895e2ce6a2f9a700489b48ffd2664d8c8dbcd17ad7d937c5464b54275d4509756615db542da5e99d0f97ce83420305e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c3734abadcd44b9f8c379f165ddd20c

SHA1
6ea9ea32a5942c6b192b45313931b5d78420c708

SHA256
45e8e2c64d59f84b1315f7a43c0e7a128ef1b405231e723a8be8efc85061e05e

SHA512
0fff52ff68db61c7091edbcbb2830e0ab7452fe66aa3d88092443105209c1fa6ce3c4e3f0ebd62caaa1ceb84f87fdbbb631abb2446408790cc74afcdd50ca863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed220b37d93149ed7085975d881e33ca

SHA1
d317eebce75db4abb55121283244e7759df44f90

SHA256
676d75eab68fb6969cef9d08e7dba16a50e4f8e7e84235f03d1cc38c07fad0d9

SHA512
c2052482bd8432095d0aa09b09747b7b95ea60eaf7665cc80c144d70fe45006d5978952dd255ffe1cdc83628a8186eacf0667580b5a2d628f4d80d678d3751b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
506780c763627dee6c06af1577135f36

SHA1
abebd52bd44a28a8d7f7be408d69a34bbfa96080

SHA256
af2ba793e37b30eb40303c23fac6d13e610dd58f5b996ee804010bfa17c70927

SHA512
d75dd090ee5c66da8983763c096fe452b6ffcafe562041916afdf08f14267674382d2ed1dd5e064b53007cce7ebc084859404c658ee4521485b76c02aa8693a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
261d4200dc023fe07c33d12e4b7339d2

SHA1
5cb9746d3583fc7711e276f31edcbbf648e75881

SHA256
dd8e9c1059fcfbec6a266dfbe5b4e17dcfbbcbf1694f7ce25a712b4a3ee7b46a

SHA512
1f0db309c29756df481280d349f3445ad5c0dba8b5e48f439200ce984b876dcbf74b76fb05df17d13ea2bd0f51bd21da02c38c13fdd3042d997e70ebef2684c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
041ed938d065e8c86af261a926fc2514

SHA1
b26d37735f814e1e76a198954c5eb777b5492901

SHA256
ae8120d70ba3e8235d9208b9ecad293193a1972f032bc3c50587c3e870f09dcb

SHA512
4605b47844dee2384b2990e3d84c14cd31508cfa4114cdabdeebbe6f21722515edca27e7c60f78e833ecee73238917fb67012c7f5d29128a8073328cd6ba23fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fd8aed8e5c6619dedf353a137320969

SHA1
1c8666ed36941b762e5a6d8dbfdd5c93e99a8493

SHA256
5e94d4421080334cfc17ff6695902a6d259fa5efe6cc30a8ce41ac6202ce729b

SHA512
ee79f019c4c37f59ab0f5e514fcfbe3066fb843ef786c6e9159fba78d55b20460907945bc88777e66a8f7c9739b1fc53c4deaeaeeacde66dac2c75e31f754496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
907fce2c7851af716db0990c2a4c7a4e

SHA1
efe76bf3f0296f0c8fd0791ec7f6611bcb160861

SHA256
e46f1b0623113f6abb731702a2f97c95fbdad6df1a0b8b606fa985ebe4a68e8f

SHA512
16a0ee02e8bc884afa9bc919559577418f8f5e33d1c3d2a1a7fbf6b660084e014b16f2287e64316c3da9f533748e3c9f8c25d741fd0aa26ddee43b1e8845c557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dec5c361c17dc8d7d5923732c8764f0

SHA1
6a855bbb1b533cac18492fed89261817d096ff05

SHA256
229c632fc37eefb9d85471e5d2559fb9202de740c7f518a4ab19105ad9dd056b

SHA512
125023003f9d0e938a7e569015bfbaae78ca78c997192a4ec5c55de61907bc33ded23a95a74fc526140a51c4f65087ab1d20109ed4c2d3e75157ca3ba017faab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab953D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9631.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit