e6b12525f323849234f760125432c9dfa909fb7a7d20530f28037fa2fe9b2897

Analysis

max time kernel
136s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

40KB
MD5

fabcd0911d7667b02406e6a32e9f7186
SHA1

f560a7c7a6a4c9f2ed7088d10820b629fc3014ef
SHA256

3d601ff982b0930076233fbc945264f9e5711ac097db7e78bbc6c89b1c8a7971
SHA512

af1643e23847b7b0a629042f2e6bcd10ec6422e680c323142eacbf394af307d0dffbf7616749ece819e1c7d7045098d6ac50eecd5fa23069b187b0596df216cc
SSDEEP

768:Sdmh0OdBcM8K+IJ2RCUcLbMy+FEBc3Z8vf/q+GWvbq+J+49mIu/V+T/4Oypj+C+6:SdmSyj8tI8RCUnyQEBc3Z8vf/q+GWvbI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004f8f318410589fcf8f8a85b9046b4f6a72e03559cbd05ef35e60ec6fbe2737cf000000000e80000000020000200000007eec5d4e04053f48a0e49006a9093bdcc2ada03458349c15a6f83d5b841bd79f20000000e53fcaaf912086c8f44b6ab041c98e9936171c812a8b8d3a32cc87e136daa43d40000000cc0f0aec1dd8d801070e24d4761f13eb3e531ce9ec6d5a9e4b470cba1678832ad123174c821aae740f0a7d50787dc0ee8c427c9473231cd0f95a81c482c06c87	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD5D15E1-1394-11EF-B04F-52AF0AAB4D51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908ca5e0a1a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422033397"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003f645eda5faf4dac2670ac7c7d5d062e0fd7ae7e8bb9dbce28940158f5bf530c000000000e8000000002000020000000f52751002fd2f923cbdc40ae0c5f7a649876e96f9b497f72e02150777991dcb090000000d28d9ca2db2cfd4040b6017a9e9a85c9cffdfe51783559b0d94a8f8a81fc01a0d2d68c00de53c7f6d3e391ae600712317c45aaf377f2ce1fa8cabcafb3e5a9c66eab3e391fbbc26e9a8ae24ede4263f421f61b77b864a04379e37e229d1c5c88ddeac74b63adc507ad03d5abd52beb0e5e97eb7da90fcfdb46aabc8eb86cc3d4d07d106dce86c191ecc06a1745f37f4f400000002f4a32cce09ac862e10b7939b5699edc7a07f37b601df86ae5153dbd8b29989b5b0d3bbc654b2c00e46be771d776fef42b1cbdc67082f75a796970ea0f3f6a48	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1904	iexplore.exe
1904	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 3052	1904	iexplore.exe	28
PID 1904 wrote to memory of 3052	1904	iexplore.exe	28
PID 1904 wrote to memory of 3052	1904	iexplore.exe	28
PID 1904 wrote to memory of 3052	1904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
519cad48bb2f41ef3895471094de3a5f

SHA1
946e0e2c516efbcaf3fd06c0b93882907e03a419

SHA256
d947c12e1fb8c2bd36e9b9e92b3e70df534af27964332b028fffc7a89867cb29

SHA512
986be75f5e4b505a57eaea7e3f78ed20454745738022111a804f0365bbc8851a3a81a9e3a7f7bc6312491562f85bb77026050365843c8a8966320ebc51d77868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f13b09a124520072cec49273aee8f76c

SHA1
b5c09e9ddca5610828c8101a747806f4975800b5

SHA256
93acca8405da022d60f0453ccdb0a3dd42f94d15e917c1a9e0caf1f2c5248659

SHA512
b643ffcd0a5a913b8ee99e0e436d2d879aa4863358004f4b2e89b26e6630db7a4371dc4940cb214e772da63d7982cc605adab35d2ca4edb628eb596dd8ec26e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af587bd41fefb1700f7f856d567d3b70

SHA1
199d6e87087d46545011039d1fded685f3574ecc

SHA256
0a7867fe168722dd995b78c2c925850cb17403187d28eff71edfa9d11d28861e

SHA512
12343f49c581e53b349d46f7c86755f174ccc4d406baecb94726152ad19b24587761d4c0253c1494e6086590311ead02f872fe1306034f75117eac4b820c2abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e8d2657848b107c517103368c1175ed

SHA1
8ea7e83686fae09b8f162b777061f7b4a7ba6b0f

SHA256
60e6e23c88d1720a019b36c18e7fcedaffb28d0e92597b8ab330bc48a9ac8ed9

SHA512
a9f0777e9d7dfc17d458a94f5c39a830bb7b658f36e321ab7da2bdf7911dbc5372244ccef19352132e1ff87fa629ac4812ef3d7500d4bf520d278faab8060570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b6a102d20d62aafea8459260ab82a57

SHA1
075661fd5e0ce143e2fef24c10fffe03de1d28c4

SHA256
ef398578d507172f4cfa27deca385d9e1213544762c994f5c362a3132d3b1f2b

SHA512
e2b1df35ce465540c5c0288de061d6385a104c9188eb329b02055c6dc04b32b51e2d4309912b1aed68f7929c6df74ae9212bd4ba1230e5e1678992b8af3a8ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa38c2553ce09e8b9bff6584a4d1eab

SHA1
fb00e0c7c3b9fc546fc2544d773176e7ddc606f2

SHA256
fc303f0d1dc2f30a7322da4571cf56c64b97b7c8bee023efe5ae5b2ff41148eb

SHA512
c6c3b05efaa59632b9fac96605e2432fb01169b1a4221dc37fc3f4b215834d46bbf0995583ecfa5f695dbd1013f00180dff4921c4002dd6d9cac902de6dffa56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dd0b730b8f479ac3dc79fe32681a07f

SHA1
20e230a01809f9251cd6ba011e92d7064b3320b3

SHA256
b01222f6abb2608555a98512c4b9cc88cb4a8ff87d475ca54aa886ab5fd03a79

SHA512
64f0cdf5c22dc1101fafb936d7ace986d3861a3481e39241ad9493775164356ec5c01f9c1e3b569cd3c7118f79894bbf07bd66d75768fbf19bb93931ad33dc2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb3ea16bc9d403a49ae3855a8ff93a22

SHA1
c43e66e42ea33bd53c9f0c68f1bc9f2c0d4a2fab

SHA256
5e2f57369a82b4a5ca547c0b862ddb457b0f54cb832bcd963ea1e547e6ef6518

SHA512
590acd1a8f43d8c3b3f56cd179d316ee495c1dec8c725c38388133e70289e9aaba1697c81cf564c87886e73212ec9947feacbb56f81155975d1d5ea31cea873e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f61e9ff0b116b0a56e3462f2ed573ef

SHA1
252f1328aba697cd1e91bf4fcb83bd46baa42dad

SHA256
aa1240bae97db9c9c7c28c28d01d4290be5159586480bbd477d4fb8055ca00d2

SHA512
7bccb15b038279ead48695c7400e8dbfc9cab1cbf6a8228502fe82d97b2868cb392703b2ecf61834fa8514031421e69f207bf54f71eb614dbc29141373d0d36d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac8e857ef45a39b1a0cbc0a67d094cf0

SHA1
6917b1b7b006de43a9f01ccde5a552049e1d701c

SHA256
362c6cb962fe93520e40ac6a4704fb3cfe96e2105490190a1c6f911b7ec63c47

SHA512
54176a6db7c6592b2bb4d04b5e21a8a65b41fa2b5bdf2af27056bc739c0511476fcaacc4df0d5220552621dc03f37a0edb2dc6883cd8fcc18328725561e73f40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CC4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D46.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit