112afef177f2d5b3dc9fdcb6a0854c3172b87b33fc751f2e421940d29de5ec7b

Analysis

max time kernel
137s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

40a131d034b377a90ce5c30426a45dec
SHA1

1384fd019489bae7feebe5713003a2cd5929420e
SHA256

8607bac00dc5635a0825e9aceea08613f441d1690c5e3e9f7175936112332164
SHA512

37f6bddb6f01dac097204f2fd59216b9136bdde8fc97b7d09cd1961d9e9d3ffbbbcc8b662139fa56e73289008856df72b940ea66c1724c86a39554a4db876439
SSDEEP

3072:SEH7kfI0L42wryyfkMY+BES09JXAnyrZalI+YQ:SEHL1r3sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FD87BE1-13BB-11EF-9F3E-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422049858"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2944	2224	iexplore.exe	28
PID 2224 wrote to memory of 2944	2224	iexplore.exe	28
PID 2224 wrote to memory of 2944	2224	iexplore.exe	28
PID 2224 wrote to memory of 2944	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab91a0074c1f5b2715018c55f5fe0446

SHA1
1e675f0a413842e04ab9f18147619280646d6c41

SHA256
53572b795908b75d09fa48792546be537c177192a9f214b124f7992c1d9553fb

SHA512
45ca12ac10f2513d22dd6d2b761074249216ee9860ef02435099bbc5ea7c64a586302f509ac50a8aaaf4d1e284fcdc35acaafe0a616be5fba629562cb31ec77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7d38b48996fe6dc5df5bad200b262a4

SHA1
8110294eb1984e2074ff50da66cbd1b4b9d2422b

SHA256
1e3fedd088e96d222277965cf3578b4530172ab153f66ab5f71dd02a1890638c

SHA512
cb029830b22b2534d7671f74a8a242f305768199185b20d5ccd1978b80539f97f158cb69e8c4eb0c5d482c6dac3fc73c0cb07b22e96acc629a7d7bdb7b34c233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43241bd8de0a100546116c9769a8a491

SHA1
f6b1f8513cbd1285f0ebcc877245ac7bafbc3646

SHA256
162144183ce8de92baeb8469ec2cce1a184bee9146af2da9f0df05805686ea37

SHA512
234cab88357a77d9f26e842a5292ebbd58b1599c5e856511c1260d49ba3efe6e7a6e87f3a5463096c7c4b3031bf8079404f1a52e26f72ec3f5a06fb2edb93444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
799de4532e337f8ed3f8eeae5ef43bb3

SHA1
99df4a5a2088bd86fd1ae6c8cf860914263da774

SHA256
ed3e32620a270eeb0a487f0c20b9ca2d285446c98e43e8029e7b04b2f2550aa1

SHA512
d3eb5a1dbbfb02a999bc8f31ab06a94bc7b68bde867236086c1896c0fd8ca72677b6464a6fa0c79999e1bc0e9a1c1a8a8f99ecc99ba0f53735682af10a64348b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20eac7b320996fb3210ea2edb9bd50cf

SHA1
64e62640dbde1a5c160a5f30f1e16dd6b4b0f409

SHA256
3a12f4f8ed1a1958fde9115cdbb57d350fa83580b5b92793abe312ab13cd669f

SHA512
1185af8280d5cea1455c8e22ab4a140bd7e5696c2021ce80a238d01bf775a1ea964a14b8170dbdc373d772db233d246780cc18664319c0ebf9575b0aa31f81e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
935e0ebbec62c508295332d349a5d1a6

SHA1
489b2676bbd66da61979b14e929978fb03fb01b2

SHA256
0fca7d66ed0c407f952c58dd0d8ee602bd86aadb20a888167678c36ee3773b79

SHA512
61d9bb0a2678f0c4b86f1017bc6b13fbe6d7cf1ce1af0e8c2bee2f43814ef0c6af51b167d2535d31d9918a18a0da9a4a775986088e2a34a68f236c9d9c0bc3fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a36cc48eb5d5a5bd04f5f20ffcc2eff5

SHA1
82e20e5b410dc0ec421226299312c277b87b12c2

SHA256
f0abfa3a3dbfe58f1db7f0865e8c398705b23dad2eb040a5e44e66613cf9226a

SHA512
89935e6335c835774c52db55fa3b169b603a5b3bb95ef2b62cc8ac0654b33f05deba0f7bcdf214b723a7058613a26d0cd702e713db39ddf4f6b4e463bb09207e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8deb77aea4308557a16cc7a7f789ce01

SHA1
983ba8d2efbfa0dbb8c53c2e89fcd0b1bd6e4f8b

SHA256
1ac702f6d2c77065eb1389b547aa45605f55233647dad995765ae4bc0f46caa4

SHA512
671a249941a5efa2921b07ddd643db758b4dfff8491401a802e86a3ad46804c7714c741fecb35b6d84f4e174857d9304a15c7b253163a95f2c19376306f3c66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac9b13a2fdec1e9109768efe1700fd7

SHA1
79e0d90b367fa489abd3e635f73414f4581f1df5

SHA256
bce65ea571aa4f9465219b8b1f121d26ba57658b770805e7d12caebbc1354e8f

SHA512
d5a0c56618e32d0fb4f02c99532c874606f7fdbaae70201f2c5d877478a80825c12f42c276917377ff5142c60c161b153e2821661268a283a18b6f9e57b4aed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69328cbc68a245dabb2696d2fdf30f87

SHA1
7a02008cf91f75feedb2556d3b251c69420f417f

SHA256
d5627cd0ef88f80eefc6beb0bccdb4bb905658219992c98f2722f9513225fe62

SHA512
d4ebc9cd7f39790df45dd35000704bf1c4e6492ef53c764a2455b04352ef2717678d604a6eecb7e3d969f6bf984551128cc9971fafc0ed651ee3ad7fa93b39d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3ff0d58c5daea7344baaedcb459b1e

SHA1
af65f663b76828744c49b8e56032aadb7498f5a2

SHA256
8cc4662be23659af8a95ac127c68824ad8d85fc9eb53b8ee3bd764d970e34fb3

SHA512
47675ce2f06c875a6da29c4ebee89c18f558015788b3492a338b9979ca01dbcf0483d7abba43ad19cef1a08dc4a23718619e7c895a705adb64795c8f14c7b662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c513ebfaeb57edf1eae58ef4e3efba

SHA1
d140a0e169aac899362f5dbd32e3c3336b47ab3d

SHA256
da5694bd7f6814ccb1fb44ed59abf7c6d1cd5e56d1edd8a1ef3b9d4e9451b773

SHA512
1885eb73cd47ddc193357b99bee2bd07e8122532d4f5c6f629b137e1b8d7d9909c74ba62bea2198ef8012416aac60b6332e486deb241df59a5f7a26adac44c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6510e7f2823837653657cc9e7325571

SHA1
b777c872075fab117df368b2d1d3f9640b17266a

SHA256
9001d2478b12b81f6d9edef17a79b675a4c4ab19d55230dfd8820b2e4693e061

SHA512
464f455af252f824559ce3c804d121474a0f5744af0e46ccf1f4f1fb0760075696de8ba594a9b9d0caf9c888c03ea7372cfd9cf0f65a68546df9bce1e853299b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c10c898a9f9b64bb6c6be2741cf59a8

SHA1
f056acbe697bcf786917cdecf518e90f9fac9914

SHA256
c669bc1933b321722310d31f1ec54080d2614e3baa9e7d03d25213a98f09d679

SHA512
9d65ee61796d7a4080c21b5d665dcdb61fa32a92d73b0c7bdc8f1d7838750087dfd03061d7b6a94d52ba7323200dba5f9d100d8f346cdeee8282515d518de548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf65b752a63c2c11867b416cc0141068

SHA1
590a99bcdec1f89f09b3adcfd83293edab20e22c

SHA256
ed484c233f6d34cc8eecf55b5fec776017c691b4984c2e2be2d8dad9822441fd

SHA512
ced44d06d678cb09f4c96972d3fcb00548a610e90be4f2ba75b34aa27304f39b041a6ffdf8cfe5f2f52edf9c5292b6d7c1a08301f262bed12dd8dfaaeee27d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed409b32f1b862a3a5c8328b23d1555

SHA1
b08f78e0455a69a43df24f4307b38dddbdfbccb2

SHA256
2d2d85ff0a6a5150527453c99dbbf372f221eea3af6cdc2a6aa6484fa73c6967

SHA512
1843bdd50653c481f9935b9fe8a92d6f9c9489c7a50db36936908ab6b0cceca79af6694b583a85c54583c3de3b07022c37c802ebe3a014040070958770795387

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9095.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit