5b58067bfb7128be00f23ac881050da095fc62959dcedbd12d310dad9022793c

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

6c536b4265701f84b418884c9a788e7d
SHA1

e47cd8fd7e5a49da13ba123f69b75ca99468a828
SHA256

3e140996e84a712cc7bb19ba738f2dd16701cedf5c82cbb2e379aa27a7cd9817
SHA512

620283fd445cce0236b716258a9d124c24ea007db5b424298388e9c99d04b9527c1f34ceb9315257dd28b7f514dd51dffc7325201c4a5257ac2042ba0967340d
SSDEEP

3072:SZDWfmtQlPtcn8hyfkMY+BES09JXAnyrZalI+YQ:SZklKPsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC55DE41-141A-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422090921"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1444	iexplore.exe
1444	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
babf9374fa0e7b05044195e4e552e86b

SHA1
378af5ef507f786468dfb1fc6f062def34c58452

SHA256
2df0a9d88656997ba652c9c9444e4e422da673163374d43b44aac44db582be6c

SHA512
cb51709822602a69c42a1a07e88c801de17d7827f51c7b934ec4f418d084b6e8948ceda6b5b47321067bdec7e0d79cb74f264bb071d07c7043a7ac497bcf248f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dcea110b15a51aad79a62380665f523

SHA1
5b0482445f1684207a122538c64fcac187bff7c2

SHA256
69f4584a75bbc18af3076c7c3dd14578728bb11bd5486c90e2d6d15fed927e21

SHA512
b50ca042c194163b64c3a02dba7e5e81a380669ffee339fbc49ffd0a2223c4fdd1b3e18233d5e1d5fec12f18cd43c912bc9180eaa8fffbd4826eea46431a8ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9dbee9420300db4d43ed742ea6d4337

SHA1
635c1f083d8a3c4af97e0c8dbf2ff048ade63ee7

SHA256
8fc1f3463b6fbfe80a09d56e2b900d4ee2da9650a7cfa09501fac41f1cad2a84

SHA512
69f992ee6106e7216ff2d0f5ab2a281d1c898f38b5c5406c3b5ebbca21e20bcf899bba917b85909c52653452a649433ad243baa94623e5ef8509b14fe379417a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f5155c79be0fc7d0b49768f927f9f5

SHA1
20c759c12c9b5dd57bbb853562c4b5b657ee47e6

SHA256
db5e56d5aa37a9b83c911e235dfc84ff5f97ba285d1ce46a1ab76dbfc6730346

SHA512
58444af08da3fd2582cab98e3518ec5821b76dbc25a04bc21c5c44fbcd9ca108f3f3f15ef8447825880c30686aa8368870dc86c8092fcb483ce5bde9886d9edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02cbdd6a4c8563da76a01cbc767fe311

SHA1
5bd3b1dd078ac94de7bbd7c68e47e8c019663334

SHA256
d27768d5a4e0850172f724287b0c1b97c2e92712464ab4c6921858025457db57

SHA512
02ea3f93cfa65ab49fe3ac15362870af857e6f9b4cc5244058a84ed7b3736b8631bd40ea607b192f9899f2253218368411e76d9ba3a2c08e1e9ac2a23fd6514c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e921f8700032cc7863bce4ff6be3da93

SHA1
424f7f4a0eb1c90d711083c193552d09b7d5d494

SHA256
9b1f0077a0c400241de5d1257299dbfdb2d67b1d960588bb12fd69f5c12d760e

SHA512
f6d4f02a65b0fb7d2ebc46f302b6e2780d0a39c025a6fa0ec1f0a8c9a5ab6ded217f9dc4f918de5d2523142c129ecf2287d79d25182ea7757e4dfbc10062090c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cb69e4becf7870ddb1d183c5a9c2fae

SHA1
95283543bd1b5bbca4885dc7aebf6b41a2eab33c

SHA256
2e149cb1a7bc23169802bdaf24c3a183b1fe329054298f60043aa2a5ce362be4

SHA512
c218bd25b3a5a6d6dca88cdd0abb6af68813edbd331f40fe5bdeea5e89fa1cf62b934f8fc0b1dd464ab94282054b92da4596c089ebc8ff591cf83fd5955a5ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cab49aee102c480f01c795e629512f0

SHA1
51a84f75ebbe294ba6ebe49695b134e01b14f4b3

SHA256
9bbab756ebd8fc83311f60db5810e0fcd931d22fdab881130b5bade10e29724d

SHA512
dee435e824b80a4513573e744022a102cc2eef71da0c4ee3928481c2627ab99450f6248d38a5a2799f586d10547d8fe8158eb7012c3fabc27cfffddade434ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d957cd74e991d062316d4938b5c2f74c

SHA1
0c94063e40a766f1f6b6b17507234de9934aab95

SHA256
0f22203c3fe9a8f1a9fa492e335329671d39b3ba1bcdaacd7345bb49819364b9

SHA512
0cd392b35b6829b2705e1a1d2e560043c48354519f54a475899a1465ccb6d49d36c20c8ecc059daf861d84b4ea3f6fa5dc951bc723a63614a250cf91341eeb83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
038361f3dd5df8ba53353f3f992f5c0e

SHA1
291146e5c2c0d444be205a14384c0c29f02eff00

SHA256
59183cb6af8aa93056ee21848832c34c72faa8cbf0919555885cfd48b432c2dc

SHA512
f0f73b8f2da8d0a4cd4b99bfc644629c51899d8ab4f8f60535de2bb665ca5454bab4b9fa7d490d0cf8875447ccffc1d1c244ca26c637c2c4698e881de98294c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4d9ca4e97aefe76b27efd9c85f998a7

SHA1
bd06a5e2f825fd454236779e8e845ba1586846ba

SHA256
742f6f1df167ed0e2bfdfc6390f90347fdcc41c38d9846f72d9446d48a180de6

SHA512
a240562aad87a2992bb317fe1dce8b5d46c338723b860017893a7f3b54ed5639e73e507650f2c94c91e8f0d4f8c44dc7d5d8c98a3c9975c0167bc4e27b8d7d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c2df83632b83a0ff96b27d6f007bf60

SHA1
6bb194f7f5048fd409f6aa6f307fcce713dfcd4a

SHA256
059cde68c58a42f708229d8285d39e7b23cde54038b88ef9478ab212d0f8f733

SHA512
5e23cc9c80b17c3b2c5e8f6fb646ac0b12a35bb33df827e30064447b07f46330b51631b5ba84cdd12e4ab9828643e4334c50fdfcf749671b0b5ac63d82655344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edbdbddfbb63140b3a864d2579f375ed

SHA1
8197a550501a47a11432bfe07de45c81f4fe9c2c

SHA256
a791c4950f59862192f494ebd6e83863d0569fb68683883f166f87a565ac9a01

SHA512
15678765d2e510d6083caa2c7095de8b254b34b12984ca71cb6071fae892506f09a2eefeaa5a5f45c576a2415ea935f750338ea91d5ff7bbb37967f85eb30eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07dc7133606b90adf28518760c9c0fe3

SHA1
a5c5152a8888cce500084dea8a7b28d4c1c767b0

SHA256
e080480cc43d65e186238a84da919f0f05296de60940dc49ac3b44e818aa007f

SHA512
b23a0c10e214671b3938ccbc0296f1179f97cca77bed3a56f541013698d07d8c214aacf15e93f2e50c9dc8f4aaa27fee2d94bc15c26b6e96379081891a2f8555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90f72cd4028713268f04b177a5075d5

SHA1
da7efcf16b081285e1382a98f594c59fccd0d94c

SHA256
59d7fc2105b1bb57265c699a276417d6ea60133754ca7c206d56c7e2e8691aa3

SHA512
86f09ca3c4608f4f1b56e1e61cec95f4a8c3d6dad744984c1728a034024e6fc7c18031fdea54317b551c95698b8ebc32c8d807b56f6803ecffc5f8afe39771cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c8e532b41c80672a0059bdfa1a625f9

SHA1
0fb4e6bc0b27bc5b17f4034b6424382041bab8b4

SHA256
c49323b6aa7de8b60666db86732f6747a633a7f6ed8cca5a4ec04b45ae7e614a

SHA512
03d1f3f464c4011873a30b1bfe49bedb05f4659ec427ad4e914cea08d82e12af7c73cc587b20a07a7285ca9d3031c20789a341bcb04a8eab3c3bc6c20c37bd16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55540098372fb1cf6ac0461535487004

SHA1
1e6412c9244424fd772dc86ad9bdc0a0c75489b7

SHA256
21dcf78d5723ac7c8017388a4d5b126c3fc2ff6dd12c748721392be44d82e04b

SHA512
9f8149be7b24d98a6d19495fc1d3ed263c26591318edee4a853bdf13b5d225b2baeb0cab95223634ae9fdd39433eb4b721b156d0e3b03d685872498d81900b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1868645f3d4ab13eef7a5c45b5a3da00

SHA1
7b690e42b641d6273038445bbf3cb03ed81dac70

SHA256
9891f8a92a804921dd7827208879deca72ed5ab4b2d5b25e8c86d6eacdd739f1

SHA512
a7851373b3593c3ddbcac0ca46afe3a80113dc5e967fea7280b10086d2484389cedda44f68efa16e6db661dd96ecdc21c89968d318eaec3cb0d09c045bb6f6c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36c382f2655ba0ee2e04b8e01aa1efcd

SHA1
e367f8ef64034e3632100a5136c36e6528cbbff6

SHA256
7e7dcd1a48f946877988e42af1838993229436637bc09c707bd0e7858574fb27

SHA512
c2f1101a1795c6e4f0c97115495a9530d25ef330bbfc4c64002e52ccbb613c3b7d663c35c1acc68c68e6eb5102e0439972efbb13e110cf60d6a3fe5043b52797

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CC6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DA2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit