be44e2cd67d4ab606eb27a9c12a71e153abb5f6dfad1545451868baf55f3270d

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

2c84de0f87d3d67401859c0807331f77
SHA1

37b48258b0e6cd776380c5b5bf7ea25d73104f23
SHA256

c36670df7e271111a0b5b52cc650f7f3cb413fd1ae1ad0edd28b0b640cadcc57
SHA512

f5c75bb17321fb47bb85cddcdbf34250e9eff63fbc6ddfddadb9633cc91b925e46d2102f15196e8f092f7d400f22e9ecedd2ce04a53d79236c49904f6896d7f6
SSDEEP

3072:SeqcHH0Da8lFHcyfkMY+BES09JXAnyrZalI+YQ:SRVXBsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422109707"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{774B1BE1-1446-11EF-BECC-D2EFD46A7D0E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28
PID 2928 wrote to memory of 2640	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5b9da1b2cf4fa76dc8f4fcf8a051b0

SHA1
43aef4367f013d64ae2451d5b4c33b03692a0f0f

SHA256
d3b4a5b4a38df67f0ecfb94685581565ce8861c203bcf95910ec64c34b7ba177

SHA512
48460d3cedbe1a0f1208e56f684c9b7873572d26cbd218f9eea4362da82a5646bcd5076c912785e7d7e6d17bf3f92bacac7c139daf75a37bc970936fba63c65a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c0ae00b156bcd114281d0659c49b3d1

SHA1
f9629abe6d4bce88b5d571ea5d1383486aca0a43

SHA256
ff8c4ca8f8fb280ee83769fc4dc6d8c0397695ae3325455d6e9b6b40f4f73818

SHA512
6c13844cc2002da16dbdcab1741ad044de47da203508a1737f7cfc3b4daca7bdd71a92133efc7ad06bd330e75edd85634e2a37b4d06dd4d66dc46f881cb45160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2623839b0e09ed27c6a545583a326f0b

SHA1
c04f8955287ea62b8d8bb5e865e102b0784f95cf

SHA256
0f95e0c2f3eab0532576a8013cfaa553f96b6407a8f918830852a8c7f42cf42b

SHA512
d441755319a8e1e9da99d4447175853c7c147db58c57e07d04d9ac54f4d98a9d3a77dcf0fcb1e99607c0164b9f1a9dd984328fae36bb836b83184deeed2ce8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbd0d0e11e8ca9772a7abbc578252da2

SHA1
d2a54e2be391fa8ab270fbec92b5a3404349d4d6

SHA256
e5822d448243d7fe32fe642420599e4881df0ef10f6f6532db0ef0f16d69fe34

SHA512
0efdfbcc257bb715a62e50878d2986e01cfd4d8516c2351b0dc4e8514515490744c9dc343b75ea4355b0892393ca159d1689f6081e217f88fabbb8595327929e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2bcb598bdb323ff65817a227e47ede9

SHA1
596579c2b06851b96b3133ead1293430140f14d2

SHA256
1f73db6248c1df4d5d9fa27e44e360cf7eab9200ba8bca0f7367bf37f4776681

SHA512
5b7d5f76435d4cf173999bec9694ded0e883df657a13c924f20ad671d9cedc604ddb480e902b63ffa32328e836aad7af3edeb343b7c786d0c2d36e311f6a34d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01f00db8407a61ded7de922ad494f400

SHA1
97fadfc6a769e9cd95288bdc7ee65ba2ac6abeb4

SHA256
ce369d77d5cd0dbeb3d2d8fa54df8a166aa7dadf014385021c2c2652554bdefc

SHA512
530e3b1badb2cb56177f79efbbbb6ce011ef42d6afaf507131282e71cb44e4e779fba64deef1a118b1b0b6f429cf3f538170e77700daeb5c52ed007340ac26d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4072724fc31513b8709ad22b3f1b8c5

SHA1
50c4863a581751fcdcff8a401cf10a95665905cb

SHA256
e9ce9907004aeca65dfc9243162ba910c0b653cea07b95a28f765dda06531ef8

SHA512
be3f78415cc9a50a3fb550489e7a8b647ff8373a28514f482fe70f2d17fc147e6adc6637850b9e37638f9a0332d9bef8d62ab108bed10eb5faaaf319ecb2638a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3d9ef33941e3d11110997e67467959

SHA1
08484eb2e883386160e58f12fe7346f21bbed746

SHA256
82690ff1ea6744b2a636702255f3f6e7982f0a62461b2e8beda67167cdaebf10

SHA512
7770500f3d1618329a523f0646062c46377be1442b770fe95e43637fb199895bf4324a68b1e055bc87cb0c895edaa06875e2e00ce423ed1fa697b38f3de878b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defb86fb68bea34146dcf2bdffa1fc85

SHA1
0b3257817557c080eb523036af771ce4849083e3

SHA256
9b0f92600ba56232a9221909eb2d9c632c09a46d0d01bfd25937ac6637482299

SHA512
111f0b42c0601103d97ce74311fae7f0e76926336f76bf994b0223cc1c36dc62cf8e0065ddb3825bdfaa1a6409013d0e2f6169fd092d74fd562bd9ff082d2558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4985afbed089c7e0b6eec68e84c6ac2

SHA1
7cc27720079a57ce1d6d4bb6dc11fa6cb20017df

SHA256
c7a3152292d9272e8867457d817444c7d044e08b769569d49b2e2c1949f03001

SHA512
f05b4b82497566fb153bd905298669debd39dcc2d13091fc520902f976be8fa293ba5e94d492d83a04c06daaac96ab4588a4151a2fa20c791b7c56c4becde28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34ac9acab00cac68994d922b970254f0

SHA1
8b4e73525d86a1010b5d9bb8c253bab24c5acf07

SHA256
89aa9896011b77ee47c953f5ac90521f4b12bbc61284b7079bf0d1a27481bed2

SHA512
5d2990be89060030d15f44b13061ca3f3f1d4020a647a097a52ef79f097edd90b066d3fc014b94706803fa12a8d1023345d017a6ea2292c850735fdc44102a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6151d4324304e1ed288203db9e2be9a

SHA1
d2952868e41f72697a40a7409090298628818bda

SHA256
c5961cab515eb1651dbd70c29c58cc8d64c71cd7e7e42976e866c75c8cd0a737

SHA512
b6a52b3c540477bc9c82a6208db1f8367b06ddeff4c93321c7b54d79215bc61e9d7fe9784e900c8915253bff998869f5bd8ebfcb9501e4e6499ed9950d3c4e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02354e99a8c6bd121f6e339a07322326

SHA1
7398d7b7c0c053bdf0a369e45d3ed4818fff3251

SHA256
c2fb1ef8a7a799b4742762ccf35ac98b49adc0337b3dd17df3454636805344b0

SHA512
a02c883bf48e106f25d5e864e820cc490b01435345ae7bed1c8345886e47ff67d9f5a11b89603d5a392f4e132c046999838f8257111b36b7c4d13dc2f4936295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e5914f07d6f19d31374ec8729822fe2

SHA1
dbe555ed0ef111640d883087a9111853a668fc0c

SHA256
5a6630337cd0d27c18f778e0f7d1e511cab2f39e9661e8110debad694dbfb1f1

SHA512
5bd8d6ddb2d9d9c71b15c2d0f1372b9cfaf7361342a991cf0f757c3fec99518bd14e69b2b6f96d7f6871ca51a2a13de8ba199aa15ed6c9d90f2d7ccc10f36346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f3af0248ed1a11861e95c08dbaf937

SHA1
e96880c1a509dc6f35857e48967fd160c973ad69

SHA256
a3b0d7c02685189c3b66508e431e0d46ffe678fe2dfdf447b13c9a0d0d2e1cd2

SHA512
cfba6742799a929b7b617022a406034519c00fe57afec108c248859df4109fc8c52997a35cc1e71e95d2cf6affb48037ce003e1867a1d24389a0f07d37dfd0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11EB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar131D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit