5617c2386d509e32e0a9ddb39e0a485934b35b8bcb0d7cde34f79c93cf519ebf

Analysis

max time kernel
144s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

68af726c86ae27aef7713e1f3777fa12
SHA1

00a594613da25aebc0413064e9d9893031b2cbf7
SHA256

ddb1c3c1c609ea65df84ed760d2836a172f8a30c7706eb53d3d61e5e35ecb119
SHA512

88f0031533de9cca9c494d398223a073ff8df0b77118d9b79824e9564d12105bcdecebc92f632504831db243fce606b8b11e5ec0ca8c85b99e51b81d5136c7bb
SSDEEP

3072:SMmKWH8VcVyfkMY+BES09JXAnyrZalI+YQ:SMmVH86AsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002eaf7d544386d6be14a52449d03281c5374cd9cded7e0c8b67fe67fd79ff03be000000000e800000000200002000000005903c6ae299c3a58f4b02705ee84f0e52a4fc3f118402f3573bf393e3578d83900000006d40123481dcaa91471ea79104126578d4cd096e29047b7320d7668a1b2d4f7c72373f8e28a908c0f941f2b1f93a9cd998c83b22d63f78c5d523a6a7b14d8c4f4b3ec3c6839a000f14a39f1fc3beee6bd62cdfa3b6948444f415c209c2fc9140c09c3b3e0b523ee4a535473c4987ccc29f813d0578ed3b075081653d489207e5ff2b8ce4057599e5f195e790f7df0115400000008deb2bdc5b01d7e377625ef1fb5902d7d43c8dd3998280c05805d75dda7fec8603471feeb3ac65e4c6de97653b0706cdbce668e77ee7b01158ce26c27f9385ef	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bbb37078a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{588E5DA1-146B-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000007ee57d0b78181941edf52c3d44cf07eb1e52db5692da343a7c7225ce0e8b2f2b000000000e800000000200002000000023befa94ca767a488bd214e50e5b1004ea6a483fc70f8ef380e176dc5555349a200000006ba8d3823653cc690a3428a31e1657ea48e575b1e5afc6a40f78c9d6a233c1f1400000002f310a5b56bcdb60528c7b2c5cabddba30f328110d5c5994288974fb33f5c1147bfda3a80ebe9e55dd718175925cc95a77dd7ae985e79fdf4a938ee1f64e3cac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422125548"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2228	1720	iexplore.exe	28
PID 1720 wrote to memory of 2228	1720	iexplore.exe	28
PID 1720 wrote to memory of 2228	1720	iexplore.exe	28
PID 1720 wrote to memory of 2228	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9cad9f42cc27772a3fa553f497b8346

SHA1
e5382b4a81cd2f694267e4b2421fab93a32b26dc

SHA256
13c77023e30aff5fe882cc025c5987c7cdb298c542ff5e0addfb75f35d1c8607

SHA512
073919ce50847388e742d6feeb9f9a08dbcb23d3b5c315dc8d51c0257adb9214cd7d954c8f03de6ab85f53fa7e64944e6c627a2b7da496341ea16c67ee81528e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a120ac8ddc839915b10b4b6158e36b7d

SHA1
b06f840a3ab3cfe48db554c2c05f23841af8a4a3

SHA256
5e01b41a5054bd39c564bab319db6141518d737b731b81eaa0dbfd573d100b40

SHA512
188d4bd435d7d43d533cc5620d58118ffb456b3be675e12da0d50f63eb87df4e5439eb2db17330a3bf860c45909d686e73170d1bf031942574eeb98e9c87f5fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f836a33eb970e76184ce5428038da492

SHA1
22f3cf190a4d01c6bef226951e30b54fb5154f35

SHA256
65766c676c2e59ccca0e8e0de781b499061f985fd67af94ef3781afbfec9fe12

SHA512
340e543f656c285417759a165d28706bfb93d30f30ee97c721d0376322ebdad501139dfbb3edca7d9c6aae3e6323a462b63d4b6fc3fdc7300f5b5f9e61148dc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bbdeb11b113ef5ba378b03922f2cdfe

SHA1
1b0fbdd2a86063bf7e97aa8fabf8ee664801ceaa

SHA256
7dd2ec539e10076e4333f0953002c0f431380079538414d6f8db5c4db517a38a

SHA512
b7b71680841cdc7b05bde2569656e68d71eedc94dd8791f7aebd9b886c4e4cc3e94c3d0a1aed3ee0b2b4fc7a52134bda53106c42705bb518ecdbeb8c1d8d76be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d78ad34b1dd3e076f5223d61e429a80f

SHA1
de31ef5f156e3f27b5c3faefc8c3e327b06d222a

SHA256
f8d9986fb7d1d2c459a0bedf4de7b6e78b51469f15c2faf95f04901f46584769

SHA512
729e044fd9b0bac7f0c209309aae01e3af2ee35e798d94df3c97490b730c5876b6e549e85368d06cd55a43a577bce86389deefd63b0660820ee85844cf0c4dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fea63bce73a21527fced3415b3b87af

SHA1
fcc042505c0c47d2165232ef0e4327fe7e494021

SHA256
5fabe8868b03ebfdfca077d1a9925553fb25ca21a7a892b17e31ae4b6fe758f6

SHA512
64e7411947453a0ea53efb905eee9bba0fe865b366c514110fa4803b8fc5b3e41d70b7759b044cb9142ceee9b4b7b6f4a1d35d4ab328a05f89c1ad9dbc281f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13dad876e08978111cfb1d8c4557eb63

SHA1
da336adcb750789904a68a8cd8aa926c80438d40

SHA256
3965b82c626b8592c079dc01aac53d0e02231487a252881af68069021f2172ae

SHA512
c9ccd93068ad641c5a2bb4f5ef79b0124737279e152d25a201e1b4934e66bd85e847e29966b5e2eb0294e5e8c367ae40cc9c9fb2bc8c0e2b2851fdeaeb168bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c60e690a608a806b590189a97f06c8d

SHA1
99f7b1f9ab0c55ef391ad48d85c1274af5467948

SHA256
0f33f35d2443ef99e1a63d48ff5600b89d0f361e2626dbc2f8bbbe49331bab11

SHA512
c2df6726e6e5b7fec78026837d9b10072ec7b94f4d86235d0ec4829c7ff3547d4b05ae7bc09fbca68c4b3297532da49278d226895bb578fcd0823027df085a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06088ce1ddf4760e0f5f0d7d35a2b06e

SHA1
6c90b91ed55ced091c67cced0537a4960c2a20a4

SHA256
0daaadbbe0bd6c1a2e28e842788bd0666932e72d0337da60eae2f434b2f6394d

SHA512
e2fb248fa7fad1e402bbf92230da3ec5c7d91db4b0026f1adca3544249f8998dd429a7a2e3eb4839300c2200aa45f18ff0467449826ded366c51b9e11527eab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
179bfbfa906dcd634aa9b3cbf67cc933

SHA1
0e1fb0601ff9f781080957fd602c01806c41087b

SHA256
60426688b8ac5f1102954a0afe4a2a07bb966a39256f43bde4b53ae3656e54db

SHA512
35e472ce7d7ab38868524d490ea26d64a7e9990e0993855b38e20e841d1117ca470198a7bf5a351b320a34bd6c4b637e3f0769e6fc3ba51803a5cc93654d8b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e34b8c1f246ae6275a11e4a2dcee5e

SHA1
7d3d17f1218c403832b0335251fcd346a4b62d6f

SHA256
2e484c50b4a4ced5e4044239684290a16a2f11ceb467de2ae51844d81cdd9bba

SHA512
1a8121c9dd117dc9910ac7af60e61d3ddd5a6daaf25f947e449436d2666f290eb35a23060a839b6729758a09bf5ee99ccb5df631362feaab3df2afdc16fe665d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287d24b3c1761fbfd40ca0e1e7e04c55

SHA1
24a19b0bd2088cad1185944d0e4fa6e4e42c302e

SHA256
c0f4239bce2fdb9b3694a5f0775d50c27b25127b88fd2940017fefd26e829958

SHA512
91c765ecbfae2fa25ea54682d152bcc6acb3c6c1ecb7b2c0fcabd140ce1e758b323334198d2c4ec854be6d9d8327b9f76bb9c841474a30c4aa7333fd411510f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d8dcbffd441a94987e60fa5286e3e9b

SHA1
60f28d7e439a8ba7266dfddb76428c92d7bf4112

SHA256
de567d4f454bc24ed11bd71b6e46e71007ebf4f29479cda8dae26dc36ec66622

SHA512
72d678a0e130f5358f8e69b165ad8b349985b4cbb2825e22589d82b28f30c19cdaab1c36821e91c57bec308f273a54816e21a71f6840df46074b9ff0f9a0b7c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9158.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9325.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit