0d9488be82167113658868fb9727f31cd01da196db91d30dea43043d55817810

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

ca37a16aed38c814ebffaea60d76aa41
SHA1

eb4e0bb4b104f44124d2e50f2e29e97c98c9de28
SHA256

addf2608d034ea4f4b914482e8e28bd7c55c1fd7dbde1ab4b945620e57c5c079
SHA512

b74e4993552149e0ae08175575f14e375a407f1c07618be5a055c0b115f6a2499e93e27f4b6d3e136f7664c915e70c0e34dcc88622ed923daf527c565c0d93d3
SSDEEP

3072:SLa3KuY323/gUX/0yfkMY+BES09JXAnyrZalI+YQ:S/M7/5sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF54BF81-147D-11EF-A5E3-DA219DA76A91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422133473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3060	1632	iexplore.exe	28
PID 1632 wrote to memory of 3060	1632	iexplore.exe	28
PID 1632 wrote to memory of 3060	1632	iexplore.exe	28
PID 1632 wrote to memory of 3060	1632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62fd33d16cf144440f129939daf2a64c

SHA1
946eb04430da16f1794ab47f7bbe54526f0967e4

SHA256
d33c6d42401e11fc6d12632ccc24a629e9dc58251490c1ba8cbb632cc03c4550

SHA512
7862d1d3615470861abe23e6d472c69e040c116bad8576897895d876fdc2d6cefb68c54d1cb991967309785839663d60a75fe690c8b6514e8df3d3d2c5ad9d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8f3d1a3aff9ff9842a4c90040b8eab

SHA1
4817c3d1d844de8e6100a944185587f8c2fd2337

SHA256
00ebec5abc56523e89425dc4a8de363dbd5da0b2fe230c4f1d4bfc1425538fa7

SHA512
dc962c6aa864e64fe154526de0d37c4e09af620b31e14846e5976d1cb8e6eaf58c8f9793522470103bbbc6d5591dbc80ea2f0d20eab0f1d9fea93930b54a0d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98bb659ce7a0923c52c89aa86b1a3e91

SHA1
5b3a6e5dfd5bf5901e7f45ceca78807c564f73dd

SHA256
70631d21b2a79ad956c716a182c556f28c679d952ab5635970c4b2450ab61f76

SHA512
2e95c6be0b83ef69b953b38f74cada01c0a05bbacb03d8dec5429f3eb0de1b755cb7b9f7f8295fde79bda751989b0da43782f5fbb3541cf7f700746e166fbb85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cb33d9d9385f663c1a08a335c7a2474

SHA1
0bd58d51498f9f81a25b096f17cb11e475ea8089

SHA256
c18efb7262028e53b58085bb6adca45e5bd1476c1279630c78f11acf05843ef9

SHA512
41a1c601951395fb7edc579981ba86e5bfe69777f10846e24a890e6975faba024622723f4b95196403a4c6b6994e5c9b1060b00f3fec7caf0ddfa390e2b681d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36e706dcefc4ddc0309f3f825d2bb06c

SHA1
50408e78817facd7a448bbddc4a982c4c223c173

SHA256
17640711d1880fcff70213561ae6b8de872ee766ed7d6962bf33ebdb8cead987

SHA512
fd32fbe788e35da8e0822ff246943020e7775f8b8240cef4ae3dfb9e7c62938352be80ede48200df4a02d263bc3325de1d9cd692261e3016957450fb2dc19568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83a3dc84b64a8b27db5b9044c60c477d

SHA1
3413400168d5c25a32e006eb1dcce58b3d844f67

SHA256
19a9487f1b6ad657403151627a441c32a38cc5b8045c3fa9311d5444101cff33

SHA512
55d4428d803a0a99761bd65f0835888e9d7ee829758ac75df71bde71ff98df8264f37e051283324b0f862068524f4fe9c669b030321fea36036863dc6cf9bde8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fd4ff52e2fbea9ff7c64883962a9033

SHA1
0e2d75ddb78803123ba06e1e71ac4cbbbb199884

SHA256
f540cae4df8d0cbdc3a1d6e6557cea0731f719ffd3421f0df8b0bfebf5a7a800

SHA512
88cf7c766a5f128f29fb6f5c08ab0642249ceb853fc02f46c76cdeba7327c6a990747850f4a520fe1e222f01e29b6c33a7a36e2a4a456a09cff40ff4e310ed7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bf83f382f06ccf274541625fbb98859

SHA1
ac3b2a2963a7924726ef1b5cf75ce057f1d852c7

SHA256
5d5a5a37315ab20e9c7557b9a3e7a3c811b9401ccf106c6091e0da2091168e28

SHA512
220de834cea5414edf611a67e058f90fd9efed70408fc599028fd9967c3e81369bbc1e71965213291b36aba51f43cf3506add2a3e455c340bb7df305587a0db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6920af5903616e211295a1fd796b7bc

SHA1
fa6916d7e910dc8b56f42b51fcd69a67ae0454f5

SHA256
27431e8179efd747531e9e811cf766cacd14f5b047e11e3f49acefe0208cf182

SHA512
aef714874f564b9068eb1ae97807d295350e8543f9f841049d8cef728406a376a7f840103858f6f62b035900feab4e841d08d331e084f4091555f8c752851c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df301866e67fcb986c448fe3786fd043

SHA1
7a2e70f0e769595c23761bb476a2ce445c2fcdc7

SHA256
2286ec5023384b63ca80af9f1466adc4a713bcf511ef98a7217ada86c9bb89b5

SHA512
dce34847d96ac5e25be821a5c35f2d757ee768609a813febcd73608981f93fb3a8121ae36d30225784fca3a2584a2f87d1f985501a8bf2ccf944773142d88263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8e8f13fa2b698dbc017b3298898e746

SHA1
eea197bc37536ccca885fd21ea4e391ca9c6caad

SHA256
d128cc6a14e9886ede884bea6faf964473e8d87e02a82e670ce20f6fc9d27bca

SHA512
23d869c1e136c8b7e1a3543090e243cf173ef14f9422060fc5685fbe7292d46f74023e5b16baf9be56b25899abc9ceaf5e1743fe1737202ebc022236017e6e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde436c230d09bcc076e798c12032288

SHA1
9bd2be8268a23642ebb99ec2b77d4abed3a21f78

SHA256
81c8fb000477e1b66fb3d5ef2bb1d69ea32e86fff46d403e19e05999b0effd6d

SHA512
e74d717831bda21fead231d9f65c352385aa3aea2fa2e4f0ec08efb9c84fd0df74df08fb46d71999bb1b922170b0e3d1cb9f268b84feddd33aefba7c8ebcf914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8538f6dd1ca1f7eef91bae951158fc71

SHA1
e8d8bc3e7ec20ea92ec1b5cb9af965bdc0c32c70

SHA256
2b438a91d6e7ad646d79af33dc7d0c92000439b99e0079f1fa8204a946e6dc41

SHA512
b416f0aee4e5a35815797ef1f6c0845508548f5379137de9e93106ec05ab79c2a25c98d5051edb5ab14ccadd0a60bfb25564bd341d9a1e5bbdd44e0024fc0679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd54ce91f0379dc32dbea498f5ce41e7

SHA1
fd912ff12b94e5c71bb74f7bd66d75b22fc7872a

SHA256
1d2a207ed4eceb433d99529918d024292356fba4220d23b4526aa166fd49b4ab

SHA512
f6c95a94f473b6be521d743499204db82c879610bb30b7910044aa306dbf68565d9c1af2c4046ce76a699bbb8a38652d50d2868f179f3164a530374bcb4ec74d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3268ae46684d747ae3fde6d6831b71c

SHA1
b504816d89ac2a523e04336ddcedccf067530b4b

SHA256
339d4784e4146b0e1e80efaa60d42f948949fc0ff6a79ff35beb7edcf4a95aca

SHA512
15c3682e1300f778fe707d87ebe8bfa9c4df22072aa88b893cc2b1f1d0dada5afb024f826196c661508ec8b75f77f74bdbc946ed1a94cf31fcbf9532994ae8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8030eb936386b4b5e4d8d2b17a369ea

SHA1
dec4f75e3d6694a49e1c2af6ad353647c275ebde

SHA256
5071ad212fc967bf2f93696c541f4e8b98959582df84367c5b49a70a51c45acd

SHA512
3793773e2c5cd6ab538c58e8435e57b19bc3ab37365c408e98e95fe3a769bfa34ffc68b968c6929d61db070011956bd2e0ba3aee9fbd1b1df23cc13ae9a30ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e96d8d019ae324650f4c59c728c6b0ba

SHA1
4efbe69a993ffe282d09d6ace18def7c56b04e17

SHA256
0aa96a718352939c9ab9f254d6a8d6f197bfbce1d7b86e576a6e654ea5dc31d4

SHA512
56ff0bb6dc62147865c860032a895c85e211feeb201d77f6036093a9ebf6518b915c6f1a8a4b56904ae03053a35a3bd5eb0da099d4683a6b0fae73b1b58532f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a8f872da06be70a6f0d81a34eeab12f

SHA1
623163dbf30d349c55947317cb5dfe32d53a214a

SHA256
99cd67806a692fbe755baf9a93ed4b69fc0223072a7be08b7278c06baacc95a3

SHA512
7a4196fd2aa4c4033743c356a3bdbbc019e8d07969b43c9ae1f4ad214789c784a4c6d8370df9210a51fe977d4c6ed732f93950a97dd331c71fed27610be465e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1094.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1106.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit