4473d14d919d966c35fb8ab4a325c3c9aa037f997e59a56cdcfe6f7fd0ea07ad

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

34218d185dd6ad81d899251502064bb2
SHA1

4e3c6d359107a9a2dc23851e85f403bf7be39c15
SHA256

5c6f21dd95f5a3886af7c20bfbb27a23623eb64f776794d0f63be9e048fd6c0d
SHA512

bb740f82ec61d24d0c41d529ef5e93ea1fe6339a8faf21a4cb2457fc742b1000ea99fe0c40b689403e9bb868378030838df19c1e62fad407cd63f8bb7dd40b5e
SSDEEP

3072:S9t7Qdd9ilp1/w8yfkMY+BES09JXAnyrZalI+YQ:S9NWkH+sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422334662"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D59B7D1-1652-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2344	3024	iexplore.exe	28
PID 3024 wrote to memory of 2344	3024	iexplore.exe	28
PID 3024 wrote to memory of 2344	3024	iexplore.exe	28
PID 3024 wrote to memory of 2344	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f34efc9ed52d2690feb604742a83dc0

SHA1
45512bd7ce396415debc54316fb879caac804f9e

SHA256
f0bf352c8c6943710790b7818acb55abc54858e2c69f5f87ee8229f11d55aba3

SHA512
40e0cc858037790a351d52993feb3db2c841cf2f61afff3515430fce085954c682300cc52083d019519eb578787db02f116e6884a20fefff1e2e4bea40cbf37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d77baca99a367cde47ff870b50ad0107

SHA1
5bbbc8e3c1ff77955b09943a49007052ca5fa4cd

SHA256
1108e91bcccb99bb48154b8b1e021f905196a346938f5da03dbf70bbb2efc1a7

SHA512
01d2423960e7352c5460083d8cb076e2833da8830c4b6ff52bb4bc0b228e9623c3774628cb7a0d2633a76c92edf15da5bed86cffa620db11aa8497c0183600b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
299d93901cf42b42cc65bdfe7ba1ee43

SHA1
11095af161cfae9601f5498b72d8926f039c9256

SHA256
9fcdd2c9c27d24e3890e959a8cd17a1fdb9d0d3cc41583d7781ddac4c02d2402

SHA512
7c172b1da8a4cfa7207e837dfc699d0a32f5e1d6cfcc392066f1d247a8cd1b3064796f1bda95f37e3e7d4419a182c14c65412054a43338164f0630e45851311b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035383c6f90589d72c4639bd01dd0e6c

SHA1
7ca684b28d0fa07259405995c82458949d35feb8

SHA256
cecd246d6f08180d3502c029df35cc4349e0596a8f0677ea57d7f75f49e934af

SHA512
47606e03e42c18ebc974aee0c01e12d005efc6a9a38a294a4e27fed2f49f4e4ce6558b75f79ae26ecf05c3dcd222eca59d344ef094b5edb49588b780fd0eb3f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdb2df954e027c59742d0ea3cae3d61b

SHA1
80ab828dc633ff4773e7ddb0c8118698c11f7e2a

SHA256
1f1dc39c3c3e23d6c46cda859f21c06606f4995a7321f442b3c8db0def7a46ee

SHA512
c06ab99ac8204070440b649225f72dad880097e3901cd78850c8469febb419816428b98c749a60a9c8f62ac8e99b8f6d9c2f1f6274eb637c6f2596fa648084e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e6ac570d152e9d407f7c16ae5497b0

SHA1
0ee8712e9a8d2abb782cf6274d63fa5e2eb1f039

SHA256
5df53ea9367ed906cf359bf9e48681a7a936f44765b70a1c43b1e645fb827737

SHA512
fe27d8cd881a9b26da1c1b691914f5981e7f43bf3c9b9f1823e30f75e2d7785be2aa790a0ecd08ed21f43beae3957ca872684fde2a09097e88ad57ffe2c1f3fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4abed060ebc296f4d62c8d5c55a5da3a

SHA1
8ee75bf20a2153c511a0d76fc0c7272b61e6eb48

SHA256
1d0a47806fd764a5a99274e11ce42895717067a85e7e0c775c13a6350dcf0d19

SHA512
d71839bbb94e54a02f8504edecdfd7ba1d1e5ad26889eac3b3b2b9744a368dc3efb467fa2045c4810a84eaa6fce5c554abe05b28c2b76193edf0cb70a2f8b21c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ee51a4117d708547bf848a56b217238

SHA1
55080581a16b7abf98563ddc49d02c56ec339ff3

SHA256
3655e2c502f7d789cba677940ea05e15fce48f9ed5d990c96c88a4cf1737b75e

SHA512
cdc9ed74af0292b1a9d0ad735fa8c9f139f7a092947081ae907dbd499869ad827720c1ddd11a4f283dce1d59803b160a1cbca56ec05455c15b395288c6c7dc8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4286ac95be20250ecadccedd548c0dc

SHA1
6dfdc97b4055b11003b86dfc577a3e0d67d9723c

SHA256
3882f345095c32f74a8c7d3b9346702b7884698cb5a40b7f54c06bf4a506cf81

SHA512
11a792b37522e2a7c6dbfd53b18190aa308ba3e2081bbff22eb229c730ae3584bf58a24374d34f67ddc0e91f628a2ff3c8e07ed7f51837b76fdfb01b4094ab5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25a534e648308397525c658aa9d2f36

SHA1
9de9cfb667ec5ffd8cb82298cb717918e557a733

SHA256
826eb8364587ca0f60ac3085d4290a7ca4577b6e6da8a28cb5ce5e61cfc2083d

SHA512
06ea914aec80ed56fe267270491b6752b5596c860cb69864f033596443fddb67fd591f7f6163b600398a1b9e5ea5222f264b22d41603d4bf632f3197eafab428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef1870f905ca16a358be7e7a9eff80c7

SHA1
4c9b2f082c2ebebf9753142e4302b450a5dd4196

SHA256
5fa8249e7fb1c78a156e25a8f2b07e121ef8cd3de6a75714d06d4031cc967b57

SHA512
ae03f6a2f7d20eefa480a5cbe882574fc3b4742ca49eb7f76812e516f2902478b7f58b2d872bb1f40d937b2a0a846afd09abf2926211077bcac554a43cc17fca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bebd595dc8aaaa0ddd69c6aebfe3ba50

SHA1
9a1f6ffd8252ee50077323ba5f4b64d0eae81dc7

SHA256
bc9dac5c945a7129857b0f913c1d23122fb5a0c358834d51d3537853c1609462

SHA512
28cc3155b5a28807b1b0fa9b0e903e524d6bf5f01a4c6e1ceb3b9a7f0b849d8591dcb63ae1524ed684b5b87b3456c1e5df6d60023b2b1d6d0b4cb95318a02bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f5ce5e879500c3d9e29eaf489ca286

SHA1
b6c694a7a3d7f7ee96af2efda9fefc3afbe6457f

SHA256
67de814db7e5e8021efc0f5d2ab6464a4e0540ef311a0e4e11d0501b34c5ca5a

SHA512
c781ee457a47e058d07a24210f7904255c02caac57072a622a9d31e3d217387d0517eb703c26d076015a7f5ef56e377ec5a466b9b71b3ff4a673d931c1c6c7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7356f497c0bbb6e033f97faab1daf981

SHA1
bf877ad8daa40b970bad2ccf1d446655a7388cbd

SHA256
3b8f9ea62f05e2db7e85d335f75c7648e508c6fa13de3b32e1ebbcec68d30bd0

SHA512
3e5916947289697dcc435a9aec87cc1bb1bb0049142bbf9c850626482e5b9baedd63636bce78cbd7f9b6168079322e44d5852f23b8fe1153b8c2897bd94333e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1dcd5d5e56e1865d3cef59d818c2d19

SHA1
fe9dacd084ed1c0589dc767cd995ab7f287910b5

SHA256
01dc37dd8ae4e9736047097768577b0b0f27d832f8d5e3b06504bb046dcaf6f5

SHA512
39a1c1c1a8823d0a4ea56d923dc0d99722d4b72f711c160ba38b7bf4bbba7c0d916b43624e206c5566036dcc42a572223caf4429575e19dac4ccf8a7abafc8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
588a1282b489261364f99b8a9d6a1a0c

SHA1
c09cb1e0484f4be86bae36ad3312fc10aef071f9

SHA256
b10752694e6e5d4706c8de2d5a0029548766fab4418e8eeea5778aeabc685496

SHA512
13e78c2b343172f3571fb81775e56c6e8afdbcb42517fa1b1df2125db988337027de97fe5139c01d9e5ed5b71ff56348f547939d88c07721aa0c2a146eaa5878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c3185d97a36d332be390c344e2f60a6

SHA1
a351e6a20c690fa46bd757a3f10e4a4aaec3bb0e

SHA256
5104f2911e744660c595b4e428aa242b4b203962fe89c70aae054c9617a1fbc9

SHA512
c70035ec21a2fe6642a946e4be18f4c31b27658844bda2e90c5fcc5707963921108b3b6b20e18c08467547035976bc60bb8d86019e67cdf9dcb1e06af2492d29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03381d22ae835c897a0f6b32e763fa5d

SHA1
0281d47598aaf47e01e72497b488f70509ef1fcf

SHA256
1ad73fda481390c0ea67d960a87b82657034de271cf7c1715ebbc883d46fb23a

SHA512
f78559d2a10c56eda27eb8d2b38d62535dca8e99bb385cea717ec4dad9f9d089469c99fe2444377fb6516fafa4bb8a46df088aca5aa8e784702320b4ffa5db71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c30508630a190d5f1021ea9dfe90c5f7

SHA1
ebf58cd88a607e9eccb3b933f0c3396be33af827

SHA256
c9d818a14641330a473b2d6bf56385e0242fd1ff09739e48be6aa1171cbfbafb

SHA512
d8582a7b2adf0760c6e65ddefc5b3ab0d0ef6781357e5b85f6acbec7021f118649f7e4e9750a8f6acf7653c6d6caab34338c23e5b9554145c44b792701ce8e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar104F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit