8914cd85745eb4934128499f24cfe51456ceb9a1c01bbb8bba3662e335eefa6c

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

1883db73b0e7f271aa5f9a2a5ec1403e
SHA1

7b41fe3ecf62f4a5d602aae6b71aea2148f82d19
SHA256

ad99875c2ad20d6b4dd472bb136875624ada2f64575c27d4d58ec5f8e0289ee1
SHA512

382d807f0534c51ae67f4a8c1d8cc46d77de542f6f723aacbb6b8a6e0f9b939c74bd43a42abaa6b65fef249b2ca788e15dd63f30e7a48bf6c0d32f68cc9f96e9
SSDEEP

3072:SxkCw/52J8ZyfkMY+BES09JXAnyrZalI+YQ:SxCl8sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422387630"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90ACA111-16CD-11EF-ACEB-F6A72C301AFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1256	iexplore.exe
1256	iexplore.exe
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1696	1256	iexplore.exe	28
PID 1256 wrote to memory of 1696	1256	iexplore.exe	28
PID 1256 wrote to memory of 1696	1256	iexplore.exe	28
PID 1256 wrote to memory of 1696	1256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7652efa0d4786604af557b47fba78a5f

SHA1
87e91c586a2fffb3780792003a084a09befd9a2e

SHA256
543b39e59d8e89afd81da5bdd4f4930030aeb0842b4edce9007ce69edadc6759

SHA512
ab8f50ff4232056fb3057978b518ea9abda4b8e1b055a5bf023f8c4f886a45e6d72a8f47703ba8713fefdffd097bdfdbc862d6ef02bb5cf2d0275bbbe5a80620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9800deb75d167198b723fbad90f500f4

SHA1
03f448473d91d1a32abb9b872adcc40e4bf0999a

SHA256
ec40d2930b1f483c864c5732288d1d79f40bf898e78160529f6f44a927941457

SHA512
e6adabf38bc05726449669d9ce8661845e50daae359aa7f9f542943e1965b178b415d4757476691a4928005e1d67a03fb991b2a430c7d88c399f1c817bba4791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d89648460417745b749b3ec41554c07

SHA1
4016a857fbe45d6de6b36c62ef7070ef77cb44a9

SHA256
90a8d2198f3a8692faef6bf3c90b7eafed612bb0afc44fed63b0ddb74f8b248b

SHA512
58a84cddb7d250c726df63e222c31b35287ba547bd2e30981a819c78e2ac5b410c1f08c8ed0add7658d4a76d5ac385695aac7af4f6af3faaed7a8f0f24ceaae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5b86868401264ea9caada9289f025b2

SHA1
503b6523db8b08ae3b1a3961428ece14c49989b9

SHA256
42ce3d3d08b57fbcf16496af9e0b33d22609156e545b0357909ddaf832133151

SHA512
3d2d8128548bf1e48d71337a5d4484bbbb7daa6962697e41176a1c88dad32522f853c73edee8a823e9167f56533e0fe4636e5a8aad0cc77bf0af9be7b7b73839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff5010b07b3151f33b0d67c346277f68

SHA1
b95dbd2f196ba9245eac0745f66e9d0049f9dc09

SHA256
6b2260766ff71c9ce293f8e3f883fe5240a638845eef45ff7bedff833643fa9c

SHA512
db1da14bb3119b8e9900ba603c6ffad2082736162866c66f9ef3676ea4ed7400b04ad259f4cfc44c956a52f025b958ec132791238135af345e405459e6a7797f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b259d03416d3a252c7395083c85bba

SHA1
a20c814e86d5c51b8b082c5b3360fc15071691cb

SHA256
f419ed77b871017c28a2491d5593c986b51f567cf5162875d8509c66c28fe1a8

SHA512
c4e9c22ea7b400b32a5e34691eb9e01fc467fe18ae2c196158d09227bbe380d2eb2642cd8b592b12f791c1368f895bde08357d965eccb0f6a1e1c101554ff7e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c25ba278bf4001468e9cdaf73040571

SHA1
dbedba850217759adbba31d8859ba8c5dbe719d0

SHA256
f4de906f11f07472a701e192bb7b6dafd4ecdf0aec1ab76c76c83cdc170daee7

SHA512
cfaba4c68dab4fc28e35cc30bd091c19e218acf08b440155bebb59034a91ac29ab8556c37d1f9a1db2d5891f42f774edbba937ed8a8961c1ce9d77963a71fa00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2c540fa04ef9343b121c2907831d40a

SHA1
40b9c041f86ae971f5adb70c3e66f916c07783a5

SHA256
d816a2541330d6c5c9dc224ac88ce61dfb301956f8999a4c99436499e6bf3926

SHA512
6cf23520b95520a688f7312c4eb562792bbe434c941c3339cb41b6ee7077607f86b40d0fe63567de4d3e73482f04ae61cf7d7482af72698a255c0aa74b69e721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85682f3a93baecae7ba07296edece9f0

SHA1
1015cea860635fd1b5d48150b5e904f6cbedbb1c

SHA256
6e6982c3c308e54dd0989877e7e086c0d67dccc1d545210d8ae01e98071e7010

SHA512
1c57fab4046a71618adc56fb5fcbc0bd84a8cb44040df1862a13144a70b91a8798779907003ade2c3d1947566b39fd3aacbdde158bc5aaa34384828360031b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f0782d65d8587181c7f08db94320ae3

SHA1
883f2b20c981bb53ecd6b37a67e24c4c436da1d2

SHA256
accd182550b50258d764944f4dbd89619dc002a2598d2c3f4e4ff1aa2e34d554

SHA512
9c558cf6679b6367701fb48a9dfeaea3cc84df641de921d13f7bb30d7bc2d4d8ae292a557db395b81c087fb268312cfb1ab09ac5d064d10504cc6936379fee1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8d4a3cd6684176256e59b571ae0498f

SHA1
28a4d531278743d336eb65d2c0b6aa498411f4d6

SHA256
9376cba482c89bc1a0f05ee5953f99af8208e72e1c8ae01c3dc5ba7a20fd3257

SHA512
6144a655f9ebc93b4be6caf71522848775c2d9077fe093a6f973fc78873f9101068b0a041fd2e97eb4eea4e2d0fa3d1315df898525e62b4d692d6623071f6e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dfa00f5b854d864d17e2589ea208674

SHA1
e59d5afdf7d64056b7c9bb9b05d1a82b6183ad38

SHA256
049b0a38d53ef1e6e1d3124a4bcad6e07673a6ce2b3b2c4e4111e010a8170627

SHA512
b33f9c99f8f400b0aff8638af4379a8926d1ec1f17051b8976a9bc6678f32e4d31152cfe646497f168bb2f4a115a55de77f8bd74a61a0088e191659387cdcf3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a36b4af19146411d6dd0fd0a3461be95

SHA1
3dd721a8185879ecb8e1e9f4e02dda56ddf62787

SHA256
ac977ed255f9242d1028ebcb32634af5ae11cb8295113d9a55de266007ff1b28

SHA512
4a9b10cfa29cc6c60a02337088ff7304cb3a3a034625bf91fee1f319cdf8fb8e933ac9a49770e1d13c5b8085fb573d411460d428371e729009791d3eefdff311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ed817c812fa99dd2bc4c74eccddb790

SHA1
6efc0a592e9f9368f2fefef9bc1929c85510e475

SHA256
53fe6c5077bfdc10a264de07d4b457fea0caf7a2adcce6eb60843863777c5e1f

SHA512
7701b63b0954d10e5f68e6a5715642107b1e30d8888d8aa8f365188ce6b330844480442a045de47fa9b78e81f5d18376836bd056604ef5bc357a9796f71cc204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d39ad108da7862f2af5ce497512768d3

SHA1
aa491f18174911d1c146075f6e07ad07c9e55cfa

SHA256
12966bbf9b7d1f472e95515ed7b0524e4aa091c5e57133436e8495f5444fc9d4

SHA512
0885c63a96d65fb712cf31c746dba8eb23962837c384617f25ca4406579c1d4015809c1d3a8c7eb49d78c440420d623473c81ab1b062b799678ba43dc901a252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17dc3394dc546976e17c82dd9ec1bbc9

SHA1
eae3e00a38bcf661496b98d4ad376000b5e3df53

SHA256
adfa11f460dcc27c4d006fce690f795bae448318d820418f1fb54f702f705144

SHA512
871f91b375536181932f67c482b5152fc9d31b2480046fab3d4b89325f4c7a1749a967b7698c861abbc7c2d5683a6555e59fe2c4fb63cadeca8aa5bd7b05b322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dee2a43a7632db774de8a553aaf8a92

SHA1
8967543add51a4fea1bc6e33a7b1babc851fea73

SHA256
9e1d3cdacf34732c11a569de4586da685ed2cb4ebf99f91a222ea041d387bf1f

SHA512
47c045bb53cee54d600c1c438663f85dce50a5455cbbf19ee0258b81c6a7aa7365facb8386970852c4853fb7fb23ec6a93363d4df481d4b69ddd1a8619ee9320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43dd6fd9667e4d8f95b16ee0b39d8beb

SHA1
c9bb97c87794ec48161f5a90767e98eb67bd9dbd

SHA256
9131edfcaf4056a1866cf25d1af62f8028af9320cd15acb19f0a15af6cbfa12d

SHA512
c2679711c5d9c86feb502a0f40ba7d1e64a0bb901a199882fa6409ad20d116de5bc022600fdf41b553d8ed7325ab63aaf8f898d74b19ef9235e1d9d716783398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe7d2ed66fdd2d019323abe3d0c3dda

SHA1
7b2a613f1a2752a35100516dfd01e0b9dda5d231

SHA256
b3f1c64e08f32b0028ad17f13670a0c19e971a69853ff1b4d3467640d0690a89

SHA512
6eae6341f4a0001bc92e54cfa0f13460871eb25fc7a2fd2f635e973997e500e1ea2cb6a1a601960a454a5c5646372f1752bdcd5ba5b637a8af2231645e3c1682

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB76.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC49.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit