36c47ccde1711aa1cdd8c44817c56163196d6079fe17767c04f1bfa4b7ad37bd

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

221KB
MD5

dd4067e57980e34d5d345fe4ea479555
SHA1

62c7714cbca8d22068c362454625db552419f156
SHA256

f3b55af36e8264283ea2697781341f78a786c2d9f93e37962a96f93b49cfcab4
SHA512

23219e2bfb45f896c3aa1eabe09ae88803e1a1a88defc5b2ed3992b94a6c427ff861a69305dc542afef86f9cadddd8c6441e5d44382da828ce31631ae5b9cf75
SSDEEP

3072:SB/gljgK/NR+xtlyfkMY+BES09JXAnyrZalI+YQ:SBRd+sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422438760"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C8FBF41-1744-11EF-9371-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5628e5d231e293684540828cfff2fe2c

SHA1
bdab7a96937aefe2ff85cafdf5007ebce1d19336

SHA256
d363f5bf7514d08e64bb070485b11e35397aff72a111361bdd9d0d5076bde440

SHA512
fa902e4498342e965e84eb2bca2285e9b15ac5b43255c1b8a71b07801f371e6871922e905d1051dbd45ecf92babfe38d4b834d6ddb36c52969d041046558814c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4e58d30a2072524071127d6b3c112191

SHA1
0edd39e7a4678a43667ed63d6b6614b955577816

SHA256
a7da0b76c6f672786f1ec2f185c9c1f4742acbe76f167f5e3612110b328a39d4

SHA512
06a07fbd487f05259f397f04f57641dec6e78386e05014555d607748672d8d4e1e75fbf20a16bec8b541bf8fb9379541b46766a6c4200116a9df3b88accb523d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
14b9c2fd0421d0bdcdf0f24250074365

SHA1
0f5695c1534535b9ba8f8d523dcd75f52eeeec07

SHA256
17fb237687b98906fa68f8cdeb1f136a237f1fdb91a132748bf3d4937ba12e30

SHA512
274a07ff9e2e7059404682603cd479c8e8d5978dcbd81ae10b0156dd217406b9b27bd604355aaa2d49438935fd98354934b68f608f73787339a0efec25335a64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e98edb416e19057ea5ede5e8fa41be87

SHA1
79f940118d2f26af64760f6b3a9367c8e7099edf

SHA256
9ddb0f1bc6271db9dc0b9bb8339d3885cd9995ca2a9bd174e87626211b711028

SHA512
5ea51b8105f8a7b948adebaa68d359b4419bf88eea368bd59a09c5d421fe1518d2fa05cbb034dd2a1d7fc55205733055b8acb6eace15a691db64a0b3daebe260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7ce9e2297bcd55f206c836d134c15360

SHA1
bf42fca248ddaa5c886fb20bee4515e4696549f4

SHA256
42e06855dde755babad34d8ac350965cab7c08740acae74b855fc606e72a31bb

SHA512
e28872ab5edb0cedb7dbb32dcd914f956226cb4b2906529a13bdab9dcf0d7339c22f45aabc80b360fe9f46fcc20d29cbd3c66f2b8b19051252a1b31d1184055b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c9720d77b4e2effc2c3af76e9785e87a

SHA1
897a8a296e3f0733506d914cbc2d3b630aedfe91

SHA256
48757e49df02c806fb74aa11bcaaf1311d512f70ce88e865c44713caa8b0074f

SHA512
02a66e4417c5bcf5311439e949f81f861c11a45a7e59553da5a2858c959e835c5cf4b1f4563a11206f7e1ad1de9f90a8f499fdf70f6fdc40707ab2204aaa3b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b7d95c33ba61558a321aa4435501080e

SHA1
6d7e08fc9c001d5145607beceaecedd11ee4f709

SHA256
37ccb9f8087f003409541f16e5921d1010368720f443ac0533ac05865c037bc7

SHA512
ed7f5e3444f5f8a4c106872eab353e738bef4f7dd464135947a96336a6e46a389d312dc6e46bacffd95cdfe9bb4fde7c375a2093114443b9a0260f94a876fc12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
073c016a7368d0d98c710b9f118890b4

SHA1
69de84f08fd85ba5849744da181af60b2db73150

SHA256
30f48ed466550c80118fc0c2a292e2a02fe617e6c3a33b52eed0bc5cd8eb8d74

SHA512
74047a367c419159251226bb97edcb2236cced857c1f2318b25be15c6a5ecfe8b3ef5955561393d15b94335bf1296cae5294627c20886fc26b1b226bcb3908c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fd1d07f385244326f4602284ec2942bc

SHA1
c3f1eafdb17a1f869a3936a64a3cd23fa7086481

SHA256
225a421ab8981d07a4913d58ce3b938dc9db46bebbf67f3d9ed5840bb1627141

SHA512
89dd5a58e9bd95fe5f4cc0d4de396e64203fb96458fbe7633506604a7e8ab700a8644cfa2b3f94958e02c5cb00eddf487e698a0b3a8f89aa0155f76ebd304058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c004a2f9b137fa03fe3fb6f1aa1ed590

SHA1
07804ebafedba13c1d73f2798830fa2a7a59853e

SHA256
a6a352be265ca182d344db7bed66e869447eb81b72f374e6318851ce43dd193e

SHA512
6b089a71e9303740821ce94336243ebbf51a42ad4dedade355f0ecd0e95e20b8288d3d0487134729e466a746e83bc4b735ca08bd3249df667fe3c98b2fbd9a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
818e57ffe84b0ce654aaec3300384a97

SHA1
a7979507af49977aae7d9f3488c404af188de0ff

SHA256
bc129ebe75fa557e6d3995e15e5155e61d435c87030507914ff99fb943313ce6

SHA512
4a822161e01eda0e2ed97758eeff347fb48e8b5fe6e515720f1fcabbaa31b06a7d5617b7a01ebd03b74ded79ff5cd254317362c236c1d3f417a5e264df4d51be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9c37d79a5915b3185beda5100857bbae

SHA1
df8900d2b3342e87585638193a2f5cbf6a83c323

SHA256
d27fdf1676b1ec92657e94acce49af53b33033e5b5b82f209a1aeb076a534b19

SHA512
760c27e9db2aeed93ef66005cafe470ba006932c42f0612a994ca57e19ff646ced70a91a60610eb3b8a6118d8947e2ce0b1b9d7b4902f296fad609d990877456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
896c6fdfa490b78b495adbd946e96af0

SHA1
aa5c8c79998e431de95c4b7c32027e59c294c512

SHA256
87605b2d2422149a6a34da2afaeeb6821bb58e4f6c50e1392587456336a9ae6e

SHA512
e470a425a7a25c57f080148838ef7d6ec56eacb7c8ab184aff7598de7d74f664c8eee6b3ac9ad9addfa92553484a63d7c6e95e2a97461fff82c91fcda52bca0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
564c712b07e739dce3a6f2948476cf5f

SHA1
ea31b59ff947ed2217fbe65e825aea1cf5242d0d

SHA256
fd04ed9c064d5f9631a17769971fb9e8a514dbbaa8f06e8c9f8edbdee4baf53c

SHA512
8450a0b283839f8e43530f9eacb952e1a02c1ed5132db8790207c8d988b3478686df5c923d1bd02a8e1273d94b617caf3cb36d4069cca41fac8b1cab80694d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8e97b45ae0fbce521607d3803f57e076

SHA1
72af96956933b8d1422d6592855794a3aa69d2a6

SHA256
357ee28db458197b0be7ba1f7c120fd3e5eaad7b2a15995c97ed8461dd8605a1

SHA512
2026acc17ca26cf705dcdf8677994016ecfa2450b974e67763128c0e1fe28722007049fd3b2731caad77bdff09182a9b08e89ec2a132c09595cbd9a702cbcad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
549b40964726485f1b64152606ac5564

SHA1
44fc54c9c77e6dd81d8f920fa2b332cf7eeed02c

SHA256
e3d08e80c6523bada5cf131ee57bdb8e8d861fe768ec6e13622488b8b26be737

SHA512
9ef8da76231bc7365f425cc9c36c472541347253fbd15ef08d30a3574fddabc7e830db709fecf13d503e7bc9c8f758cdb0efcc7f8799c75abb27d127c9c179c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d1a3316cafa0d55e7abba75ed3dd7eb5

SHA1
d95ad4771d6d08007baa96379741e2a86fbf3886

SHA256
f4d320f7600fe1a9d4609e7702fd30410e42cd4f9084b6596bf2f8ca42b92333

SHA512
1f558b00b7ca8faf9a1d44ae56f8c4092a3ffe0fa61177fcf2c1db4099db66f9f59487388975d277007d48ed9843009fc091a83501177a266246df93e35cad3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4771250a54698f29c3d5998c24d76d9e

SHA1
bce97d48c8ed068ebff5a15ea7ff93836684e76b

SHA256
f9097044eda8522955756451414e31b46c3232bc2f998ebb2157e9582b0a8447

SHA512
d59cae14ac75b92e709c93922d73460fc3dff6a64df64c2c45d5956ba49d1f8ce44846f6378b849abc186a053ca25e2738df84aadd7f3441060e7886f3d2a35a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1390.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14A3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit