09ad6b1ad91240668be9e68751b7083fc2dbe58ce4295c74dfc7d728184b9f7d

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

d83ec34417206ee3e21009919ba4149c
SHA1

43bd17e32c6a2f6398fa1543ba3dbd85fb6255b3
SHA256

b3b47539d612d513e7fff6439c147436df12bfc03cdbbebd4bcc2b2704853703
SHA512

52d9361df0bcb8810fd0a11fe98da0896dcec4874f0626db78aa5e43f13dc776830940b1ea3f9a87697949bfdb69ef0fa1b5462ef4d57cee27096126adf285d9
SSDEEP

3072:SlAqkTncVQxGy4EyfkMY+BES09JXAnyrZalI+YQ:SlmLmsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422464338"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A39AB91-1780-11EF-A9A6-4658C477BD5D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1724 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1724 iexplore.exe
1724 iexplore.exe
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE
2064 IEXPLORE.EXE

pid	process
1724	iexplore.exe

pid	process
1724	iexplore.exe
1724	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1724 wrote to memory of 2064	1724	iexplore.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 2064	1724	iexplore.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 2064	1724	iexplore.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 2064	1724	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6458e7f8bf69ab06ac28456d0dad9f6e

SHA1
afe0e6139ac222480a52f0cf749ed22f78715606

SHA256
c32d44ba2e362888719463a63569678fb3961e1c7b22428484f678f28b056049

SHA512
5d0c51c88d8533cfeef53ed0c9c80372988a6bfc4b070fe42afedb635b1d3f618e084761acf8183d8f9f0dc69508666ea54bae746ff8d079b0524f83cba26954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45767a2aed1cc1f301b52a753b6d5c20

SHA1
6939057e0aa47fe199073d8d8aed1c6c2a24d631

SHA256
aa5c50022a7d41ef5a73959b5c3cae2bff8f70d8002e1822865c3ed395911fff

SHA512
f261c404149c98108cc5b9a8884d548dd8cceb61e4f06c205efea66888f5ee01c433269d6fd50eebce175071667cc77f64df1f33b1e329f8fcd578ced25fdd59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27cd0bf45e94913b3a4247b95dc4f329

SHA1
6621ad1a941b2f943d37922906db632c10d9f196

SHA256
3e7ead74577432c5528240e796e51cb16a43607300c9408f71dce0d1909ef4b2

SHA512
1175cecfd618b9eaa48433a9e621f43ff9223265d142b05674e71cb61d3603200d78887e0857a761e1340d38b8243620f94a66a6e4c079c93d96344a77669950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7054ed905e79e5c8a3342b6474faa3de

SHA1
97f7eb268f89e4d67145612d53c81aec2a63639a

SHA256
41c60b8b9ce6ba2532596c1f5e67c46eb7b54a5df06627e420d00fb1ada56f1d

SHA512
0037835ec0ce10502f1751e53b507ce6525957895a1e5598904f8f002444d685c337da76f6fd6bbe13fe1bacda184b64b1a2b2638a5ea4cd215300e61d65f917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63881f142cd5acd4879eec2f51369a4f

SHA1
a5b0c52f8b07ce504aa09f1fe0b09a4665fecdcb

SHA256
a43b2ebefee46f617c8ec914c9f9f7f960630527b3309792113375cda21d1af4

SHA512
264d5a6983c0e6c86d33219860dc26d5e77a5b96f77d276f88ec3ce4d4f5d7b5bc983d3437946f024c1c283c35df729c89bdb775a2a7b90cb90acbace45b5b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e5efe49cde581a7980c6d10489542e9

SHA1
8c864ad5832d8072714ce0e30aaff21909a0ff22

SHA256
2fb963eb37004f126a14b462f4a7168d7094586a0fe45519c64f1687080f7ee3

SHA512
b8d08e9faed9a7e2b998d4bc85ba5d8b1f47a8589cbacfdb41e7890c098bfff3640d1da196a55dd0c97676a60955c5769b8527285705a0a44c87f357e65e7632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25d95073d8b5f124b0586e910ffc9836

SHA1
0516e4e7c2e38fc0ac155eba525b7161fcf8b972

SHA256
331e186a09acd378b0d86a92da14e5cf22badc97c60da2c110b64cbfd6a590fd

SHA512
e5a5e7c63d2982d43d5c40aca07735437b64fba7539149d13cdb2590243ef88325cee328f780efa88d70409c97ec0785d5f0734d0d75d0ceb48f1cdfbbe572ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
167db61286320e4a1c6d579f3b24fe7a

SHA1
03415c0756375459cb65723034effdf0ca372e8e

SHA256
48fe583a96230cd6aa347e3755ac2c4275c0cccbe053f43ae099db752f3fb0a8

SHA512
2fe90209b6e44a221c3fa8fbb8f8aa1021dcf29f0262a8c960ce39100a7173f6683df1de6b8958ba9a1900a4de4bd15b0579aa94e4752d73071fd6dfc8b7c6e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7745adff24f73ca6925d29334aab842

SHA1
17c94188834b7169448195c62f925c7ab8c0169f

SHA256
48108307cb6a88fe939e0322182028d721a85ae23ca458eac8e5920b7a7a5b30

SHA512
ea67152929a9e989bb99ef56877e19547658663d99b2df769ff03b86da664caa255108546b4656d1867125aa7c043de2cac8f9f6b5b6563be6c047705e858cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb76294657e79121f3a061bcf9ace4df

SHA1
1afb01ce9a4a1ab82dcd3c3a46a46495604f739f

SHA256
4e526d6bbc989d16cef06cdeb9eb70b969acde0258363e50e09f5bb34d3eee32

SHA512
4f1f0c086830dc070625fe348149d8efb400a563ac1f2048c628fc1a6185a90dfe6695b2edf0efbc060d29139a49c4ecb6c40c66d05e112c9dd3591996a0b739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef3de9c2da76f323f26a17a0ea900e0

SHA1
831176d6e5da6c7a246bafb39b9d82f9dc35f866

SHA256
089c04f07cc7eb558d4c2a6c64897bf86fd884b9092c4c72c567e8237d6347bc

SHA512
509e16014aa6a8726791b1ad43b595ffe2bd44be531ab2bfb182df62ee2586882eb0b2fb79d1a4f1f18b11e5299b2bf9eb9e2d4e87877acc577d2a159955c9f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
170db4fc76be6acfea189ccb1c1984ea

SHA1
597a8eb37195bc43b9e9f5c6c0944385892ba3e6

SHA256
279c2cae539246fad5756f448397e5e6030f315458408a20761a48f6512a019b

SHA512
0292a3f60719c473e365552246288807feddb3f977358a4533d0faa2e5b22f6670dc9594c9d57786cf6a3d71378b5fcb7ea1b9a149eb45a287cea8a5b3db0b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78bc8b74176f6039a6d8b65967908f63

SHA1
5ada4abd574babed2e55705cc108b211434bc0ac

SHA256
21baed32f2574001ce9a1cc4d400e68ca345d15d72eae8c3694c59118589d98b

SHA512
eba229ca83ae3354e6e734eb7ffd3d5fbf12a96bf539d80080638acedff7c342cce6682148dc6e3bfca8912a0f70d7e47d5be4dc647124f762c56bdbc95d75bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04586335ec01ece5f7a419b0c22020e1

SHA1
5ac9c13c8863a6bc416317a2720693fbc2dcb0f0

SHA256
e113d5689c4cb57c2e23ddf78be27b08da9821e9949d884001547e9df76691fc

SHA512
26611046fb7976b7bb1bcfda84d52415839857f0ca8d864d87db8155453bf92856f737a9a1bd4cbd1fda225ffa4724107b1b90a074c438167bb4ec0220d7a20d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85509a27239bdeffd89412ee996d6273

SHA1
8f5726703ffa5040b02fa11280a6a0576a10a046

SHA256
94419892356afee3f790815f32b79b6a17d485e611a7cdcae516f276cafea1b2

SHA512
9db130ff949a8017c96c7563d87d4b49edfa80e3e85b86c8952b81aea80e0ac11f12eb965b1358bb284e5ecfe01cb29f65ce1bbba913282f6e2b31e0c72d586d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F55.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FC5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit