baed5ffb9c796440c4960d86f5e965d8caa0e93cb20e7a23fca4a5620e12a007

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

fbce3a73b690a0262e952fb2be6b12c3
SHA1

178eebc78d675fe9f8cf4db1fb64486a43893cb0
SHA256

d6cffdb20879ac85fcb1a8a1ca32b20d54e1d4207c7415fc70c3e8b646ff5036
SHA512

741084f410bf24b8b5088ff458153956233add1a1d530055fff10edfe0d148a677d84d609387976018c38f6a6b0726ca7eaf92c732b017f492b23b632c763286
SSDEEP

3072:SU5MEAlxOoBGyfkMY+BES09JXAnyrZalI+YQ:SGSdDsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422469933"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{310E6021-178D-11EF-B4B5-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2924 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2924 iexplore.exe
2924 iexplore.exe
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE

pid	process
2924	iexplore.exe

pid	process
2924	iexplore.exe
2924	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d47b3bf408bd223699a6df4d312326f2

SHA1
cd3098386a3f1a28d5169102f51401be384e4d2e

SHA256
e612e65642de165e9c34a050048944c3bb64a960f1aebe98ab30f8b5684e3fa7

SHA512
79df2af951f552ee7a4ea6cc9721690719ee4381a185a8bb22d2c1edd6f72b93f358db09f6e29438b8e5863f692adab64de4769a80c7ac8d8908ca092e2904eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4482d014d9a972e366e356eb5917ed

SHA1
517f676a7a506ea41edb02ef2cd4b6c59cdd58c5

SHA256
2f1e99d589edc0e0ea97e9d6fd2a9765add7af43e8973a1b9468f7bb9fba348f

SHA512
25e1340ba0e5d27d9afb95db67b19bfc557e08dd568679b3f843e34a50b5c6f61d57defdf0bdf1576b2910aa164c0630aa3d7e3de9f9b78676a445aeb537be4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3cae2f97af402aa0722550a38532fc7

SHA1
6afe161a2b9c872ec8466138796eb1095cf9d270

SHA256
68acd3b07914e8cc7ef209ff74b6cdc4e85cdc45ffeb86e5f38c25688d77ebce

SHA512
29cb4c7987890129cad1f2fa68e720855ff0d80041b985d6c2e75f9d9060d8a2c3170ee03dedbc976cef537b022c8518456c4ad966f90af8fa5bc8fbb2122af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c366baa49cbd372da79624d57301ab44

SHA1
6bca7a0bdd667289451442f3fe0c351b344d74d2

SHA256
53a1484da067f6a7c95c2b2106a00629bb258879dd6c21b57fa7e1bc6761546f

SHA512
b6469793ec1405f90e951f4afb99635d0aaf3ab4e289db6ecc428eb127c9e1e4c1254a3ca65871892d76f50bec3eb25c3435b5b8be01cc868b9e78a6f56bad72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
453ccbf7778e926eec1e8ca93de34711

SHA1
a0711218909b46915f7d5be5df2a22ea094a2d25

SHA256
7294ef7dd2c8b4c66f5070c599ce761c5120e32392869156361b1733b6241c4f

SHA512
fee5313b8bc94900f474271dbdf82380b8ae494d4b63a7ec9e494e5290dc1b3af3aa3b3cf84cfed3f7c399051541f7c6e7d9b092f2d121665fac004ce292001b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a93b5f062761abfdd1048f4f3e8470b9

SHA1
309b1bc4b10a0120f515dd298879aa37971784e8

SHA256
3dd52464b04ae6d090c088b170d9877fe4a2c23285fb79e299fde7aed8a7175c

SHA512
80a77f6843dd4e23e846c9ac7a338640d0ee646c96233ada85fedb1e4c86d9d6fc410aa583f26aef60dcc874c22ceaa3fac8910c3eae479fbf113bdb264c9f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b387731de572a7c5cfe933281fec8efb

SHA1
831a3bac361af35375c2b495391fca07da3683a1

SHA256
b096e8a6db9d1622672f9639bf644bd9abdd2843da942111358c7a08f70788a9

SHA512
bfa988d72158c3081449705aabddc9cb6ec5f92d5fc042ee392cd10b34d09739f24a0635a842ceebb4ff79710b26285843a865d6e133f2a384b788d04f87bd11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d2fb3291dbe47adc1ea17910baa055

SHA1
575d3e859771ea6417702b0620f6e1603a69fb9d

SHA256
2099a9855c8498e7ff6b1a2766538ba0a54c6778a931a000aa4b874153027ecf

SHA512
ba227e2bbc8c4cad09c41347e2198436e5dd53574a75ac64763418f55aadc31fd7247c3a2dd1e6b635577f8b9d62d267ddabb7f144835cc5f1b548e9d52feb84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48782b3ec7fe1970f68f85d644960280

SHA1
328fa84b5855ed7428f0a0fa5b3a0b22a7f5e4db

SHA256
6d1a9935faa7f45eed0bdda69baa7965cfdc7b16b10f115ffde6705f66af6035

SHA512
f30ca0cc5d34f0b3a25c6eec776f62a4763a89251525ff3d6bbcdea6a724e197ff3600d479309e2226453064fd463c4c848e9d6f392b67a3563a99e7f842f18c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2834347fa20b16856a0234e86d65361f

SHA1
909dd29aa217d870886c0c841540fabc0cdc2bb9

SHA256
aefda61b8d127459fc216b8b4f788e4087ca4bb407c59691e13abdf24b49a921

SHA512
f2f6d44108a04e6ac2e9fcf84ba48817175fe4fd1e7d75cc2b87ab3693221e2268611f96d5d6250dcf31d21c708172c500845a492a904d63556e0ee609e2df97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a5d4c1fa35638908fa813756f70e265

SHA1
491beecffd6e7e2a5423fa8f8e64c697b4a88f4a

SHA256
0fea43b5070b1e8d24f712475ff1bbfd87131ce11344ef4cf906ecdbf67cb406

SHA512
07f0249a039b19e2d589d7a1aaefc3431fa5499da329be04021cc63269dc1a316cbbfb298f15bc91e5b9560d7fe08923b61dfb4dfcb244945b68034ad6fe73ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0097b177059f802cf04f3063f52f96b

SHA1
3df50ae21bec0b5401dea20dc934153dbd205e4c

SHA256
a948a5a455059151d48bad3c46a29dd9eeedb3a2d69aff6509a62e7ecbacc05c

SHA512
07aee17b0ec80eeaf88f7b3259f448730dbd4a117d179c258b8dc03feff71bcb19eb652d8f581535993554a2d9143681313a7cd6fbdf34f00480aa52d502323c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2bd8b121a6b9531a7ac1d0c875d6f69

SHA1
516097667d6ad0f2c10f08cbd40e90f100845d68

SHA256
4d925fa3a3ab79d73a07f89489755790c4bd6eacd896ddf9a1bc0ed65719d0da

SHA512
023c045b1ee47c0d9fe41fd3c0f1607d8b67fe9889e142400b6620bee5819eb5c8400b849eda5c5b200f84f4b15825f77349161835c00cdc8f29a81e318396c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d417189a8863e77cc53c1e5983c2b445

SHA1
ae1cf8a37fb633a4b9f0b465b900bce062a47c6d

SHA256
a6a78e38bdcfb913dabb4ac27033e324425bd2aed1291495983a424ec166d921

SHA512
749495bf31d7b86296a49616c8d4d540220b983bfd0c792dcce6159efe1610b5e9d68994382dbd0e559c288caec554dedc6844b24fa307dc03029ac1232a9201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43a41804f685ac7d4001e89e63f984a8

SHA1
f4e2609fc167a548c870edd814e7d6d69feeab33

SHA256
1f1ca3aa44f6646730efdb5e9d50f757b324665bf6d1ef070e5e09a0e9421a09

SHA512
6259f7cf0a7db65d50e85a0754a822804adc6c56cafccfb511e96e8e69e5c848be207f2b8523ebc65f8a4fe63b9969f350dbd3d9b1144fc4160139129e1a9d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5712cf75090874d0421ba27d84fa360b

SHA1
bdb3ef5634344a15e4eb8176db80736812195b46

SHA256
1d680b7fc8367bb3f61699e44e9a1cd40453587b8a9c275cecad7324b54da7eb

SHA512
57de145ed527a5d829b4c0215ef0854c21bf3584e9f3af98f176dc95c543118f7ffab37a2aa405d525d31e0f4a7938304638674b494203e1de86afd26bbcc4b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e00194a49343e87dbe5a1e4e07c4bbc

SHA1
16acf343eb5891f7a36788fc1b62fa7ae5964ee2

SHA256
1a6bdf16ff7e442c3b2f65757d182544f5fd8afe238d8a639b05f4c848a4cf77

SHA512
fa4c830548fa8d37340e81dd3fee6083df97e902cced8f9f363fe2d960ef5d65e33e6186e1a0229133240af0cb7b29d507ebecbec5c7dfacf1b4f8d792cf66d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
691f4e6a6ecb9e1c8702b668b5a4b35e

SHA1
8aa968308b26a58a412a9158b6cbe56cf3606b40

SHA256
32e8873c22309dad925b3aabc222156562f4376bad92e0c7c4eae6001f22adc5

SHA512
f352b8d43bae4db5560a484252875543ab7d7d09e7827209e09a1e3d90507a191c3e6f577f713e5b60ee33827ec2a8ce77a2c265ff78bfdc7db793d7e948b42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2168.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2268.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit