9afc900189801da6f86574a0f61bffbc220257917876384c6ddd6e407213e4c6

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

8937a73f137f22abb61b1f793f8ef143
SHA1

170cb897525550c51157b1cb99c3c23422df0798
SHA256

b96aac10946f55eb56cedd76f9129f220d6bffc9c9a099a2fd3f667212a1a471
SHA512

ca77414c7e12c54a61258a809332b23b07945e1a61cd64478ad82160e334f529f6b381889eeea30fc9d61a9d31e559646dd4fc5be00a336531bdc98785a9eda9
SSDEEP

3072:Sm2hhohvX1ziryfkMY+BES09JXAnyrZalI+YQ:SmPKOsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422502885"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA0A9981-17D9-11EF-A635-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2304 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2304 iexplore.exe
2304 iexplore.exe
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE
2180 IEXPLORE.EXE

pid	process
2304	iexplore.exe

pid	process
2304	iexplore.exe
2304	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2304 wrote to memory of 2180	2304	iexplore.exe	IEXPLORE.EXE
PID 2304 wrote to memory of 2180	2304	iexplore.exe	IEXPLORE.EXE
PID 2304 wrote to memory of 2180	2304	iexplore.exe	IEXPLORE.EXE
PID 2304 wrote to memory of 2180	2304	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
568eeef333e7730eafa2bdf6a797972c

SHA1
1c051bc8d198446adaa6451db49612d0f7214d8d

SHA256
b68211a90d5e3835c9dae9f2b82b96e42094750e220b59024e792d077e0c0611

SHA512
558af9a2732ac855d33a8f6e81cfe659916102dd1e5c056c9b51ea3c6f0fd693d72322f23e9a3e4d8e85884cc533fd4937f588fd7a5be7ceb4f25a8f1e7f8184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8df45f1fb9885118ee4be5f7b2bf02f

SHA1
e333b46ea3ed38915c3694cb320b0496d651fe53

SHA256
eda342aed879c15250947ec111fc57c14cebe50e56b349ad7558adfbc6f48a77

SHA512
737b7dd39e5d7578b195b5c304f05f10d83d33b2139672ac7e24900158decf6270052be31366708c646e3206a8a7284af5709b66dba80f0063a6e1bdc8bae085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5227f49be68d36816dff4ae941db1c95

SHA1
f3e0cd97c71d42556952563c7a18ba193515daa0

SHA256
680a184e1b257477a9320a833692b9e71935281285b39c9fbb9ccb6c32165b70

SHA512
aef4b7688d571d07fd50abb1b146aef75746d9af626a0aa95fcb0d5417180387c7e7cce5c7c1f3be3677f3041194c78376ef8a08a32a32a523a2368200418a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45168bda7a044c85d7dbe9c85d930fb5

SHA1
e0ce438db6ea4565ddb2e396485ff8b52749731b

SHA256
f78e99e03710824f5467d653271035023a86be9edf890da031475421f890cd78

SHA512
e4c9331f39363a522eb500fa51c9fb7d47ddb0cfb55f52434443c762f999d0f0f22e972f757fa1ec367c93a636c3c736b08b5edbca3f3bede1b9f31d50c06d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72abddfc4380e01881afbd236c1ce94a

SHA1
8716ab80b5f3f31994d83bd0db3e3204bab9be53

SHA256
43809ac7572d3debfd8d9286c003e06c4a223cdfa94be08365b263227c55630b

SHA512
adc7682384e76bb2f9e4e027758ce05bf8d8aa3f641962106c4ce15d9ef451bea67fb8b26d5e088d71b8daa78f7f4c01fccf03924183eff69e0ff2d8e1fc1ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9607aafbffbaf3c56fc10817f5858ba8

SHA1
ac77ce2290b24a0f5d08d200a614fae872f5373f

SHA256
c46f094d1b2c77a0a3d826c351171e6c3bd55b3f2a3493c36ef272d628255027

SHA512
5e9cdf8c82402a318ccfd89c2d7267f39a1155bdeae52e54cfa4c72dbfe42b72325acd541722da6b75d63f54c86e9b8c8fb065d2730d9d6bb2260a584e92a130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9216da76c84ec49feac5fa99286d54c1

SHA1
10b4418756b5946a206e64e454319e811f26d11d

SHA256
1cffc8e64735fb83335ba7855cb1bb243dbbb6c4a27a4700821282ff18bc7c75

SHA512
d449f68a776c02b250059f339db4d35e4dc9fb1793d6f135148671291b282383719d2e5bef717603ce8ce87f4dcb692af3c4bc3a9bf28efd7c48f111cc9a3210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
781866bd000d9ce5da918486d5d06e69

SHA1
e3da9cd7a8e5a8f29178dad4a280b29a83aec91e

SHA256
0d07dee672d56725cbea207c889199c669375ac87c563063b7d4d47ac3167cd7

SHA512
cc0add8058e85399b5f7f9f90c388f728f5084c0c18b535ed2a029f664cb4a626d15ddeb30827cfe4c1c65500403cdb98d460029811b61e51f64b41c7bded8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4708cdb1cdc3be1a2e71f445a7b1c164

SHA1
1aae49938396248f226c89c6e641db6aa5115edb

SHA256
fa8cb3897edf961f67b43f6710a9b25d9946394b422e3e4de28443720a617f83

SHA512
e77e18f329191f7718ab1a14fc91696b4c926b6bd2dc46dd0b531b5151a4aed6f5f49724ba3d468b06cae0f76c0200b112efc4ea5473af160192e10d414296e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f785b29c788b9d1bf2547e8a6969639

SHA1
d07bc6fd3cc6acc1252f53f6c7d6caed8d586597

SHA256
53b657930fdd6cbbc7805ced4eb85bd345cbfc9eb1356606a91f1be3906720f1

SHA512
4516dab39b1af9b777a2f61e8bd81f36bf3c84b676b878107627a0be01b6844444d1d3ba86a2b25e97336c1b7f27a5f36f8d3882c45e72edd7e8c75c60d46b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f47cc64b3efe1cac34af4d43267b04c2

SHA1
a9e9294e7ff96fa6ad3c1917a218089ea84fdd88

SHA256
1da9e98465f60516d87f5a41ddc5a50dfd096da4edc6fdcc330fe377a10aacbb

SHA512
151cad2741737fda7942e5bf5e10af5d95ebcf55fa5822ad457414782bcc246af0ab8b33344452d070e89da4057668a6d00728e98c3bf881ba4e35e0c6b2a7d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c1bee6bc0e46f40c587834f1c37e231

SHA1
9657bc59f5e34b2cf47edad6b1241040b586dbb3

SHA256
3a7f227e2fd55e48f8a4c0930bdd9bfde4254c454d623020c15a77e87c76b3e8

SHA512
c259ac909017031bf7740f2dd84399ae8e52f348eb7b369ea373676f8529c862e70811d1241b878638296d07711cb39088ead60abd2caff523011dbbe36dcd08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e43b89aa5c92061eac59be5e6eae9b3

SHA1
c18057020b67eb401e040f817a2fca0d031951ea

SHA256
1f93d9ad7823fbc91379a7eecd794ce8c0b082248bced4e9579409f4b5d2eb66

SHA512
677132e56f5e5b40dd3fd6a139a39f26a3ab06911de3337ebf78d8e6f2f4a2d95ac00c6e51aba974f82cd633980aede0806e14c1dc1ee9d2abcb94929a6e28a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d1d067b6a355796ccf6c80024c586a7

SHA1
24eb076a7e0eb2fee1bcb897be046c71b7559f19

SHA256
c1359bc0df3c757d38500e10b961b5c7e9853bf50084c346e3bdd0e19f05a6c6

SHA512
616aab5decf678cdd78e7ee0bce8fcd1ed4448eb77d6560253f0bf0e0b8105e40e4efa2666699af5d1e84f874ca43c0cf43d0b2eb964f6a3f16d8e3df3842d5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2812c3476da1c5be126db0ae34b1062f

SHA1
0bf613ee1ddabea6496b835e6a216e152fb338c7

SHA256
5b0998f053c03284aba68f4a1d07ac5cdfb525b88c270da239ff9923753175b4

SHA512
abfe74144e04aedeafac269d2672e141b90591e59ff3ee9f9bcbaf22fa0862e3353703f4f0cf60992708d893c106157993c0dd87a8490efd958f6a8f1742de98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b565599c4077c5fa99c4def921090bf

SHA1
f271af686d6bfbd1b284946edfde4386ab1c7086

SHA256
6cf1ac4ec641b174216d617437e7ece00061328c4001d19a5f3433f58b917c68

SHA512
16e736da436181a106553e32c7dc60c168bd818c271dc63a8b36dba18718c405a5d413ab8bdec6d7024d24bd36ccc42e06b6bf628b6b765407dd3c91abb43a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6670320eae866abab4cfbb6999f121c3

SHA1
c76e3539d5f4d87cdc20368e0ea9e70c9880cff7

SHA256
94075d903bb1850d5db9862aa256b5c853c5da450d05d7afc6c309a0641615dd

SHA512
83bc56e8efd5a67aaf9fe07a4b9daf70617f9d941ef59fb6e2f51e6cb4a3c12f72951b21f0446c8a9f0e5bf48be56e06a5ceaa01da401a6b62147b0f89e70312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7baefc2e29abcdd4ead59c10bf94a05a

SHA1
dd5f6ca9efcc654d7939841f5dd76adfef3ab44f

SHA256
6912722f1452f95d7f29d88d136fc5e4f4110396b74fefd6e3e70d9d895159f6

SHA512
6c74ba74984f9f7b6cc56d6edacf360ff80e42b2eba5d548ff1c1bd27bea012b823012748d793d0f0c9135b4b372d55a643aeb4fc8c09bdbd92a02e55c60e79e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08dc3f8b8cb8303bc0e79d6519769839

SHA1
a9dab49257e4eb30ee83d721e5393bc52b32544f

SHA256
7e253ebedd1556a71ce0009d3826cbce725ae89053fef4dc08b3b7776e390e67

SHA512
797d1296159030d6f406ffe116b49cda8a8f11cd1a56b55e3b0fe8077989350164c05e6587eee4aea75312da73492383c5fd3eb8008b5f9dd8a31a8e5ba6c986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2196.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2268.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit