41c343e0fb2a2dfce8abb6757791c62049fcd74d01055f042a848b30b3797b30

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

ccdb1236922a579cb350adf08cd753b3
SHA1

9dcf7d4d92326dba24b226bf67c66e14455a241d
SHA256

6e86c8523337fc66499aca2e7b21f4f1e0a0944a98068450b53be8dfd9f97b77
SHA512

d861e3dd94ade969243beefac09f0729b707abcc24769725ef5f389610467aabcf651f9944594997fa24f462451afab0b3147844f35bc5a38aad7501b43be558
SSDEEP

3072:SgzOXiY8itN2hyfkMY+BES09JXAnyrZalI+YQ:SgzEqksMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{721A80A1-183A-11EF-AB14-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422544345"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1688	1976	iexplore.exe	28
PID 1976 wrote to memory of 1688	1976	iexplore.exe	28
PID 1976 wrote to memory of 1688	1976	iexplore.exe	28
PID 1976 wrote to memory of 1688	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f174182fafe89aea3ebf7bd7811fea34

SHA1
dca52873840e6e1241aff3092348730fc7d48965

SHA256
127b96ff6116cb0ef6f762ab5f52f80b7f032c07e653aaf2354ee697ccc06ca8

SHA512
bc1affe4dfe777d59447c60f2cbdb482937a60001b55a1fcb27194270d9953dab77f1fe1018c6ca398d66720b937fb27198018658dc39f66a5e3b2c0efbcf498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bb0aa81b1bf4bb84c3f9e34d3a63182

SHA1
b1bb8b9642e900e280a348a24f218323617df437

SHA256
43a9528cf86770454430055a7464b18fec28a93a61219013f12eedcb874dc1ae

SHA512
a1926ed9fa30716aa32bb3eb75431a3d56cfccac20ffdd2e8470648127ab6fa93a420a012fd04368fd1ca3d6fe6363b768f8badd301c7091f128d28209bcb11f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c30b434151cd3ced5b107bc3ff3956c5

SHA1
ba581d96b911c1827cb017fce8e6ca87e997eabc

SHA256
894fec59af3ae45e32dcf8d39f0b78d52366127997413b5402111fc949de3750

SHA512
0fed496a49ea3c9cfb0a0787136a14c0762aedea27aa834f96d54a9bf8ed740187531b9e58df8ee4aed38ba3d51747b2c0f4a87d0f38f0a6965207e58cfd0ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5840e0931c41a025ed08f1090632ff96

SHA1
c53a1631edeb9c2354079dcafcd92c7bf98c650d

SHA256
5c9b592794b2e7008a05b6a9c1b706469cb37ac6f8102edfb2119fe9234cef1d

SHA512
d12b85ef5682f783a22f851f5d747b3c1509efe0f01a9db4f905db8e80544f64fef18ef8f925e4537d9a47702a8a89023251850f04f955d7de2f73a285cdebc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c759d86ff4a0659210a61f4ea845f75f

SHA1
8c3fb9519ee201fc88dcd6feaa59aa938864adf1

SHA256
21e34fd65ed39a5d81fdda4a66856b579f3117a9ffbe8cd1a1c1bdcfbf3682f0

SHA512
a29e2bc918505259da85a550128bacea5cbcdfba5d579e091b05049a101f3ad74b132ca393018a9e0364e226bb37a7f700021591a1c8f6716d89df32b0b78740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cf374324636e701a95301d693a53d15

SHA1
0a7e27b1db1de134ffa84adfed61d2ad0046976f

SHA256
9efae50bad5b13fd45e3cd828d4c2d3bebe49fa26f82b53d1d4261b1001f11b9

SHA512
70567ffe514b76eea854bd6c6c5860d969a62af5da87f696ece553e9b417e9746ec00d07ba4d8f429443e5c40d005860f1a7c1cb91f7ecc6c3142dd6384874c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4660a3ead60b38df31f954d971a98c1b

SHA1
9c938e58c4cb199c78656d48160956aa85ad99c3

SHA256
73bef7a13ce48056a6d602c644a622bead527e38b2ece7719119a9e7c5f90b58

SHA512
38bd417b08f8298f9d4fbb32f40f23e59814daf7dc158dc01fe12fdd483cd1f73bb4d3f8c1baf3f41d8628016b087ec8aaba8c00b28ecc32c4c3df81ecc659b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8faad306bb76d07972b857ce3caf8788

SHA1
00b268fb95af9f710b71dcdec55a5cce0c808ec4

SHA256
5722d24dc1b6e6007a5d7ba3fefa7330c4c25515084a826931b10328b6239f93

SHA512
2754696eb1f56761871c8c7c32a4ef1e84ada9d4a3386da0230f26ccdb2451df9da2d17c5f35a18fcc36f4f4395dd99e5035df5a5cb6bb16cb4af21ba86ce02e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8418fe71bdba71c880c43c81a37c24d

SHA1
438bd57987634512e225d525c453bf5daaaeac48

SHA256
e170520783b663a10a1ba8f3666ed659b453281943e036127c56da0ccfdda6e6

SHA512
9b8b076e4be66b8c53873b632bdf3ee87614075bc96e858bd98732a22eed699b26c97b6602e132e1b3df909e073351605d6862fc3370b09b6aec11c72c12bef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c9e768bfd87dcba1b9338c3e2ad85f

SHA1
e99370fb489631ec628fdc5163115fa6874e6868

SHA256
4aeac35e27aa7fdde883104a3485984a3f02f4f9d8e6ff03fbb2b652f58d85a3

SHA512
98ed0f121141ce212bdafd88c30da9aa678e3d2c4abff73500a06ad9d367f81cf28d477ec00eddfb929be83d90a9e15ca3970cad140317122f6b90c76d4980e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed0a12d94003a4583e6e4a2ea97672b3

SHA1
209c5a23034892156d848d06690612f0488e747e

SHA256
9010a2115ccf803338d9234c509c901b9fdc2b7580a0ee6da751e8d8488390c1

SHA512
61b7cfe2d4f4025ec1fa2f16ffba59d7ae731d87a72ce3cf5d1c7664a52b584ee1d887c3713ff0b7406c6d26805aa8e2fddb9e3cf712541d923ca53a59678f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d1f8b774eb901e733f2f4efd5220081

SHA1
365dc2241a7c442f21c637df3d9df2dddafa1f31

SHA256
dc4f98aa731f058027f70a4fd4458d59cff32cae68c2aed94074ef2131e9e6ec

SHA512
5c1be0bab6bf7b45063dd422824027622bd08cfc789cc3a1e7bbb786fc9ff8796032f639f0318e7ecf6040db0a82cf939e8c6392dee814d8110c22dc3ffdc30a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d86325fbfa805a320ee0fea3e489dff2

SHA1
f57a16bc088769c559857eb5a07f85e8780b870b

SHA256
4058b3963ef7022c881f8ec5d515ae8eab3299e5ed4167aa6ac7ea61055aba8a

SHA512
f6379d482fb3be34fc0f7bd921463be2675d32625c3cdfedd225f1d4b64a882d4779fd4014f5aeb27d24dd1f8edc73f4170cfbec5ff7634a095e556896b061e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077dd57f2a0724d1793f4cc77c545a4e

SHA1
767259fe4eabe91bbc682f6d341ea71b90459831

SHA256
e3dba72a5d25345f59ee85bcf0470c630dfcd52ff28199d202519e6c74c881db

SHA512
3090a0132970a7f6c6409b10b49b9449e7b4140abb3d78195349f25c0a7766e0dd0c29b2e5f7e909848a7911ac9a31c693be2be31a78a95de3ed3f18aa840d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80002a376caa7a5b42312b7510c5ec45

SHA1
d6a4a3a4b0063687dce5170ab21cba9cefc7fe92

SHA256
21a37f92ed8ef0ea63453dc6da244ccdc976f92edb034846cffbcb28ebf4ce17

SHA512
b80b76403c6fa05955d11708b7fc9afa05159c1a00d0af04105aa0cccd8a86eb2fb686064b4229be92dd6e7d84686b49eab1b0d6c6aa59ce86cf38d84d5bea39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ce0b45e63ab806b989dd8ce0210484

SHA1
bbaa740014819ea96535bcbd606407ec143a9097

SHA256
5dc1418c7b183b9bfc82e36b9b1e6183479f45254cabc76f6fbc041e951e8586

SHA512
1949079c3311874e74d860861fb43363278607e7bf9895ec89b0bc183808eb4dbe5a2a1bbc344be59ba4e7621f2ba2c6ff65c592ec0530f2fbc115ec81ce4d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2153fcb6498bf802b7a7ff638e959e9e

SHA1
b6ddf19c8bf3bc68303e2771ba0783a842534867

SHA256
048c2fd711182a473945cef276e2930dc07ec1a2929dd7ae5e5f095ba40f751c

SHA512
c3d889a777c1808b1eb157b74cd3393261f4a425ef681cb13fa876dc03eb7fe11bcdd3a9ffd13a1cb859573263ce634de1030eb7c300b730851e6337f77b2b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e08e89259499b8ba1d823957c8e8af6

SHA1
dc306bd5d86cfc6aaa4395633642add77a0bbd88

SHA256
65d8427114a7f3deab7ae6194a7a15f86ca12edbff5a6b2b605ec67efd6d11db

SHA512
4226d145707903c59d343a3aef6ee7493b4f1ae4f8b5ad5bbf271fc43b1db4c31d3d1065136e2e38591f7d17f7faeeb8236fd4e67411d0470df865c4c6a0e90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10CC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit