66183afa2eafb8c3f6ba384d422372cef9977e4113eea3f5fa34c55a1a5af8f1

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

6bd41379a7136ba4410c5565b39edf7a
SHA1

70c46d0dd3fc1844caf066ae53545fdd4c50ddc1
SHA256

06170ad66a11e79e38300cf534aec663ae961c4a680ebf7c04426a9e85e62625
SHA512

562e74a2afa2ca4be70c2f0a7c3ec5da13acdac6ebdd882da7f650c16af557a8f7efc20b2bb20c661e49ded0ea85cfa49ed2b76c9acf40f0e9d1807f0b08f7f5
SSDEEP

3072:Sk+7kbQe3ZMpyoyryfkMY+BES09JXAnyrZalI+YQ:Sk+1NPvsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D78E1381-187A-11EF-BB21-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422572005"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2424 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2424 iexplore.exe
2424 iexplore.exe
2216 IEXPLORE.EXE
2216 IEXPLORE.EXE
2216 IEXPLORE.EXE
2216 IEXPLORE.EXE

pid	process
2424	iexplore.exe

pid	process
2424	iexplore.exe
2424	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2424 wrote to memory of 2216	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 2216	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 2216	2424	iexplore.exe	IEXPLORE.EXE
PID 2424 wrote to memory of 2216	2424	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
82081408ad0de966557e6d1927c19e13

SHA1
b9f20f1d28d6e607ad97939f021c239a517bebcf

SHA256
78acf39e427be520a40e062e74b89e97b36c652d06b96cc2be6d639002d69e8a

SHA512
48ffd605d9157ad8aef2dba874f0e325644948eb2ea3dc2c091be962b240ae4dbd6940460644fdd9a2ab4d6fcc14ebbb50c04c61dfddddf387e3e7d1d82535fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b9ea082f91bfc81f067c2a74581ac6cb

SHA1
1de9d8524797b30e74aeba1f2618e46ecdf27a36

SHA256
d93c516a0af609bee3ab1beea4e558d602fa6f2c6865857e03bdb985bf17390a

SHA512
b5d8906f5a7443160ac9f18cdf7086608c6cf42fb5b64909f2faf7b0a650bc0aef3797bd5879ef0c8263b97d6556caf223583ceeb6251456a770d624a02e9bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e57215b591339bf561fd631f58aeb6b8

SHA1
b2e975a495f4e048d46e094d7cf6a508627db453

SHA256
bd9e3b6570d534986e6583dd1bbf28686bacc1a11c882fbe4a917357d2cc09a6

SHA512
0dad61912e5eb3279b8da5bb69c3b45f31b80d73d04e0f2efe0de89286d27b132b4a4560ccb23c6c240cc8b4fe81654fde2681886886eb65e77e10267da99114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
db67ed81922a75f108df71716b292115

SHA1
994571211b12c71762b40956f843083febe91dbd

SHA256
d10c58db724854a398ed0c95b85b1ae3681421ae256a32a3932cc438cde098de

SHA512
06e8ef75e09525a17cbeb21dec9707cf0885e766645aa03d49fc936e05c4b4a3abba2dc5e86e026e8d75273f1cd7db014015ef804cd27d3a2bdb0f85688ede0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e7e70f02ea5554efde100d2e0e8f187f

SHA1
391d5b889ffa0d40cc52792dffa0b368d65e29cd

SHA256
35e5caff64c431fc8cebb24449b8d6620f52de7f51906dd95bf765d89e1d0914

SHA512
ea4c27ed5802818cdd80749c988b6567e052dea5e1ded252085156471b980189df9cc3fe2bdeeebb913f6fb029eaf3341520e8fdd2cc952864d5c330e7e129ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e000b3f005e3f894a9c5135d8e44a6f2

SHA1
25fc959262c1749a58aedf1f3b9e795e3e6d7556

SHA256
03b672d11794d572e2cd76e413521fb2565119bccc6420c6bd293a28041bb75e

SHA512
228d24c6334f035f9e677d1317960175882b96844cb87bc4fe39407c78cb762bed6edbbd8eb50ce39ee3ad1cdf4db7762e81ea0482d5d0e094485153ab8c6158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e6cd546e1bbd996f081c39f43839120e

SHA1
f6221eaea1ab390cedeef2dc0a2c60d9508a75d4

SHA256
7c2aee9bf7040e1f4fd95012cb204a7662b3a223b194b43d9268788a13bc8197

SHA512
1c1694a1a81e4ce6cd6d51c7ba7b515cccb2c6526e5ef53c0a91fcb2ddd8927050ca7daea45d810ad3cb66673f12384c41cf72a0ce033cccc2b6fe4a0d81ef45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3ab766088a212a3ec5a3d7ebc0e3c719

SHA1
e5529ebc9b1fa3ca52002cc50fea3919a9d2f1bf

SHA256
18b4da06c52b67d8de6817856a01dbbf4ea8615526b41125e22246d5f20006a6

SHA512
c2387c0ab27e49163b53e641c19d4cbd20374141888334e7fb3122d970d83bb89b5fc1705edcc411cc0ea49314dbd82b83d1c141d403aeb49cf3d0f0f8d0851f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f5d74ef19d4b64d825f5ee1a081dccb6

SHA1
2c1a802fe8cb5110dd6753c5181a68bcd2aee89c

SHA256
5aba6bf026b5902ab6c07785828fc96a97c24212e9b6d03b011bb7dfc2428be7

SHA512
3e178c57549254a91d54e36c0a2619ab47984401f0ea2c033b9acfecaf147645b2ce299e1c15ed1877667b85110cb820b1975813e2ea4d8ed24c81934cf3e68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
47c901b454bc1cced6caa4cfca346b95

SHA1
931bb833057482c614d7c5a64b6829ec5c18a443

SHA256
42407b8991d5c81b47c575432e1ed504b03edb3527ed8f99e5fe3468e9f0f9cd

SHA512
e054436e5aa5747df0530045ac5c5e805c2e2fe293028dda57c7dd1cdf2b0cabf657f4e6bc06507ac6b9e4c40596ab010b583056b1a6d9808d715a0ec994af64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0b661bdf935948add3bafb295fddc21e

SHA1
3c88e3650e2b318d89f74327195592fc0d4e270d

SHA256
a2387944a6e7a7717f4eb00b2529ae7dd8b74c5f06ee8e30385c93c7e672c54e

SHA512
4a86979d56238605dacd494267351b54ad69e33d859baf00c493217cb370b14cf17f918f5ed6a253d48a8f18634f9a2468424d306a6d71d6594b81dbc0fe317e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19D9.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19EC.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit