747cf05b340adc89c7455e1127469727e66032a7158430926da86279203baf2f

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

9e73dc6df7b5d4c47d97d05ae6a90b23
SHA1

98cdc642f6955bd630d3f40a0eea0e947d38a68f
SHA256

a4f0cdcdcd790a07d500750c936198cb2e6ca1342082fac958f8e9523eaab540
SHA512

5c2cf3e4baec1d8dbfddcc314586a010c72c85d82f03bbed30ee88117f0e58f07641f9dab753411e125667bbe8f0bbbc9bc5004781312684fb33beeabd9a8e03
SSDEEP

3072:SRLEqNhDQGlyfkMY+BES09JXAnyrZalI+YQ:SRRPQsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422720251"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02422081-19D4-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2080	3012	iexplore.exe	28
PID 3012 wrote to memory of 2080	3012	iexplore.exe	28
PID 3012 wrote to memory of 2080	3012	iexplore.exe	28
PID 3012 wrote to memory of 2080	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3187c889f5a315857598ed4ebb6e577a

SHA1
3750cbe62626c998766319980994d1bb8f1d6cba

SHA256
5ea3b7686e7221f1fc2e5bfb37ebe0ed7c10b7473493283d2c778ed425c78a7c

SHA512
44a916dbba544721cfe1c0b1f67a6993f209a498c77737f5a7e11a229d515d454a86b294b06f35202601974e74cb35f88d6004b370a15e929241085f16670b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6491c6414944c12d5c53a1ced715340

SHA1
51120ef80586223dc260f3bb28007b1b1d4e487a

SHA256
48b8b912fa5e7004c271c53c3741a03b8b8c6893490518326414a35b6f8854c3

SHA512
0e9a774e3966e6a6a99c2de2c6f794a44229154b6945a6af569965bb2dd0d457fa08438aa1c75b02698ec83517d5eff5c423c91cd245af131f6d70d4da58861a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
354d18e997682ec3d44972a2b4b65856

SHA1
ea3faf063618ed604018e2c18de6de288df465e2

SHA256
eda38d9353ae45d99e0a8f74e2f5778fa7f0abb2bed3db5a13dca74a7c5ce4df

SHA512
4c3b901302a923cf72b14510e362b303ac843fd377afa1e238bc8f863ab8d77a904128c0efbcded72ccf7996751f728427758c0f443bdd73dd35bfb97ab0a2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
776ae8e962c365e2d36b00c73c805063

SHA1
5d9d9af95caadddfd243eb713d43f732e38af031

SHA256
9561512d42f4bbc6191b356d3f4210a629a12cefb9d4d1e23150a2246735b5f0

SHA512
2d16b6c1c226c3606b8b91d40b195d0e9845db4528d4609c49f4011119faa6aa8cce2b89e6eddcab2a6b89b558e0b2030faa81297208c43b1fc28b56610ea3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175b181db70db28f50e2f7c10da39f6a

SHA1
5fbdff6abd5c390fefa769ecc422f25672944dd8

SHA256
dd7f294b743779f888b9e4c38b644ae5641db6a756cd7debe2a78fd155ad7639

SHA512
bcac3871c5041720a798a0bacfdb41143aff806927e46b0d12c1a1e8f06a22d8430c8882b70b2792c53ecb77e9a45e26369b5f47a8a2f332fa66b06127ce1eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1632ebba12362341d452c18f5feda6a

SHA1
a513b8381b2a2e705e574c2ed7863db39d50c43e

SHA256
f465ff8641233bc7f45923fa97ef65ae1f345f4cd2a3e75c6475d3554894f43c

SHA512
ba8484561802d1a558e7e36bd86e2afc09a2df3c5e6058fa26d747d152f613d77141c8251cdf6c4a33e37bbcba2ae3087b2e211cb2f3f8f31bb5939cc8f9d2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9023834074fcb89c50a195871bd05a48

SHA1
a5bf92a35cdae226da062cda7b84ddbdf26eb684

SHA256
2f1ffd7b0ca888849134ed1e7d29b8c251f4b45cd6c2761019fe13c821b94cce

SHA512
f6c15b1e89e89ae985213dbada23b00957f7837dbe5443438a7cbe4eff3889c08a5f61616d3a526606a10834bc48d53150df131eb499d629742ad5e0ec437e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5a3790e907f2507818ac0fe35e81f68

SHA1
e6b5f198b5241a01407919f5b710dbb7c446a461

SHA256
1952ddcea17a9cf6c9df3828b6885377fa13ff21337c091a79cf33bf69e9252e

SHA512
81a3bc359fa497f85ca563f89e18ff91517b78d65da5052cc36d6c52dd05825bc7dcf9ddf79a9de244b9ba9e40aea29f46fe00a5269342c2b5fe375dbbfb707b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5731267150551af93ae17f435cb735

SHA1
01da606c04849abefdf65a24fee8b11c37f56893

SHA256
98a857904bf6007789e34b5096a2b63e91576cdcce4edabaee2ba9fb078e03d4

SHA512
2cfa082afd109718abba89e52216664a696428a6a6eed02435c8a6da7945d9c482a7b4b9f16cae9b96502d203c3f29917462482bf39f66016f931e6f0e81f150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d292509c8dc78546aca791b6eff96e3

SHA1
3bfb1ee39645cc5cfcfa6c81bad0ad8c8ed0e93b

SHA256
ed45a71d93a4900166fe6e1547a491f095cd7c0db3dbcb5888c23712818a0401

SHA512
d06fbc9a5efe37cf069e2cceac7e953eb21843e2c90c3ff164df626d13d748c7ed5a86fd2adb8d93cae5644ac329da3e54f5c40f15b49c08015a5dc29522e762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff1294b60b6e91d4f81a66aabc457f9

SHA1
5ae9158e1d22b22063e87183bcbf37a4ebd951fa

SHA256
1bd6fd64841d01770aeab224e65709afd1bfab7cfa7f888c9c111e16cdd2c0cc

SHA512
50062fb0f7e407954f44c528825c143e142c6b6738c2abcf9e7f7e1061075358c2e9d0601f850f366646645cea493fa5edccdcd33a860c5b2ac4ab3ee671ca77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86937d359bb5be7b2597698e1d05c367

SHA1
6d5e8e6a9f4e0da2e39753790034191980f6b987

SHA256
d9e615d483f013f2eadf491888f76c6229a5594e40be94fad8964b0dcfe98e99

SHA512
b7653c31e2f1441d48a6c5789b315e8514040034b701171342441f3393070321d2230a616266263fadbedcfda5133ff1eeac5845cec62ecf6a8c27f29b73be71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb2f4bc7782b942010b4f33a05bf0514

SHA1
5ce121db0d2f307ad5aa68b70d41872c20761eaf

SHA256
11f618eba9843dad5609ce8288f2f4e5513ecdc3195aeda1b916e38a6b6e33d2

SHA512
03dffcb862a4f9925183c212f4a4a286de7936de515a3a45f1b4af652269cd2f6364b50999994ca64db1579439820efed75a828dce5fd4c3b095a274b0fde433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dc73d4ea7552bb739b759e29d9f248d

SHA1
ebd583b291ab8108044a809026b02d16d495e02f

SHA256
367632bb10946e174d2fdac0f97652568bd252c6687e27a61d758f2c8e071ebb

SHA512
ea63043b3acda7c969cf8a3a58d6171747c29145be2bd9ef2654d687689d5a834b1ae176e09169da87ef34bd76cfd8439e3e2dffb5e90a8bdf374c694b3372ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b6eb902e47d473353c5a2e01c8f1e86

SHA1
f9ae6044d8f175e0929c45024265b6b5d9c1b370

SHA256
e9fbed296a0f1a994436ffee7e46387d643d23019b412a9e39dc879d2982984e

SHA512
1d16143cc2aea3e62f9794777311cb75b15f5db6cc9ca500747ec6a69aa31bd445ef32041f519480116b31ce13d8b40649f44436d53784db65d80a37d541e504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c7db2c1110647a400cd0b50dab01dfe

SHA1
860a980f032e9d7811e347d5f8951dd3693e74a2

SHA256
e8ebc02e2d26f938eb548cb957e4087db3041a29b2bb1947ad673bf16b083c2a

SHA512
839006d2927b62adba80d11bb8a533d912c3679023891d37a3aefd7e2c8c55ad6a1cfb12255072878443da4caac30616c009d81c1bb920ec855e1679fcff5c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a1d8939d5cf7dc50e2dc704ff373dcb

SHA1
601c497ba99b795a768327fdb144349c82ce3499

SHA256
8fa7fac87a363aea7e1400a644ac0b2080493d2d6811b7ad6fcc576783e9e8f5

SHA512
1752b4763a9aa654af55a323d5755a211b5d838994da088543746a10575cf744106b5b907ef5030cd117fe1e4233de43ad7e27249d45f5c011b9d319b7c40dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
431a9509b43c57e923c3f3f00618d0cd

SHA1
8e7db175612792e2662e425d7702bd30dadabb1e

SHA256
24dc76a7ba338b643fafe9c8aad80235266f121ee19fd6fd28af48dfde197323

SHA512
665021f9cf81d2b5c6d876a76f3265f11124c6746358a5ba90199ca1c70ecb3c90b542bf805b8e164b42a41f850241b5e99d45f2fd7332f5ab965e1062d40674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d0097ab6e7c870e90f9805f0881ab9

SHA1
2e94e5f696d7879f7259ca0d1a8b43a8d87fe685

SHA256
7dea80ccfe601acbf9d9cc5472bd3363e491eb38920093d05599dab7dd992814

SHA512
456ba4c5aba63113eb42862c657e9e94e3380ccc64cfbc89225db56b93232fb792e0b0d7bf300618f20c0cf3a2dc0dc6800b076251b2081ac2fa41a2f632a18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12A8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1319.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit