91ed7770083044eb130bf69994c1b327d5d59e4a093b8fbd9fa2a74d8d4f5711

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

214b4c5fbbde4d344072980e14a0b31a
SHA1

2b7ea6f9f996d85c95ab20492fba0d93ec28bb3a
SHA256

0c63a5dc37cc5e4d4aed8411cea176b807329fd4ba3c11bcaa1a65c170b6174e
SHA512

04c925596a1c1b9b1c8c82b44ad23728bf61085dd20d763ed71fc0db4883afccb2c0a6fd105a692be8a0878303cb8953e593f657505f803ee510c7c38d83d6b3
SSDEEP

3072:SAUS8Y9XR1aNyfkMY+BES09JXAnyrZalI+YQ:SAXl1sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422878163"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADBE3001-1B43-11EF-BD6B-4E7248FDA7F2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28
PID 2100 wrote to memory of 2152	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4329855eedb384cb8bd1f5c59cf91ee8

SHA1
62a265b28abd86bda34efc2c0f01567a92f61380

SHA256
ab60e904e496701b9135775961b2505514243c473e45f13708d6ac554df65223

SHA512
94f29968c25af4fe112f4b790bf1940bd441fa67d2c7878d331f488f7fec696656a9bdcf039566ae4c95f9ea9e5509b7d6ff998398a1c6910c97e54e52db02e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6695f487300928e71a94c4802db028e7

SHA1
1e3332ae011bf4d461afcb630fd2dc33ca470dd1

SHA256
f52fef5a626c22af502b747adacc25a9027749bd8474db3e6e3eaf414304fb4a

SHA512
bf4505263c2db899fc8eef367e67c97f8bb07484178250946db5f17dff046d63a7688625f3ada973eea7c5e1d911b7b2d9d5e30ff4dc95b67a70bafb9bcc99dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2f46f6cce6f17abf6e322a195763438

SHA1
60497cab13a37ff5b9f2babb4249e464a063fbc9

SHA256
743582b4b5ab318f9e631c8554edc4bceba0b75a0537ef4d95d096a1b970f436

SHA512
37b280f33eed16b7e011b6e98ff1a322abd977b838519388324bb699746e1f63b7394255b6f7a740f3002c6b3d8c7c8aa097120094a6b5b654f8afac054ecb93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac72ef277073179e941f10f3f02df0d

SHA1
e3b0e6bc58cb4d9de4d558874bb257a18c2bf2f4

SHA256
1a094a6ae000c8b1b2f86d23a846475d1928a54cc624c36104d78faf7f2ec05a

SHA512
449d0353452f451d1fbf90af837cba6e01d36efff4eb89db8a31e1f8dd920be97ced51e43a7b06ebafba087bd5629e01bff2ca2a271baf155a60c0f5940f6271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
251aba4f42bbbfcb43f361c047f2ace1

SHA1
8bd566655c0ad18c85db9bf012ad36550d0674c8

SHA256
fdc06d31758a132efe18903c40bc972ddc8663cff316ec406771b6f2e5d25a44

SHA512
d046b362487974db4ec9aaefdbf2c228cee226da091a0b0e589f2de3944b65cba46af65709beb04a6586aa82ad57df89e8ea40245826df12fa7a8f52ed46115b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6c63f1229e37a50c9ee6ae10ce5b8c4

SHA1
af735f1debff761fa416d92ccf112aa5eec7f116

SHA256
d4e6fd45dd67ed2872e7faab0dca14ce45b8bdd30a59b3b305224c3a895df8f2

SHA512
b15d4e88cdc2ea59a431f04c5148a4648386e0ab69d8110e111e04957a09d8584dd898b214e987af1193c00b6d699fa3badc9246021ea962e23a6fee00cba506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a208b9a775e42e0c7c5a36fa9e581b9

SHA1
bb61035b563d6c0534a1ce201aaf2ee3f773dc66

SHA256
d67e16acfc98b6ed1ceb1b5ffdbb90f3c50da4d57d65fe45d89c93f6ef3a7703

SHA512
3fb37eb3130775b44cb116d469f55b513f4b01603b4b02b88b0f7930450dc8ca9314eaa3d9be30e0f7ab159b47379ec243f6acace729d09af717d7c8905b1720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d13c85ec3d985a76860248f5c822fc3a

SHA1
6b91e7267d5955b4c42160fa20b823b43bca13a6

SHA256
1f6ee32432732129374064cda9b6cc61d4a4351c33e966e8290cef4cf743a493

SHA512
b158a244c7fedbdd259bc1338cfd450f4f801e4a9b3e60f78ed41a9edd936f2c5ff44c8933601d84557b56c17457c39f9c5c0f2884d4ded91aeb875258247ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
819db9440f2d5da92603c1360917ced7

SHA1
ea562329cf01301c4fc88eb938476d3a80da295d

SHA256
8ed5267926440897280ba6627f8b5849c54f74290dd1c3c9a4ac53b736b94d31

SHA512
3336999358d27214a3ae7dad0ec45c5e2b7d0b758a067e235aab9bcd5aeeb23d915f6dc7d1e7218d640fdf3fc948f1139276aff5087ff7d23af38e85ddeb31d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c33874692be37b9fd0a580ea783fb7d

SHA1
d74f43604df5c50970f83a51ebb45a5d0f26da87

SHA256
84075544853d2325b19c8202d8e1a2b142ec1bef263a317ee0531691b8ecea60

SHA512
5cfb1ef8b992fe7c02652f7eda28d95bc1a058cccb9b2071b76a699d1754176c4e6a34f8ef82d21eda2aa8bc6fcf922601a5a625202b1d4420dbe528851a8703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04808e9264b2a0487efe5d12d85a4b13

SHA1
9ba151d9b5cd1a454a4839959e531f314a5a3a90

SHA256
11fe68470234a28fe4d286ed666715a183c3e25924fa6cb1d961878589fb0161

SHA512
daf67231eefc35b1b15c696481d32c2d5a765c1f9e99569ad1a122d33b4f84c77b4738883c4cb3ac66d2ceb980d43fee827ea00a1633496f1470479d61ead339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06453b6384cb36bd5fcb84312e47c738

SHA1
c480c672effcdafae00ad05f9c9c733a6ac0d4e4

SHA256
9aaad82e35b742f6f08ac7118d978cf2384bf94842a95b3af9ae9e9d747f7bf4

SHA512
83b39b4f3179f3b2d478798b67fa0e59dc3703dcda48cda87d612f2abc4c823873ad4df9685bd238fb9a8d5e73b94191f9a4b0a43b24a509efa75a944d828e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a0b8b4e25230846302098e9c6f6af48

SHA1
6c600a890ea04d9abe4fb605cae1501c7b8361a2

SHA256
65d4df14348781dc7f2add718e552694e75ad93c2e43306e143b44a3bd13b5fc

SHA512
99563b79eed15b36bb8741e2b1962d8cefd2836e26dbeec58cddd21954617b58a40493d102cd721d228627e32301f11659a8d97da85d69e7c3db689ea53ea4ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e6c06338325198a2d1d9fc1486ed2d

SHA1
5a8bcb43cc51b2e9f4c9e8abd45709229b742732

SHA256
5b203332093893014e4ee111272efb79de84ce1bb900435093d3fe623b9b8a59

SHA512
46fb5c40f0153320a53dd321dbf713bf5efcf23d43b49c3246afc60179836b9a1ef6cd683cf04d24ff31a377ca90a86d0dbe16f1c2a87a4184bde2384d7a9a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5dcb547cad659fe60d9205aca13d9e9

SHA1
abd327574afd3cb155e896467a06f01e29c14763

SHA256
3407d052eb21ea0e3b94fec4f1f02496748af19f3672186de445a328d517a5b9

SHA512
153626b2a82350fceb79bf01743dc1348c49ad8ee498b7d311ca730d9046c551562ad9cf33adb770d7ad3f99c10fe5d9503f0a2f7f4c93aace8c7d5597f42b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1888c39fea58b416dd355296487afef

SHA1
32ad6dc97ad36e62b8defd891850c3cb9fd18bf3

SHA256
c9600c25c6f31cd882ae2e7b7b92b1e7ca3c4de09566a9d32bea673ce0e24f27

SHA512
94a753d322455731d934a51ac664da7aa9002aedeebdffe8f26bfb1ed0871505896d4313fe23e331de86db84fa776c72c618e70020fde2dc492af5dbf4e47415

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1566.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15B7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit