287e28b199a3678d8987f6ecb6e9c578b4332e33e5e215c534216240e812a8b0

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

27396602698fea67f269a3137ac4ef09
SHA1

1007eec3ad87c1817340bbf3e4cf46846328483a
SHA256

6f03a7fdc2c9ba1e862cf88658db6af3ebc56f7f44d7d22d9a350edbc202daea
SHA512

9da5523daa00cb12f55a3d65e3d8b755bce2d710f55a4748ecbf8d5de7c337ea73e79392c263e6d55250270621d3d83c5c8ce8f0a51a4038782e832762f49275
SSDEEP

3072:SvwXuSQxfasdj6yfkMY+BES09JXAnyrZalI+YQ:SvUcjfsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F530221-1C75-11EF-8D12-66A5A0AB388F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423009538"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28
PID 836 wrote to memory of 2372	836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437b540c1b501e37a516dbe045d2b331

SHA1
8ce80d60b4b901bccffd8698befaf9f37a8c8849

SHA256
51da988ad255bc60783cc9a184a01efe97f32b4d164e0572849e4dcff4cc1805

SHA512
63aacf13f75eb82c70e977679432149ed8db7aafac34cd36cac8620a17f4d33ec0d190237b91bc8290aefaaf38a4136b6d8d9d96144a5085e6b71930484c49c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc001c391cccf544e6bd522f6d59cb9

SHA1
e151becbccad33ccdcb886b5c0f306eaf1731593

SHA256
1c9c5e05b8f8271d6adf0b17efa0fe007fb1ec863ffb1b25f624e33dc3a32217

SHA512
b0f526688a3d09e7513efc40d785de6da4aa734b8d720f7bcfa0d9d3ca95e5839fa3e0c948df8ba88b4661d9f4835fd9279ce20b6e4975a8f685f1be3c1fbd5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1a2634dc573b71af067c39bcd5a62e5

SHA1
589fb9a140375b52f7d4fe618878eb2a67f3b1aa

SHA256
5051981e7af515a304d8a7b69eccd3068524b90f4a3e2bc082c74f5f85e26afb

SHA512
8c4653c576f84c28f29228b9151b36c8f9a544245c2f9c7a8df6d63602530065f4976aec5e73a80bc845b2f266065a675f29b7fe19b0cdb7355bf3ad61284913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cefe234fe1a4e69f67370c67dd9c9ba

SHA1
41711a45c5c7af864a0c6c596c9c006985264f2c

SHA256
7d24e4c025a57d5aa24a47c7b65a7548d06f12ac5594246603c7ac3c6469c2c1

SHA512
8d4ffefdee01184603bdf786d2b144235cc6129fa09ce4223b0f307264f79ada5919c79840f6bd968947539752e06e9e787b9ffc1c33a8f356358d54d1c814a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5effb0fc935cc01679246bbae394fe2

SHA1
4f8bc2a762f2b200eb60b15c6b92e1c3c7fcc11b

SHA256
e286eacc253d09a6d2f9b99eebeceb17cbd40a34b3a65b79e0de13e7afad3141

SHA512
dbd799b52b0ccc9725a0814d9ffb4d9a237d4ca353872c3ac413ae950a5de1bb770f3cee7aa3902489a42c054c2033897803d16516b989a4acebc33b0987ecd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
093d894576d8a42c8ff2e67ee1b17588

SHA1
ea4e73991543488e1829fab1476177dd47c52bdc

SHA256
5f73ea63ab4f288544ff2b3ea534dbe01cd9e15dec62c174463e2e7bc46e96d8

SHA512
ae0b9a940e2dc94f923b44861339aa95006e49c52f493d88a34055052cc837bcf9da32e6237796ebb1c7e992a0a3a1ecdf65148d4faf1bbaa49f82a646011f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea40f8edd07d60f29172f51b62280652

SHA1
0145eb5737240308cc587fdcf4a573ff5806e765

SHA256
61945d64613eb7f97fbe61a300c2a0b80a27a2f0a3cdab8ced747f1594122c50

SHA512
ff0489c56aec741c1603594c20b65c5faac9eb6d263afbc9e7cbd0cf696b6078544793946b549f6a7058c337e1f2db6808388c3f63ea6f3c4ad270dc50e8d169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8845835cc2f3c2ebab8474aec2c581a

SHA1
5565ff9c8999f4ee8f0f21a0083462b14c8929ef

SHA256
0b878a53e80bd3cfb52092d544953e3067ba00b91e3d161b7b26186c43ef9845

SHA512
3ff9948a5dc5f3028bdf18fd9c9be0ebecaf7da87041e33e24e7284ad6c5200dc2b030fb446a65c5e528c499e1da5a771e2a0ecc9b0ef7334fc3366b0732bec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac2da9b41c806cee2213f437957b4177

SHA1
d5631060abe7680cbc3dace8968875404996e0ca

SHA256
444c865a80de83590e5cecd4eab0071204bf1b79c5004ea066f0b4d93b88ef72

SHA512
8dc6a28f27353c40eb486d1573a88df24a70f0d319d0f1912f5efedde9261ed5deed68c12ab9699fc9577c19a880123fdfbef42c5d399919c1c2298e955e2911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
198def2b68121932cf85c645c2211ea7

SHA1
80bc57503dbbc02de45f2ede14894eca429ac727

SHA256
00a9bba15e4640a1e33f9482c74ccce78bb6dad8ad4adba6f5b7f9702e24a9a1

SHA512
470d9a9eccb58a43f342c99ab1da5ace1701a79ab4ec8a243f58a1cd7559ff2faf64145d6d3f9b20371066e4efa856551150d69be04e82c68214e08cf509633f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
594e613500cb314b10135478c73efb18

SHA1
e4b9c8fff56d0662cf91d11aff163d5458a0390c

SHA256
33400dbf1175924346bf4f9dc8b79ba66172e31782731a23541062610d570e90

SHA512
f0a9ecffddc75218af2f963a636842ad9a2c65c30df332a2f9ea90322cb98e51a9c3a944320c8cce2912fe599ed6359f71f5f5935a6c460a041b340837fe36b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05040b92b400be110e8d6380e9b9357d

SHA1
18c7e94813ed3cae078f863cd510c005e909716d

SHA256
06cbf87bde348ed2d6b9f9123553ae534b3d1e628e6660603ae817f79d675df6

SHA512
2db57b2a9ca01492c875e89198b2917e3f12a4d59207ead134e60067fdc5e499be5f3bc13502bd5aae6ac0c23165d9b4df039eee00ca2e2b99f8389bb7f1b181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8263c7081c5aaa0dc9bb89dae87b461

SHA1
2ede61f451a805f579af9fa34f7226f21beab299

SHA256
0feb003fc6569cdf143b9fd9d6e3934503cea9c5bb581edfda0c601db5895a3a

SHA512
30399e5a055c5ab80aea7de359e532ff7598348fdd7d1cd6d376fc40a94d396cd63aef68a8eb91528704cdf9bf3ccd403d787dd20ad0652102938b77560df5db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f63296577ba3e610710f78f825f2c83

SHA1
4c34298a293a93c6899e5f81cfec9d4b1c4abfe8

SHA256
3e3235a77f5c380c2342ab52e7ca13a3d0d368e67d000b723b74204ce869d829

SHA512
e9a8bf302bf346d0cc0eaff3d9fb0b0a4dd1ba9a822ebeedbffa8faccaf605a5049a3cb74e90bdd9800cf5d515d9987b325dc0f4490ae4f3272fa7e145b3767c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7f7f436ec88f7d35cf93ff7e5f89b86

SHA1
087b0e71f0c72d442c97b05be5fbbb6515e170fd

SHA256
0816506e2f7fc4698448fdc2daef794b866ff3b1404f956a539aa30a5c837f6d

SHA512
8c2fb6038415dbacf2e79c45a9f47e0833cfece8690cd45c36a24f340e4635d2c472c048368f6bf1c1d3f13b70848e8d4b97ac358b7818d2f45579b1ba9572a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1ED8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F49.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit