627c68791371d17b7cd09f3414c15c7471c218928057115d1404ef4147c9af1b

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

4074a221a1f76ef8af6ac612fd3dcce5
SHA1

cce4315ea76a83c01fd1bc1b9aed35b3033d48a9
SHA256

f5b635dd2abe13b0a1341a01a1d836a2212100fe2a7eba7a0e25c29a2d8c658c
SHA512

fc332550185a7403c292625a8781310a8e8154b4a8082dba078770e2aaab474e105d70521df364dfbcdba05971a6c6f9c9cf1cf12ba80c92b474e44091c91eff
SSDEEP

3072:SMtqHTdKbTMIibZLgUV6AoyfkMY+BES09JXAnyrZalI+YQ:SMtqHJKPMFtLgRWsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E061E821-1BDA-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422943103"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014b16c7ea1f6e5253146b1870e1598c

SHA1
c04ca0718b7509104a1a85a8c226042544229aec

SHA256
101da07a7590218faa42364e9ce39c86d752a404ba77da53fab5bdd10464357d

SHA512
cb8076912d3bf4e2dad21e4f56e6f06e55e9555bd8de94aace305a9613afb2f48e1ec4a981fae4bf8a791d5569aaa2f35485d5b3a5ca886fe5ed548e1a58d592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95871411e551d41cdf8a9f7bbbd72d38

SHA1
3983e44ad4f88d6b5b6ad89771ebf950111dce79

SHA256
4dd13dfb725666a5526c30c4876ed1a6ed1214efdeb28ba0151cb87d2f0dfcb1

SHA512
90a1db9378f7baccd3aa7d2c6c9c8a2f09b91c02d70f0263471a16005c998b8fa7520415d026efd4a74f3ccdd1677fa4371d8e3d0160e8db3fc01503eceb3634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43415909f37e121531bd8c949a0b6705

SHA1
a2cf62035a757733075850a5d0558da746ec881e

SHA256
0a82d7bd12fc05e4d92f8b372bba3e0e4cb798159725569b43985e4f72342d96

SHA512
5096db4602391d03c707e27e84633fa5eb0d6039aeb22394e3f2c280adfcdc72e064b7ac04bee5877377d027b1050a25b6103dd7e9797f252015fcd25f616afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5996fe5d1f86bb4332dec5bef7ad26e1

SHA1
ed82930914ef75f378db9fc3f07686c88b95f15f

SHA256
ee4d9c8f4985bb3853e5b56d264be9449301df72af0efbbe4e4ef2bd8e73a53b

SHA512
78a98a5cd0134a79f36b961f2e001e43392b76b86bbd559c17cb741aea5bc32ba5561b2ba24b89092ff925156ecd292180a9d02873ab4fa965d8c457205dfc96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11297b5c85f69634b905b293e9386c76

SHA1
cb29cdff1d8fc3d3f7f604bb87990c6671f624be

SHA256
dd9f05bc73b1ac7a1cd007b55aaa0b3f0de5c2e56544ab42136b48f07b7946b7

SHA512
efc0560c79c8d4c98a279164e5ff0f959b0f6d56a7e18070299080910bc48da93df89822b9f0b68a9cf79b9c52aceb9aa93511ae4e4287ae7c8c685015a41d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d51aa3612a3b753313b4d77d3a575d

SHA1
fd20bd5655e6ce3a8f0f0ab4643b6583d0c19788

SHA256
bd2e7c6e8d0a2bcb19775f08d1f55051c87c4453c60bf9ea093be0e74093daa7

SHA512
766839a724d7377531bab2542d701fe3a56f49c30fdfef961ae53ed85fcf1609e93929d2b91f8ec92594aca93ab9c83906d6acde9f543b73eced42750ef38e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daa2d79e7caeb512ced8dac2cedb4356

SHA1
b4f8d7c5d3562bcbf562fe77c30c9bc610fffcf9

SHA256
f3008f767a7894f1659c5674b446dc72a18f75e0093d9e088f19f77001be4dac

SHA512
ba24630b2a3b608abf3f48854c3325b635986f0b869e4117b2143556560cbb1af12e392d83c07cdce15df6cb11879fee40bc0847dde1a9b5ce62d1309ce593fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4b5c9e5641961463e97d8d280055876

SHA1
f87b505c9dc81668b93c21f74f98b4e213d35008

SHA256
16cebd41a8842a85a4ef325419a26b53404fb024c6d10ce5481382cc971b469f

SHA512
314a88a3a303b46358c7f2c860df2a11081ec2df333ffd3b0b0cb3c8b4d8ed54df1c8808546e572cbf9871d0f190700a4c681845ca00d8c5cc0bed1fbe456f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21b3a4410b48fdd85a00f98919e71e40

SHA1
96e405922f69b4b1f38baf0bb44e645d3047b563

SHA256
56b97b99d307438359bc954ce69d1a6848861caaab20d1da1e1d4ca30f7b36a5

SHA512
98d61381465b7df4c07477607818ce5c7d57f8d54f01a9bb62e75e062f6c92bd4f8dec89afa07eec0ec6280bfbdeb6b7a8d3d49b53a360a62f4338f8d263f1d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c3b61523a8841cb4aaba56357feff1

SHA1
1468bd0913ef55b3bbd1c9bf3e02165f04f557f2

SHA256
ab61e478061c2c135e55abfe730026dd6e666ec788f48bf3e938d9611354129d

SHA512
fb42e2ed822fc9b611ca4b970e3e53ff074fcb64291fc73764f70df400f53f5d33f46f514333ec86f729e2d7ca507526f9c7e3c85a0d9b3d4ba4cc11c2dc8a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e0b12d9b24fa451bb0034196ce76242

SHA1
07c27da26addec6579fae6f0fc9f4c0b101ebe24

SHA256
35febd897fe2783fa0894d56a0cfbe98ca4c1be442e914227c1baa87102ff50d

SHA512
ef5c638d7a872b90fc2cb9608de2e6e977e99548ae2597914018375e890612a1ec57f451a6238137d4c68eb112f87819a14e66f0d5a55f6c069124889ab3dd62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8aa9816e074855000913de61eb11952

SHA1
4cbfa43ce37b706f6790fdb974b5cfb60158d07c

SHA256
968bf930b637fee4c65837d8889130beedc1201595df54b504b999da53ae5b2c

SHA512
156a49b3554af3e6f8a1788b7866d9a7ef822cdcadbb64ca6f24781e5793376e99cff9dbc7c033477cddaa3b628c32cf433f45fda1aa9b6d98aee74e42430822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f1b7c88a35595b8988f08cb62fcaad

SHA1
ae14e57b6efd2aa9252bd9d543141183230ec772

SHA256
68f1dbb9877aaa3c151b1c9a3634c1e76bbf091ac75082a2ca93df5458172e80

SHA512
178fbdb5217ba9d0e5cfb538d73553c370bd461a11e0be9bcaeed9f6c68421ac90bbf0ae62fef9249b32c07b37717fd6f887c615ce31ba8af4c3b4477e0c84de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3619c6173e0a69d3f62cbf7ed79e67e

SHA1
dd4d0394c031920329447e25de6d044fc1406d79

SHA256
ff22a141c34674900d5d9b1e5ddcbf8b60c23c9ae924b9015ef66b02ab4fd8a1

SHA512
ec2dbed218d0705154609a5b016a556278c88e5f4cb477794e0429bee6c23c4e06d9a1d6ac0a735aaa6f8d2f2c8fa77ee259ba473d13baf9955c3c0bae1c81ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaba76729ed75a7727b89c638dd4e673

SHA1
0805ba44028082f5d90e6973be1a1908fa5078e0

SHA256
a8a075691030f666262c5fcc814a2bbf20a3c67eddf383444c8bf96872b06318

SHA512
271ed2e4a0111f0ab8b83fe2a02e992716fa0fa6f797d3b66b87276696befd5d5d93cc605ffbc899e6014ef77ad366153785133d0aaff71977ad2b21c68fd3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aafa6ff01a8e6d23ee485abf53c2f6b

SHA1
ba227fdf05d54abe55e9c7dd67c6e3002f5f7f44

SHA256
beeb2de542650ffd791bcdf7ac03dc08701cf9e5fbcca702a743df7340964ec6

SHA512
16975b15dca10fbe7a6296e08e84326a9b6c4e915a6ba7fe1eca2d69286f0281a406982d62649becc88311f382a222d02c161139d0cf054f3b29eea77598a26f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b3ff4b2491163b1419732c6ddf84723

SHA1
ec0f59b72355c16b1be1487cf5847ee75d9627c0

SHA256
b39a96b9cb87c6fb4ffe3f7b99ffa75a4d775f5d80fba9d8ee5bc30a0d580ea4

SHA512
278676a859273bd65d40c84d88eeef96257f440b8a86ccdfd3e7515a608d20687654b47cd6d6ea84de20da4d8e4e0d6e847280a5342575a5e4b51818d06241e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e223e4ae2c2be99dfa6979dacda21cd6

SHA1
0a0dfadaa60b2db18473173c933fba60c92953a0

SHA256
a07442aa1df672718c02aee44539f77e817f58e46189587e3e717bb788964b88

SHA512
013bb0f3f22c06133f5a5025c2f9f301259ea888a6d278809c36d69b1f5f2521c6c0176d960f72f1f42d07f0280ad8375f6cd958cdb66f4ca17884de55fec1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d94f032d3c5477f87b16f810baa868e2

SHA1
ac9cdfa4fd5e69111d3088ebf41959af83b77b6b

SHA256
a6566f042df6995774e533712c91a1b6b26d50c081ba862888ece31278cfd1ed

SHA512
be46feea1015428bea5fc057838985fb5ea86e2330d628a108169c3a7146e26f6c755ea71694aa57a11bf7fff5693a0f081b41ffd331143eea4c380a65b075b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF20.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit