bebb17e956a17100998e6dcd3642adf2c5741e70e10eaf5a32aa3bdf257cdcba

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

5b3498e7f4729afe87ff0e9b4a0e31d6
SHA1

98cea6d4f0fce1aca1e5a0770cc38284cd776572
SHA256

d12a659a560b4d4100fac6b2a7634e4dc73f36a8c6a2781c0d20154de300ae43
SHA512

2cada85ad80611c54aaec68a7ce2211d6f3909ae84ddf48429b3410518558c56f7d2faadda8e264d970276aa0edca2d05d5a7529f186b373c0e3a055d6cfc40f
SSDEEP

3072:SUmC3kL/gCcTqmyfkMY+BES09JXAnyrZalI+YQ:SUs/swsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF712371-1C1C-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422971474"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28
PID 2984 wrote to memory of 2932	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9558709be1de3b868a37cf866f35d2d1

SHA1
0fa81a38a3f55e2446558e1834df60f849361a73

SHA256
dae7bb3e7743c04cae63ba116e915705c06a39de8f315763e8cff45a6882e1d3

SHA512
7141440341bbc409681d1ebb90ace868dabe8f0678f5b63b4d76c75e047791b6f7df5df8bd01b633a6ed8e1a8d1ba59e9d2b7c8379a90ceb31f0d5a4f4e97c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8039d9acc5d4dd912c4f048f82b9d225

SHA1
e3182120e55d0df389a9bde183787efd6b224198

SHA256
6761371550ff698a29e9e3613282da179ecb26891072b087997d5e9c03a273fe

SHA512
f2b88a5461f362dc42010a4cc7f52f36169ee56d40f576de886014dbd60caeb0f5a313c1b4a33a753905fedef752a5862204da5df7a3ebeefe90c11855801341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd8a64e818f5f23a3c468747d7a6b971

SHA1
b787128d92c45a494066220bcba7cf83765bf520

SHA256
2a3d0815e24767283c85c2a901c0529c12435f6126cb635602ab160e60b552e9

SHA512
6ed35d2b1f0018ebb1c22cac198ea6e25cf025ae37f482e0b8ad91eee32846adc79afb6b04ba8abe3af53398210b4ba834bacbbc5a3214a4ad1a984af8a739a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47b6caf14eb476ce5fdf243480ba32d7

SHA1
da2a1e0fd52780507886cc6ee5171ceb8dd0d54a

SHA256
c8b98eb4d769c852bd9a22bf89fff8cb54313f65deaab8bc0ba7b1c7a12d3245

SHA512
d454921d098215c49003ab29738acfb4bedf2c81697cdd654f7b7a27b509c57c48d8c74a8b25eaa4e2536e9b62070f96c181f1c66f1c40a598ac24c87ed0b0e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b77667b2480dbd235c31c6d4e02aa582

SHA1
9cc8dc62e9aac17439c0cbb1eea51cc15b04431b

SHA256
01d14623aae83a9a8a50964231a2661d85db2f70b018d517a9f7a7ae8278cf0d

SHA512
6cb6dffe1a61edfad5df170cd7b60d42fec32752a2287e320d41bc5024a13ebd4d9a62caa13e146a842690cee55aeb67e66870aeeab9499d52712a74c7b8dcf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cd1cf528ee3955a25ce9ca0f13aa239

SHA1
567cac4c21a92e453004a631ba9f54ea7b7beb30

SHA256
1d995be92c262f5a8830fa0acb10d46a6b3c43e2aea4922e80133be121dc8e10

SHA512
d9babdb2c4bfa387ff78b4916c93df2f77f02c5e55b5d1e30ab5abbf00c8a7953ab5fdc19e9becdc8455314e8662da1d67e87d61d533d456e8aa4cbf94f2876b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7182ba245abd58a34e15d84197356ca2

SHA1
73a76145069bc2e7eff49bf1a12ac31ee7ef0779

SHA256
9ed4e9ec81dfb91dd0cdd430ff67ea28a6ec694df6d3f495e5a3f0dbe2d9452d

SHA512
9b1eaa408dcd892af074041d64084db70eea2e014f7064a4c35b681efa1e26c7efaa4f9b7e2f6f78e27c000f69dbe84c8d288be441dfb321353458de79a513c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47a779d610eda531e51f9fa5340a359

SHA1
7a2b839e222e21a1c61603a758b1d4d86c29a559

SHA256
b5ba39310b78e7a4677030ae8b72eb27fccf36ea533a441db0f75d9b384480a6

SHA512
2af47c2ffb0eb9dc81faa1880140c589167b844fc9260256f92bebe7acebb4e42f0459591a3195dd2712c20c29e492d342ecaa09023f7f09b23ed7f1100024bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af464ed7e0666bca8ca839611844ac05

SHA1
f1289bc84b9904131a081a0704ed3062b2f81269

SHA256
ca80fb9e984f4a34720696c3617e0da3c0d2a2828b320740c32bab909216024f

SHA512
a7863a57e13571660a3e8ecdf3a614401c124c181d2335967d90a318c7cc226db2aa9a223860b6e36cf0ece564376809fd8820bdd884b5a234c5295a3459c91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0673905f7977d959b99a1d88d19204cf

SHA1
ed5782caccbd78073ec347a791fc858992d9eb2a

SHA256
737199000901da61a7dab82208e63ae1b073a5c28f9bafd71b1290f2e360e64b

SHA512
745a0fc2019a879ada07a1a281e25357a95c82c0bf31deb1ccceae3e4c0f29080ba7817cd72ec7eee07806e7ec4ab770186f2a3c036d412a72b87a17ddc775bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c462cd723c4fb83f780c5c4c41a98a3a

SHA1
1f602f664160585c37fe813885143a107c85bb20

SHA256
d40105309340cc08c762535c8f1b838e9a332ea64dcaf08ab62cf32cb4238309

SHA512
d5e178d4d3303fcd71e2649e56b51bcb1622b0c65b8976bbb8e1161756bc2ba70c2ed75bfd33c2fdbc4379907133d5571eae0d8ab7f0fa24c4f0c3e9e10015ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f2fb1f525e943aa3b1ad2d2e0ef1f6

SHA1
052093408f2febaf005eb1fb002661832aa93510

SHA256
c12950f57fecb461e54c60cb0eb7192f2c9307cabff4bb92734b8bf88655b874

SHA512
4316454b0b6fe711c3d5eed398628bbdc224c5b70fbf4ece2305610c3b48af490307fd2cea6715fa646653826ef1d18c625ed52a2582d1ef06be0704cc716241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
513fb82779f9a166821cd25fcc3d71db

SHA1
9770b417f4119ad99e7aeda322c619e8c1124a9b

SHA256
5b17c78fe56499e573168ddfefc40020a1c37d461fa9e708d0780f4a93481356

SHA512
99cf356ce98edd8ccd74fa38f03576a998d5ffbd649ff8145ce63a63a5c1e3106231d54c84d2f181795b94370a5853f0ee13f279411d7dbeea028e3e357b866b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8c8d13757fcc3a39563a4897c0584a

SHA1
70a52f74d526a810fa9a32328cee838970079480

SHA256
1502e622d6346f916a8899c5f192749ad710349252196ff40cbda9c2056e46cb

SHA512
a20bcdcca6a4fb1b4006f16e543f4f8c15c485478450bc9c45d07b048b1b8b0545a2f0af800ab6d1f57d0d08638e47e698fcb9d9ce5a1e6c42ddbac6bddf8b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07463938ac441f6c74f3f7bc1e4d33e6

SHA1
f760942044024feeb58784767ef8b64b0f2ba26a

SHA256
394bf8f8b4a91a09b28f69f10aeeb6eec8dafbb3411ce7319bbf37ed7a8a8b9c

SHA512
bff88443748b1584544ead581637d039b291f73dd062feaa9daeeffe2430fe001faec80d03bf8c328945160395174c8f9f76ba95fd9072ae9592aeb05ff6ed16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a28562a4f15acd7f481db692a58d0d33

SHA1
86cd5941b0fe622748d928fa77198be660ad8fd9

SHA256
e0f193a0684209664577289b1cb4718b96348181356e37739b929a5e2e611cc8

SHA512
9365bfd5c0e5ee15c05705c8de07554ef6580ba916300ebb67ea06da55da3bb56ea705a9ef03f2c5774f6997a424102edd987c6e74f3de9e8ba7769198d40fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68282a56bf1080d15172f0a53396176e

SHA1
face93b87f9072ab98e90afea6bfa470c25378f1

SHA256
4b9b9c78079440fad0952e7a8a0c5223fc1e5ad2706d68451d75955a852755c6

SHA512
7bae14519b0b9390cf3485639316df5cc53321cd8e41e9c6b2b1280135e32cf7bbf6cd289eccc8505810c7d6355ce7a7c0ad80fb4490fd27fef4536b8177ef79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bfdb9ec89a0ce96d3787eebcce8fa7f

SHA1
d105c5c3505612ff91b8edf10bb1a5c65b8c45fb

SHA256
f8a431655b03c59a5dc559ed8560d0511213a0864d45f945db2ca41ff19ab844

SHA512
1a07512903d1a9c9ed7e282f7331e56f19fcca93f3ece694c98b164a57e0c4f7ee51e6a5323c591d890221d3eac975ea19a1a60ae3a67713628e7e6d77b508f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CB6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D07.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit