afbd33b0a191f151554fea958d1f1fa0b681064cc8178fd04d296f1fcafb920d

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

33d82f872ca4cc55606785846a5824c8
SHA1

d6369322608adf703a53aa7f1c4c6016f36089b0
SHA256

ced9795bdeb88cbc4dee6eb8299fdc5488be96de9ed7bf6b7d9bd298f93896c1
SHA512

79333ebd509d10d14b2168d5b8cdcb8bf87fc22fd952217f426cf91627f400cbc384c50df71003520ff83f9b5220cde831eb561580dd1fc3bf6655616b4200fd
SSDEEP

3072:ST0qz5ThhlR0yfkMY+BES09JXAnyrZalI+YQ:S4mn5sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3B9E5F1-1CF8-11EF-A4A3-CE86F81DDAFE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423065891"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1012	iexplore.exe
1012	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1988	1012	iexplore.exe	28
PID 1012 wrote to memory of 1988	1012	iexplore.exe	28
PID 1012 wrote to memory of 1988	1012	iexplore.exe	28
PID 1012 wrote to memory of 1988	1012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a3a85c81bb95d9f90317c989dd2588b

SHA1
45042f554c98dcd2493c1fad69758aae7ec0831f

SHA256
0c224f4a715927bf72c188449b373b9d4dda1bc7cdb71c9569c0e9b3f94137df

SHA512
fc8b65f7f1cebe36f2a64a0022d2fe3fa0584924bf4fef3c5aedec6bc06dfd1d37466dba547a0b9c8739c18bb4f4066f84d8b3443c6fd934b6a1b48542e95f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff5df16ff727923ae0b981692f97c00

SHA1
fc9d39b3045ce94044c6c861f56a82cba79d66ed

SHA256
efd3513fd02a21818cfbeb84b117e20097cc4b8fbcfb1f04788ca64710bd4f0e

SHA512
55ba87fb659e437103510c695e3740a4afe84f94ae55300286a14c0eaa99e680c92110f80a6488e0c305117a7b3417ade584bf56428459de6b2e346b8ab2a116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a58860fea2d4244210fd1743e08d7ee

SHA1
d9e236d2e9e5f3b1d013d0ecb53ff54ebb7240cc

SHA256
7983b6704a13b2113236bd2173426ab74e71b8e38916f4bc4cb9936b492fb51d

SHA512
e964a57cc4c2b346176fea20c40cf79d7b59072cc48143ca4724c2b8d7f02c18455b61a5015f602be496c6967d25eff19917492125bf7a88a887347f5b8e9a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e826910746173a35f12410922da44b8

SHA1
8a646391d48443bcbef636991117b73462c5ecb8

SHA256
8463dadf7baf4842dd0557869ce8a3e8e80edb9583ecc66a4207ef63b20ed571

SHA512
ce8fdf12fae40e5a7df70ea126c089634186d4f0cda6ce6453a34dc5a7f32a9e500df22c52b702badcbce19c25066a8c67c900ccc20663216edf0b2cd9445a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a4f4663538488670afaa1410a11f1c

SHA1
255a21d2e9ce800386840c6f0da716550a3b1d3a

SHA256
ed465cf2490e68747d59ca5f0d0f090e03129d69d92030229e83c6d5a54e4216

SHA512
96862440ade641f9f76b1a8fc7fa8fb0463ff375e529b91f5b1aeb65ffc7c1b853f9f7584e6239544506a1902aa6c2f144a17e29e3780803a2c27d5f38745a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8b25d92c799c17d65aba6af645ab66b

SHA1
6629225f614cbb3aa22fa1e8cad9ff9176762d8b

SHA256
baf20effef5e01f26e38d0693288ee6836a20604894237e113dac05c1ff91878

SHA512
7805c9391aa3a3c51e45b486d47764cb6fe4c3a09d84328208b3db4b7ca36e4c9f3528e937ae2e98b73e7bf1a56af315ebd46012fc565aefe64ed88c66eac901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc79c909fa03500586d7a99a67e0eee

SHA1
8b942233f4c3da61302ff6a3ba052e3160b07811

SHA256
357c256a5ca9c226098be1e1f731b8631a26d71280e8729b9317e6e4482f16c3

SHA512
58bc52c3b13f194f7b4d3a1a53dcfc0e4e59014eec18f9ab0fd9b4a89edfb8f5f78799d679550eec247c5d2fac8d23c0950ab30d6a38931afacb92b68edc866a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf949d6abb5c6f742ed87faa43d8b5d0

SHA1
0336f8fb01a4a267f1ca49c0ff86f641e70a7d35

SHA256
f8e90b1153d8afa11358fd6aec92fb9a86b82dbcb3ab8a83463b12ecbf123825

SHA512
525e69e31b91fd8b9d0329eed6b8a3e3bb82c1dc5632f44c88a30707db9896cd6b991af73e68a8f89a9e2211fcff6c21687a032b337a97f909aaa24daaf49b86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7951ec494774567516ba0a29732d4cb2

SHA1
d65cc1c5736dec51466525235552febad2b5af25

SHA256
66fe694d5b1152f610fa6788015b8e8a273c312b0fb5f3cf0907af19d12b6429

SHA512
2191773198433e20027b585199dbc14799e230360a2655206dfa42db0c54ad9bf1912ab8f684a48c76724edd1aeedd73b1ba32ec45ae55c9129a7a66dcc59fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecb757ef424cbe3f765c10bfeab629b5

SHA1
3018d719787208ebda9e418e8dd7f428d680789c

SHA256
779c071d0725f2637076f67e6670508d62e4d96a9a09da44aec69b7081963e0a

SHA512
53662be96820233f42ff251b56b31daef2e10fa521d6d1470b8d693047d2cf5d0f81c5d2e74a6d74a4c3065babc94ff358cbc4f4b47730e155151a42ddaf9b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b63ef6af6f6a7efb1edb178424084a8a

SHA1
5f5c76b9935291d669da3b90c04325dd095b86cf

SHA256
230221daa0b7f87ca3766103177427afcf8ca68876e02ddde9ecccaad2bc7969

SHA512
9aaade96c954cf9cdf50b7eb921557b48e3d5f207e19ae4c7add39dc302105f9f27edeb3c4d82fba13c587454eb68dd55ab967da4e5dae5bbb70016653378a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7fb23cd4ec0471f34c76061f9bdad8c

SHA1
562473dcbce21107ef5784b1b593f27781cad9fb

SHA256
2677582040521788e25a65e31d5c6994e5a9749a96fddbe5bb09c56deff1d6f8

SHA512
fcc6ebbc1532d56b16e0732e6e9954fd8bd797d5b953f28013f28b6abcf97b47b03af67f6d543713b3d8fc364d5af82cf2ac13539543fb19cf6c2f98e94bc149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99a6c22d4ec06ec943d9e06997e0ab30

SHA1
4ea5b4dcb09baf361f94c3c837cd3b3c9c59eb8a

SHA256
2a4ed5174f64c861eac1cebfe1f173d20125821c87bbcee98c579c4b911d761a

SHA512
61c101d57936c868ea0b0fcab28738f69308b766890c215afb60f6b94866a79d1649046a3dfb28fc20ed38b158b8ed5fd4340511bde2f607b4e304074c88165f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bbeecd87928dcbb3bd2a0bffaf7a8e4

SHA1
784b4816d33d5993ad30e5f071cc195245427daa

SHA256
019b4aceb6473a7ffc7675ace05a9a90722190171ba7d146dea9b9d8d3552db8

SHA512
7274846fdf21838b9cb811c2ef049502d763a608c3dfd2974c8874c5ed6fd5ed95b74206205677de1ee297252167fd64db69a56056b2809a8b2dae11b7234a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ee5cf1c6d2f033d3e3b4243140f448

SHA1
989aa27a51012b16e40d69050b70558df1472c4f

SHA256
86d92ddc5ba0e630212a3b548ca326d8b7b2537039f38eb81ed8e0e5de4352f3

SHA512
7cf7592a33849af8e678c3d89f37b9f21a4be8d56433c150c71c988a442a5c1657caff45a56c164484f8d6d01d35ac9d655b9b3340a44bd1d1912c9a0398b5c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d3233296e8f699c41c542a52eb759a0

SHA1
ff4a24c245cff14187dd212f48bb130a7b493726

SHA256
d25e58d4b4c49ff7b51e96f4a820f081fa41cfb63ff7fff730569b06fd91d709

SHA512
ce75640dab7404e5023f55890113d1a77b287684e5824e810706c68717694cb11b5543a1d5e0ab364fab55f06940b1853d940cfd9501ccb0fe45727c02ef0c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb9eb3bce570090db69bb1db9cf6cc6

SHA1
640d1dd8e5169709e028280011140112e544fe33

SHA256
d3a67dc8d5c674de6dfe0c5f94affa404acd53f60e60a6bec7c60138defa9cfe

SHA512
2a7d3156da3ec1c41743d919b8b8d524d504bca5a4709f8d8fd9d75c8e21dd38ce17e3c8d1f3d2499d0b1768e34bd997ac97eb0a68064a039a8cdfbb5596d708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45f26968fe6b791dee9e49bec188328d

SHA1
e6c90f042a8618f1d99130b498ece9a303562f39

SHA256
7c969165f6d39f8aaf85eda6041aefd9b5b04e841b3d64c35c3fda441b9040d9

SHA512
05775c799fb4edc8f19b72fbbcff5de6b6cb9f670db80b7c728f3922ec5fe0a7b65f0b71715af3dbf65336e087d9fc40b8cfa5d1baa54b10f5ec563bfac3a849

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B50.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C41.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit