7e18adc9c6d0346d6754f6129050796f813b504c2876dfbb16531a3918cd1743

Analysis

max time kernel
137s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

5fd07065a2fd5d4ca7e8d13ef780123d
SHA1

d3934204ebe43f3ee37f952fd9ed01b075561490
SHA256

f15d4211b88017114cb1abb19e4d44688df55f7791ce9908cf9b0b7572aa1c84
SHA512

c1a0f3b1a13dcdec9acf35013713a62aa85312aef46d044254e012acc843ad2d6a13fd8d42caae8c1ed05ee17b9870a93dbbe5e4da8fa15c43b7faa0816e5b09
SSDEEP

3072:Sh40y4eQn+IpyfkMY+BES09JXAnyrZalI+YQ:ShNhMsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9057881-1E0E-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423185364"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1960	2896	iexplore.exe	28
PID 2896 wrote to memory of 1960	2896	iexplore.exe	28
PID 2896 wrote to memory of 1960	2896	iexplore.exe	28
PID 2896 wrote to memory of 1960	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc1d7d5e875604ca046e46803d901f4e

SHA1
50ab952984bf3e55d88b67e30a4dd520c5d127e5

SHA256
eb3249395578179f4444abc16d51e874cdc56072474f129a3b28df5c3c9cc122

SHA512
07aab95abae14b9b3d5321d8c4478e4bff0b3182888457e61e778f2fb76adb3d24c4b966d7db8735e251656ebe358fbd5d2a9c1d50165b5535250513d54d519a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
669bb92865b4c16a9582198e6df973da

SHA1
3ca4bef31af146d610872a7ab6e99ba2e10bb2d9

SHA256
78a5acbd8d7f5d3985cb9a8bed0d698de00fa298556f02a1ebe109bb96b5735e

SHA512
31478c3fbf59f03715a6d3c00b4c74e196e3e0a2e175dbd87b11bf34a5ee52675f96b895fd4ecace5fd34834473cbba01f327aac2fa76b0a974d22b1d07b0672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daba1dbd7c685bf362d6c01f83ee577e

SHA1
c837777da8b8bc50d0f6956785d46383101582b9

SHA256
4a2b5b56e7ab8714cc3af768862b9d4557b714a237a604311dba5c70f9f36cd8

SHA512
7f46d649eb17fa232fd28bf69c670311718b45ff6c125b7049d5f73eb2f1a0654f264083a9265747ef61fdcad44eca3e49cf8790fb0f569233757bf3c49fdb6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4686af06ab4ba99000fe1148e0baf7b

SHA1
95ba34988550ea4579ae564e74a9685807df981a

SHA256
e453adff2091f97654c5e10e2467600bbe519c5c7cab9fffbd13a55ab6ccc39f

SHA512
a72d9bf83a0060ac067e15eae4543a62e848dd8257bd986e9a1de5a3a2231ead47a533792bac4c335eeb6dadb3ef78a8a5344459cf6d73136e809343b40310e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
892f65653da905d899bdfc88e9fbfa5a

SHA1
76b6b14bacfcec08f9071f20c45c763f5f6fa1ba

SHA256
274b8fe38da21d3718acb2e31e0e0884a70e21ad424629f33e573dc6893860ac

SHA512
ce8050973edc93823f9950ab6a7f17e068ab364502d9cfe132b47bf2a61ab61f60890c4f8d307c5f5a7b59ffa0747be98ff42aaa003dc65cd67b421971ad1986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d822054916a2ed9bf98ed6648e23f9c

SHA1
03b59cd742a9ad8ee3b65faca77d8785ea5a0f89

SHA256
ecb4cc2714d129a884989e5a0fe7369d30200ab481565a0b55547d81639e9239

SHA512
f14b19c6bbf5716a7557fdc401e0535f925379b97690601ed92b5691be3f60c28a9d5941033bf0c2dc02fb0e952143316163dfa756e2ad5709d726153e02abe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9a2b3a6c25f984ef84c97babe36ebe5

SHA1
c57629f4e8834c5b79f7ab629e7567e6238a9a84

SHA256
a3c61c2729af4dc1fbae0e7a15e86ee67a107f6993d4741574b62b1251557498

SHA512
3c335b527dadc284843eed48fb65d42241d02a06cd54dea354a81ad4b959e1e4c2a541fa9453ba440aebde875d92dfdcb198f455f25cc2ae8a3b363ff3ca0234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80dcc524cf680ca2c1fd07d122131000

SHA1
cde9a5918d264879bbd393aaeae927423e493e90

SHA256
07f0d43ed2638d9deb704b276c97da962072a263f85dc0b83f1fb78c0eb5146c

SHA512
10d901f4a4985d43cdeb0d8d5627f9d1350f01c27209d8954d8fd42f714b43714a4f9174e4a5ec349e7351b59567c0875420ed0ffb50aaf7ca4410149c62255e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
211769857dd0d823505121304687f6e3

SHA1
2b900784b2d9c694ae5ec9b7ead06a48d9b6e452

SHA256
f031800c0a6bf5a390fc86fdc622dd0354e2e2c9090c3153709eedf5eca98cfb

SHA512
3b5cd08ff2772668b0406ecdb67a4924335572b21cca13aa48017cb332d20fc544b7e80666316086b8f1340490d9073623b8ec216ad164e7bc494bc2317b2778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
654e55dd489c01e12e13c8404ab825a4

SHA1
06e98f19575dcb96e1b9fdbd3934de21066ce31c

SHA256
2baa75787a546a2a340e3d43fc5972ee6b9387a3cdf91d631e372dcef10f8a7a

SHA512
895fa46927d3be9a6b5ed6191c187f8b6ed0811a815f2a8d3e29b12024c04181e77635be0233a263bed1e92c623295186356eb1a6eaae33dd8d967298bef925f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66fb317f17db9377969090f1edcbe83c

SHA1
cc97c0eb4173a24947954e5cb60c1e0e31c32207

SHA256
b262cd6bd1ad0ebd2309f8784f772fd354adaa58cb7ffd278942168b35137a8b

SHA512
8e16dcd5b8ca9e04513bd29a7e82d750732f3cb80d92b8bdb3751bfa466e98b0da97a4776864b5a5ac56997fcadae45c3b6774fa11dd56020a68e915c5633f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf3a9d5ab1c854c4ff8dfc33cf35752b

SHA1
f8d9b1f1f0d35a6fe5188f9866ef26bfd4279d19

SHA256
b203da47d887edfaaa5ade915200e0901337802e41c52ac5cdeb3fe6a3dad126

SHA512
c966f4ea435c70b2d9cad8c149d3c4ee6a58be4ce29596fece50c951045e3c496d5f7ea8d3cb38d0c41b3064b8fe505dec43517c8eff40784b5423b9e7b3fcee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7edbad4c4846e6e097d1b73186c1d0bb

SHA1
f421f9fa6fffea7e0323792110291bf3dc8aced0

SHA256
960fbecae4097437dabd3d2a088376bf3b0c01aec0150b72fa27d2fb521a8134

SHA512
a9f36be0295343e26de9d181afac1bcd0dac97047aaa8eb666bdf56d6154114b00d8098af8bf9d4df20ef38ad9c14cf881ea6ff575d0de585fe3c57cb816b4df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9afc302ac2ed598abaec18ae83d2bf3b

SHA1
6c109ab511724d1802e44d27cf00f904a0a5b75b

SHA256
766f715a767f8a24091f60fed0ece6fb08fee72231628598813496039c1d219c

SHA512
4a046452219e102cf5812d7a54201ceb8e60246d77810d49666c8f85bdb60039e61bb340f185999a427881574870722008cadc511e8c69322438bba2842f0c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
669e444a1d8f20e2de9052f0fb7e83e2

SHA1
560165b30f077941ab81b6d9d6e0f35594218130

SHA256
4d47dc6cf56a9957edec3e4cccef93ebf75add5e0b33135f64d54a46d3630862

SHA512
3109168f12b2e122a997e2e530cf112a52751bfa5cd5bb7cfe6f9c993b5101c0f74e8acf0c8a29a046eaa89b4de832c8dfd4590369971559855dbc5e0ffc8394

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab907E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9640.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit