ae4842efe84c3be0b50caad36a98db356566aa5603fdb3bad06abff4c2630563

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

24b9428f38fab6e52628e3b238082785
SHA1

978a8ccb6855becad46ac04db01313c57aa06e99
SHA256

4f3821fc5168653e825cf3f1b9b90b5ca9381ca579cc35e31672a935e1277be2
SHA512

875dc359d0e11e9ec271ecfa4a1f5aa7e79c15c0739e8c22e5cafa95cc138400f86c24216a106c2858d720cbe982ae905c5b8235664d463f2d5a86f414d0c8b8
SSDEEP

3072:S/qI+2ZrKUW9+xkyHyfkMY+BES09JXAnyrZalI+YQ:SSP2ZPWAVSsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DE34EA1-1D51-11EF-8E23-7EEA931DE775} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423103999"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2796	2864	iexplore.exe	28
PID 2864 wrote to memory of 2796	2864	iexplore.exe	28
PID 2864 wrote to memory of 2796	2864	iexplore.exe	28
PID 2864 wrote to memory of 2796	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6267fa0c7ea65c939de6f715855fe02

SHA1
99711ae2e89bb41eef5b53ed63b5e829e3b470be

SHA256
00a400ef468a207d00714d825a083ffc1542bb53cba38718df5c411a341ac580

SHA512
fe4f1a22e01168a0f861f2af561f74d244b411cedc9b7e5bfb31bca0ce96327b0eaf01dbe81e998000b81ba7f67f6f51d470ba19aca04db046d7aa4e3f46e28f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0551244010c92828302d7c8e5db8cc7a

SHA1
274f2e8edfbc672c91a3ce7a6cc549d391e6251e

SHA256
926e1bd069644beb746d78d9d60fd92f13fd16ca216ecec45953ed933debc60f

SHA512
1cbe30e7ea718373e3a374c9894fa35a25fc90dab393d8b6f21617ac80205bd800071c532f73bd8cc9006867195502491cdedba60c31d2ae31b2fdc2707cf89c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e42582d895ccf1be40e5f28c7b4d1065

SHA1
91e60ae0b725133a419fc99b9ef6789b92b1ff6d

SHA256
cd2ca79a7104aac15a6878d11a9d5edecadf1e1585b8fd311c9541c31b39963b

SHA512
21b62b66cef1fb4f3e46217bb8e2b999bcc59e63e94fd49e2a5857c0056cb0d3e56ac33fc38dfcecf2bb4573e25d3a22532bdad44571c4ce8391c4f22778e67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8f6604de63cec2a1788420a7081d9fa

SHA1
e26dc32e7982e13aa431ab8797f0a4a2af950689

SHA256
85bd575f9ba4fb962feabab48632477ec2cafca608d42532c3eec82179156422

SHA512
04801581b8381b19c3644aef6ac2b44585f1de9d9b17c153622fe42387c94362749530c664a18dce81ce3c532a55c88d00e87679838a46c5e76f88a9a8cbe07b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13b3ba9286a4feaa0c8cc45e444b8bda

SHA1
1b176871056e642f0c1c980f7a4d9f4a50b26de9

SHA256
36c9b0a04068ad01fa491ba4aecebafcbad87d8b4fa76aff91d9f9e4fb56786c

SHA512
f0497685da64a4f52308dbe6637df7c7d271eb4e5122e8d1c9654b1d42cbbf98d7217050db3d2f7488c2b59a68045ff83d71e7a6b4bef2902552a2688810f725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e204d5889189194c0539ea7a19ee7b3

SHA1
1ff8127dc139a8be4da7e828700c6d49684fc66a

SHA256
49393a50c0dfb6d1103df71fa274655d96ef583e2179b8b24f6ef975d441104d

SHA512
3ce106bdb06e73a11f515b44ee60ba8c8385d9ffe4398633c1a0a74ce6f27c1341359efc076a2439dc8d430e6f7c7c089c42cb860ade8e6b6725f0e14346a200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e951f8d471c97a6b6821e3d86b558f4

SHA1
3a7e7a9adce28b348b470584c5087da3f90c0fbe

SHA256
f857719ca3c08e064578ca19991e375cc7f7fe7219b70d8c79348888e14af91d

SHA512
f8a281892cfcdf954ea964d0597659975784224f18359dfac382e237451bfac423d6ddbe6128b4d5c384d449d5abbbaee8c15db50cd24251096e7493164dfc8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9387b5973feb93db8ed71fab90d62e5

SHA1
4495f5bc222e2965d9c6bec0f5eac651dd15d602

SHA256
2a62f81fdcd7278875b580ec402a675302371e76c9f9c69a5b60ce4ffc6a4fbb

SHA512
14773e98a5f3afe486883bdbd8aef9ceee70d5592467e5bd9ed704d6db9f9191414e55924111aea804778ed1368ed6e9738d00bae2c9ea75c91c48e6156ac370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca3231895f1953c0a368c8aa81d76b89

SHA1
ea4bc119c4d2e2ed1865fedb7ec7d821dbf1a78a

SHA256
9adb6ba7057d969a27825184b159e13670f03e9e4a289c985663044b87f857df

SHA512
e2d9611f47d5ee077656f576f51d4424e62c18aa046d714bdc45da04b12a0aaacd6cf469ae1251a5707449cb0b733b861e9f01843b3ee326bb5b3e54abe1c93a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e7d23fd77c0305dd599f2f51cb84d40

SHA1
40c50b21619352b50a391f6f1155535e9c458635

SHA256
80ab9ee53c86c24c6544281e3e9d9180904e1083fc3761a49d52fc621bde38b4

SHA512
58246441cc0c5754c04c2353dcaa22eb9d730cf0f1c219d2656127315119062d27fe79a60ccda30ffb90495f0b2e135660185797948b5a8dba56a2c0dd7afb88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df378bbb1617e053735a298de45bbef4

SHA1
328165469b2f9b9aaf955e7cc83f57f6b9541268

SHA256
7882c4cabfb4d6f4b6cbf498dec36a710a02d11a02159514f19a7fced9f257e2

SHA512
aad44c7cb0924f96ca5a5f7da9960e8ad41de1ee3bbb4f6783f55b9fb1af417b9ca591f80b4d8c4a85cbcf3f94f0585c84ef58135dd74c609d3e6d5001f82d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0cffc6cca01832d424ba521b9758210

SHA1
9502776f26ef0cfe200c2938c5555d2dc67ed18c

SHA256
4639c86bd99b9d4f7d511337ab39c8b347ed72f2502fee0ce69396ac3e1691a9

SHA512
d0cb303d0fab2fbefd0b89ecd24e6cc5143df281f932cb7f51e71eda4f8d601bc1b13b79787afba1130bb3fe89350331534b93a69ada07769226ba5096f13f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
632e97af1d38ffe416e94ed76d5ec6f5

SHA1
814189846494462d0f4e90f9049c917e372f528e

SHA256
d7ee7fd85df68500ae658c24c01af65c72c4474638d981ad4122a88d933ed75a

SHA512
8eaa60abf6896425458334bbf226b522c090455468d8854bc21f63f13914708222f25c109ec7450a861027fe927115ecd653122a1d601ac9e0fffd8cb591418c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37ef813e2b2d665107d2703f9bc19f36

SHA1
20c59d7cdb7fe13217673532254d5d6d9e7fd053

SHA256
00096badca42eb36771f65bb2b57c36d405b51696e5c4e0974e91bc6bc0c31c5

SHA512
8a3bdb1a910115708a19c9c0b9c62f38fc05bf35a9b033a899e7232a7d66e5392319f5eee24bdc2296267d9f2ee0e4c638a9f083637ef76e1a343593bbd3eac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78b3cbfd9684ab98fba2cf0d211d16b6

SHA1
113ec1e47796cd74e70c621c01018dec0057dc67

SHA256
43a4e543f2b91c16955c9484c68fc5afc1b1f4b76288ec40003b58dbd2f1d9fe

SHA512
2acf08359a834a4b84c6994886b4dc0e962f345e75650275c4f24e12fbdfb859728275029c9199ad859d44274e050784c6cdc4e76f544fb5d10440332313a8e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f21a3f5c5f2be9a159c84f96d769203e

SHA1
7b813f1653036fbe5eb7a07f35a1d540004636cc

SHA256
2a93130ae0561bf04f617114f800d61a9052f8e6d97ab50e6f35505244a010f9

SHA512
5d89bb10c00888bec2045e09acca79d4c47beea250677c87bd1fd5e87b430022eb015038430a601faeb2475f195b219c01cd1f6d860ce4233aed623a2d92d0b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deab9bae8e4c2bbe1f1eb0bef1050fdb

SHA1
898babe8f69c0ec5a7a6aa17b9807c12a7aaa4ce

SHA256
520d809c1331e7d3b56e721d25eabc3af2f4e6651f8b59809423084636a226c6

SHA512
4676949d6f4c247eb4184f46dfea54ead95703e2d0f95bbbbf322e9be6a7f5e14b1e5b6b6c4e081ee1391b251e57970c4b6efe87d1186694bed00239c1b648a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e267be022aed9770d4d129f4a71b1942

SHA1
48444ff14c4c5275d32d5a7b0c4b907cead487ba

SHA256
9452048292a791bfa41221177d645bb73cb978e99a6fb99032286f747fe202e7

SHA512
1f15ba8b1a34cbddbd2931c6b9494869e7426b57d1f290219ef6a17889fdcea0cfab1a8c41bcba776476c7b94c9c8a9d6b56131c6f50fab53537dc1bdce037a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d5ab847040f6698e091a0e8b686735c

SHA1
4852d8baa9263189f3ebb8a0319b23861fd79a2d

SHA256
1105a65e43d7a3a105a465b5a16fcbcd64bda52e664c15b309101eded62d538d

SHA512
d4a270165052cf20ecea60136df37f6ffc9fc0acd6ff712fd72504788ecfd2c849ba91f59f670e9e0e6073a66001bf79ba42df7dfcca3a58cd1b938136566dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B50.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C21.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit