fc2a0003372bc2d018eda8a1535a3be21b1be4202ae6dcab384916b45fc2906e

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

84694ea929d57f2de824034ffa74e778
SHA1

17882241321895df3760877b4833af11aae12b19
SHA256

1710fbcd4158dc94064a4620672de3fcab9b93680d502126194c60d7fe180a64
SHA512

fb7c457918f802dc6a925ea50b31df339f5936f0ea8ae46b0dcc1dbd2e4225c86ca4fed080484fae8dcab36f4fad6afa7dad440299e8c3358b4590c6f53225c1
SSDEEP

3072:SPWM8fzBOPhYyfkMY+BES09JXAnyrZalI+YQ:SPaghVsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA9FE431-1DAE-11EF-8E71-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423144071"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2900	2248	iexplore.exe	28
PID 2248 wrote to memory of 2900	2248	iexplore.exe	28
PID 2248 wrote to memory of 2900	2248	iexplore.exe	28
PID 2248 wrote to memory of 2900	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91fa3d9255a041e44917e7e2d1745107

SHA1
46e188c05225e3c626323180eed29cf84422cd65

SHA256
cd564d9cc3717c9d46b3f74a40085b9959ffc88da055b54180285b69f195fa9e

SHA512
c385a890e06f2761c68cf634cf61d191102178ad9b616a8ac5419633654d671325bbea43408efbd2340934f0246fd769a25381131201ed75c5576a32aa2af927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1032b72afa7dca5f7baa3f89b9026e3

SHA1
49bb1867de273dfd2ffab3a9f62be2a387fdc243

SHA256
c3f0f436433ff75283ffe515f0c2af55f4aae04ad774528ef193cd92ee27dda7

SHA512
73215bc3c9f6d73b468692c79b7a0b7afc7fdc687f7a249a8065ddb96eeb384bf7ece3a8e89e932a1d2aa3d5f58b0bd13d40a3984049a641a12e78d15ce6db82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7b0a3927afc20a1bdf341a33996b36f

SHA1
b4f6589af67e319533ea980a2a780ce1b75f139c

SHA256
4b0d3504deba7f25f8a4133828b722187a4e6259cf06fe25e11f255fbe2c32fd

SHA512
b2f401fa1bd2f7c621519027405f0d42d06080b97bde341edbcd49c343dea93ea9ee28f0e8f4e72bb615e1ecff5da8873be262eb5437fc841601cbba2cd175bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06728e33e1faaef58017fb87081c2ef4

SHA1
c0b536bf271716683bf3cc00aab977a3ed26a766

SHA256
47410bdbc68b5e941256922d93c4d811ef57d619a922d3e61db220a35e96a6dd

SHA512
36453d8224e6341d71785c92f8d7ef56171f75e4ee80a2ef414e22104a6f146c8b3df6da3997ed9b3ce89caa1633d9eb10f390d438740c9cc9865603b1969385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
529b17eb76887237c916041101b4bfea

SHA1
993d4d7802b967791bfc70dc7aeb0abf221c3032

SHA256
f4109ed26d690e10d3c23dbcfc81aee80a850587c6edf396313964d91569bf03

SHA512
509ab533c49aeb11ec2b35ce6865c4e7eb52f2d07ffe877f72168584b438455b9fa26504d3dad85a9a84124105a348662d67fff36f8de6657c108baf49f46436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a6109b231422e9961273aba49471939

SHA1
221795a3608368394911cc0f49cd0ed7c5791317

SHA256
16f7c65e37593194d529b498afc4f61c90bf5c2f2932a267d0ec4b4c90cb7abc

SHA512
0d680dc474307e265a437559eee2e54b3dbeac5cae9bc4cad44ddbe24128a96ab6840b644814e04ad4d2c8aae437ba1fa38d5148b1943e083cce76208003d863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
372f93c5cc4fc74d721e5fca0467e8f9

SHA1
60e00d2b8e352676e34cd7f5898f76367e562be1

SHA256
086233887facd582a72e52676dab4f6feec1ac4cd600184d12c22c0af4091917

SHA512
9a8c41c29666400e60f0062045851cb879f9fe79bb65d727ef93e84559c8c2b9ecc337228b2d55f7dfcabcd1498f49b6c0851e9926c7a6650eb0d5e7cd3321c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b88b43c04e4f8b4ee602e137cfa3d048

SHA1
0a59306e77d8537591be42b0fc515722ed5fc7e4

SHA256
481bb399f0010e51f5c7b224c4b01b1bbfe12afcfba7faad8309edcf71b90617

SHA512
c007557abd18caecd46db667612d230f7f260dd476abe7d57b704dde2357c00651940d5edd3a4f4a7820c4b684830a1f40add2407276cd20541101fdb34dcca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49047a73c33f6928ca3c70a9d7783892

SHA1
9bb5baa1ec270ae82d9716648ae09f589f77d347

SHA256
e0cf58ddb783ebb5a9d3c6436e5c75f15670828e9eb65dc9aece4d26a9135aa3

SHA512
cf1e27d0ca8c505e696e2134f1aeb8ac331ad9a01027c7cd2c9d4a0a786dde8ae86f394255813288eaba11f78c8fb473395384ecf7cb772bfa5d29db2d9a9566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b985255a0b7f2bdcb52621b3fbb9f5a

SHA1
41c5c1af444264f8103aa0f344a9c1175143a33c

SHA256
c106337fa2dc428a86b6a8eb78c13f9322d599044c54b5cc12b5bb15b47b9ba6

SHA512
47176d71300539b30d59f5bcb3a8108167723e858df7145b39d18833bbdf18169983bab717f1a58a271b73ce60806b60314bfe4346c81e72d79fb5d7908804ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8361b2688b51a1e0734aec3ffed76270

SHA1
4ee4f7c54cc191d33712523b7b6f0568ee8c7616

SHA256
9f84d2ac2cd1789eca7013449e1d56b717c0c746dcc6fe456fbf3caeac5a837b

SHA512
aa44cfdc97e03a73642f308a1397e73f742d9136b5b596c4dd8eb175fd9f24596486227d472f38ca72a3dbe107dd84fdfa49a53709688c5f6a51749c19c59f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e18b2dd4100d1e9f62d110eaecb8c620

SHA1
0b3125cbe34e2531637518dd8a30f26eded23f3d

SHA256
e5d252c8975b21cac18e7b76ad0903b62bbc35e638febde0e015619e830c2221

SHA512
c983651fc8410850f25b733f7fc9f442bb0aae10845454e58341280d2f62727e90b8fcce6d17921fc1146157fc7d6f0840f400fb31a621599d1b5315450130a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ae930ac7a6da3ec6e33d980cfe6fa9

SHA1
18aa34c2698ac4576175577e8262dc633b342ce5

SHA256
da518d7d216a862b39c048cca4e9033927eef013b5a504eb80427f37e352bab5

SHA512
00c53d6f049ddb361fa19748eacad8a7f251068d394d6671a3210b39dd1bdfb13691c3805a90509420e106536f0bec6b804386c51ca40ecf9babb136906615bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d1c96540723f3abe20575d185ea2aeb

SHA1
a0de75cea8abce4b5254970938987e75587fbf86

SHA256
b371b0ef0d0db428fe6bf9d45adc23b7de2890ee6bbe832889c2b916d803ff59

SHA512
1e1245bb0ca23e99e0797850a517012fef9c587f76d85aaf68c605799bb847d46922e4b1b10b0a0c15f6923937b3ae1784d701c83509acbca12172e1ad847e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a03d09c2a605ef2a764be30a73a91a3

SHA1
21283210c26ce23b1c4e7f26c58c7df5214963c0

SHA256
da9a6ad4fc38b7c0d5f5e62a528070eb6485c15ad26061950b51f7858fa48124

SHA512
9a608d681b2a7006bcbef4f6125d6cd4270d318f716589c0a24b75a26c92818b431dbc6af097e441b3de2996c0fa09252112ff34a54d985cecbb5b66e78da7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69db11c5c704b9c8741dfcbc98779994

SHA1
ea7d2a08d9058124ce59405141d126c209d62d89

SHA256
294acf01d3a8dc722c8ef25b2e6dc88b820e76f79f29de3b46d9571d2ecca931

SHA512
3983009a1a11ef89c6de6f439fdc189c521ef00da8b4f020bee905eda993ff59dbfebe775bfb4e4866d01df21e36cd41650ef12e5ed8e86b2b8ea642d9e15403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f62b0d8809b61fe49402edfb9b369732

SHA1
2f3c79246ef0984d0c25b8959ff23fbffd47ed3d

SHA256
1ef9b57bbe0902b86e74e01d065273a0c00794db68bbdddc29aae2a65690eaa6

SHA512
81ae8037f2facc4bea2ff988bc6c65126293ecb85e0991f6ef9c3f54020e891270d767fa5be2093583b1e4399b356fd925a9ad239d88eb5101708c31885b66bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c9f394b2eab70bdf8bbb1d151633aca

SHA1
a789bd7fa0d434f6be10e3544291947be0812b48

SHA256
aac51bde25ea1b70965a617084a33564b75c84759dc8fe8df79003676fa8e848

SHA512
7365d57eecea39cd63d7930d1121cff98134141f52202108a93de95f0f27decc2dccff7a38bb328ef1b30c8caa7c94817df587dc38d18d9c563bc957cf8d7f40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53a684bd293375f821fbf09a3d9d172a

SHA1
5405ada8776b0c99023c598aacdb732a7085536d

SHA256
3f0f2ca102955efd9fe4f5aa5e90aa2ccdf2e9cab2d3068517a8a73b5383ea46

SHA512
9ca3d53a2d4b8f9b733396c00871ac5c07e8acd56c8ea54debb528a712b111f801270e33e6f985b33dfbc334894b8395c4668c56b06e69abaa5379c890c027ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab762.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar853.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit