57ea2fb01f3451b67d2c6459a9a87b31cbde3794bff74ac57ad8828409b2fc3f

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

fc20fb7a510a615db6de5903057d4678
SHA1

e6b23df82ff831ce333b2048e0a63e7f6a5815c3
SHA256

1b7191b55311b61c6fe7588db2806a5ff99a46dcada524c5ded5143d126b83c6
SHA512

e580c9761f070cae4ce3e1b401c54212f24c8394db8934d82d2b374d1bebd6e0f11b0842dc30d227a80723a043b017be855328b460b4c9b1efa8f2dd4adbcd9d
SSDEEP

3072:S+CJpk2Vsj3ryfkMY+BES09JXAnyrZalI+YQ:S+x3+sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBDF9761-1DBC-11EF-ACEB-F6A72C301AFE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423150087"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2620	iexplore.exe
2620	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28
PID 2620 wrote to memory of 2248	2620	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b07506fa71e9ae3893ed77c8967506d8

SHA1
81ef141121072e2084444618912cad5290af7409

SHA256
a5330c5c3456180b44617d65a9fddd43cc05c237dbebedf666115a4d4759478a

SHA512
a99d306711f098b5e33f9e51b9aef403f3e9eb22c31186664db66908670993003b0019b85ee393b56ad568595069107d89dc7a3d34f7e4cb7b09cd4f1a954cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17ad4e4e4165e55799ec93548ded4806

SHA1
69e47b1e1e4e7b9c322a75e92f1a0ca2596fa07d

SHA256
48907180fc2c24129819b24866ceff351134ba311b6e88ad18e39d6e66557809

SHA512
057419bc05bbbd65168e7c66c35c24e4dfd5b94b9452ce46752201f9b07db80971c832b20e8ca6e74240ccaac0dcb82932c95071c7b49ceb52b194f3a40a64f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1272b4bfe6124464bf7f959cf0e60091

SHA1
07790d607ad4fbea6c025fa7bd08daf118d9e670

SHA256
730b4c484f2b20e0ae010edd90b5253d2dbf7637f37d778149fe625015f7dd37

SHA512
a81cae45e94c6216d183fef00cdab512354d3fa4f9ca3c26b955de66b43523f559c3ec2e3546a35a515130ef4250930a39a660c7e5eb409907b39dc492c84a12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
680248c8688bdade30a6c830a365dd35

SHA1
c86fb863acb6587a101ebdf245f1dabd56764527

SHA256
7649a4a7914555315389811335886bc337b58359c3deca0bce6e51774de1cf77

SHA512
d18474c5ceb36073ce144a2fadab178dca481b41b665f658be6b40ebb20b12ad58f73860c88e8a9c7662593f23e170903d06c79d5441b75a3ac1c32dd3389a96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
910b1ca57b61509ff52cc329b73be373

SHA1
5a31bc1c0fe45e6a91ce0ec5ecf8941d69d58bb6

SHA256
3bc5594337b7b0831adcbe23ef13c262338672e54583e27e614e700b15439ba6

SHA512
06eb06fd923f8a29f86c7ee49e0f7541f530748ce68fb48ba29298f0050b9d380315ca22843fbc406634df53dcd7c88a1de571dfd31422d9aeed4f94d4251cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f1468db47ad9821f0f5120bb435558d

SHA1
3024bc2ecfbc359923f0c765bce5d058dab83321

SHA256
e9397264a72dd290fd2edf16760f90f30ac160fcd8343d496e83be9903ed809f

SHA512
f05bbf6d171796b4581e2e773a3d0b7de5c0f49e7872bd25cdf1a5c8ad631644dcf0a1e31217d3638944aa3aaf05fd31768bd9beabb5cdfc7081a6741135f1ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f28dad21cd5dc95baff5e15a357cb1a

SHA1
cf5587f7046746a4038903fd8a5e73c4af21324c

SHA256
89744d6786f7181a0e6117515ed119563ac1e9041e37544f8b7dc4680955d6d3

SHA512
14e39aab51d207395239523781f9d005c2c51106fc7544360ea05a2f703123cabf2267a0f0b30eee59c162b0840af44d3c9998af8d7c1828df6c1c4e9a705486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7da5684c7bc776575f6c89347d7b8c2b

SHA1
0f486d2af11ab9943080389a48fcfc77aab742cf

SHA256
869aa74eb6a2cb3c3c41c7def52b6d9c181516f41e4938accfedb2756bdd8695

SHA512
98c119ed79a7c0600e6319a12129adc03ba783c4d171c7922d74e4b7057bd9f08dc803cfb5c5d89b7d8ce8ad57f8bb200a83950cc792d04542754a2097297ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae58d05b006e3623f04d26431ee26642

SHA1
932e1c11bf4b4f9f53d96a1bebce785547910951

SHA256
73ac3907aab06c423045e7dcdcedd7fb062f4e7a5111bd82d14096f252576ec6

SHA512
badace41f646b58f55714a79cfdd3a420276573bc79061499d674738d49eff73c7807a5bf65368716d9c7d87475e5ee83d761e12dd2c332e451e8b7239339d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cc41aa6e5832372958e4b7624723acc

SHA1
98550a32c23e9301dd69e75ce2b3d4c7a9020792

SHA256
60aad2512cfa9c064bf07cdc17439f2237e08e33df497e9de1502992b9df1b07

SHA512
783616675c5d7fe11a9ac862d4e607497a24e0f7ea34237f78ca380e1be48568552c612201fd1b03a8ff330073d58c1397968d99846bfbb3c03803c2bdc1f3fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6e0e82f4e48144f19a0ce4e40f0a66c

SHA1
555f6b1d3f9f736a7bea50c3c541da1e05a138e4

SHA256
a31074dc3eff71808ac631dd5f3a1290ec5fdd9ca27e8257758ee837898f1ba6

SHA512
72304537986973dd0dbfa6790001e2552b055e12bfe14b5088c1b4dbad7332e90800fb0a07f57fdfe00ea70b36651a2e8ff04d761573570246ab68c964f88e21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17ee2e8f61e8be2c06f36acdfc402afc

SHA1
48462df6a6c05061c71c09ccec96903b1e405e75

SHA256
fe531260d1889872da1cccec97d5b10c616234d9f17754f4fc54bae65bee1e14

SHA512
4700edf97b505ce0b3a3fb56225e233e0502bb8c0c3e427d3423aee54d72133844c18c21c841778e74aab624fdd2d509aecbd095829fcedfd2adcd0b509a45dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2833fcbddd2483190f41eca29d9f4d59

SHA1
75604628df5716a5e2cfa2486feb631f4b072b95

SHA256
d134b6a0d3d831b1b797d71cb127a4b4d2ff5eaac9855a63d899ff2f9c348148

SHA512
61b8d700552efb818c78e03e11504429dcf9e185feeb0c5c802c718722cb2d496454d4c6f56ab6187cdf3f539e78358349755912e2621562fb04f39f6e532d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eeee9fdd56a648c0357cd483c320289

SHA1
cd2d863f93d0e98843dca327053e49bdb849218d

SHA256
ddf25d029eb0c377f50eb8992eac6f14d96fbfc3c20ed69b1ce38e772cd1bd6e

SHA512
7aa3e1b9056b693f5053e4d002ac2a85cb5c3a1900ac8e7b2fd943501b8c64ba70c6b1ec45dea8ff9893db0e0625d6fbd1a35e142159278eed6c07d3872f7998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fdf14f0f3fa6d6822fae754c5e870fd

SHA1
5cd584fa07f39d141024e29f9db069a2e48450ef

SHA256
b1d6ada6c0b116cfdb9ba02b5c44e919be953f5d4cc8ad92704c188ab6062f3e

SHA512
a2d82a4ef91789cdc70a639d5ba02a7fb6cf2e7cc6b50438ebec96853a82a8d70763bd24320c4e11fccbe3e9586f7295aa4b34cb254a0622d454b11fdfc2376d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd28100546c0d6353b85304a84ed947f

SHA1
1601daef4c1780d7c5470bc3ddca71994c3d926c

SHA256
8b36fdf59cc168990c51da75980a70e18ebc40c8794f67e59360b5d69e38cef4

SHA512
7350eefd3d0349e66fdca5d45fa935bba9a69227640c87c8706f5b573bb33bf81464ca84e0e782140ccac563513174539345ec408776b5efa48eb0174d6a59a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68afe8b1e7e101e83f33f82da7bbf8e0

SHA1
6bb0b179178cee3f62c9049b19125873e0a4777d

SHA256
7f7153ca9c5317a38a3f99f6617a6799abe2e0cccbd8507a480c355b5577090f

SHA512
cf822c88a0cea11836f159e56ab2d4d08c138492d60d9f547f2b9e4775c19321acff5230296134755e1fa03157a1411ba000b3a09069003677df55234d22a021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b175966c473b53030dd947da7e0fc73a

SHA1
3216e2e49a34d08bc89f3bec62ac6fe2a6ac2afb

SHA256
6e1680406e843d06b9016e691d2178babc87ca9dad316a71caa0717797ae72f5

SHA512
11ce65875635594b27dab345b29cd3760a7653351b9ab643a6fc3c25b4429aee6e491e119ba41313051836ed65b936eabd5a9679fd64f837b6f398a3a848c85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7962af5aeb84d76ac13d5f11b085a42b

SHA1
bd0fdde98dd586cf5db2838b9f240e61f6f3637c

SHA256
bbfa89cf93f4d9591936facaf93029d46c1e5f8760986d2c7efbd996ff778a54

SHA512
2f8417e4d92e3f5523c3055477efd9fd9215caa31bd146681692a3679603edfc33f8816293bd537b82d7ef5d370099d08f09f8342009ec2b6b402cf955f9f68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC73.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC78.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit