d4e581c29c9b6b34f0505f946332fde386728f76c1689cc69ad0a5927c934727

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

0b3e7d2bfb8a4939c6ee9603838749c1
SHA1

9431b7c3ede04390af4ae275d1388daf91477865
SHA256

a127839025726f8292281400bfc80e7cdacd2e37199260d78b157fce4f4285f5
SHA512

a05b0dd335bc3be28dd30540f6334f48a51cef6d45d230a45e9426358b2c0d394b17a9afb6a59330d7f51946eaeef35dcd687721870cc85ecda1f64136a2642b
SSDEEP

3072:SAzD+I15Uyv4HyfkMY+BES09JXAnyrZalI+YQ:SANbttsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423171550"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4DA0091-1DEE-11EF-A8CB-6EAD7206CC74} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
1280	IEXPLORE.EXE
1280	IEXPLORE.EXE
1280	IEXPLORE.EXE
1280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1280	2020	iexplore.exe	28
PID 2020 wrote to memory of 1280	2020	iexplore.exe	28
PID 2020 wrote to memory of 1280	2020	iexplore.exe	28
PID 2020 wrote to memory of 1280	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9acc1edbb638b8c5c6cb1cd70ad10cfb

SHA1
e16052dc195fae5af42f0b2a49476f02ea159d6a

SHA256
7c3da887446d30beeb55f1845a69ded1ecd0ab81635727832702156c032a41e1

SHA512
292404fafac690db53a68e03b9d97601beb0ab99dd69307918485096246bfa8b79ce957a1bd639f1e506b6297d7d6c5362656e7065475b930970680cfcbbd1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78468d7c88442d26e7d1b2a97359fded

SHA1
f97f958178f5b920c998f0f3973ef19fd2cd78df

SHA256
d32c4185625a461dcc6b013d2339483d7a047fbc6f08f1865e1008d85f2ce6de

SHA512
77eef9cdc2295c81c7f110ac21be78e377b58ee768fd194816659d7f4b35006dd1f5ff0df4dc8c64fcd3a1ea4e8b8acb0141d674269a25424134f77bbb9c033f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
953b64949355e0ff7d6a26fc74b54c6c

SHA1
67f6feb507801ede25b0530047f8b895b671da25

SHA256
57e76fa8b223daa82a463a5bd936b4e2601e60bebae197439e2dc9c431e98ca9

SHA512
168000ff7f874ab109fc86c8d155526722ab1d383ff040aff8e9499188d4059953630edd783ef2205ed5ca921c880aab95d129800764ba9a308985f95b7a31f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe1688650c1827b93a238d338df66c83

SHA1
e435717ec904145f17f2db73eb4f866b0a2bd650

SHA256
3258636ad0e1fb75e3c67ab809adf91fe05220949dbf2893d83e63e9ff22edad

SHA512
77bc37832bd8034f56d93920fb36c68393494a2f7739f25b42f2dfb52a489cf0138e09ca6ffd90360cb3053fa16d723cb8f9a3e2554ced49e3e3c32217c5a50f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d33abc7aa1ae121a37c5e0349fe15e3

SHA1
1f45fe7b3664fcac0d3fd1e18e33a64d50e47943

SHA256
dfed01d09fa819e77f296fb48bbc60cf9760bd69cffb7a7557dd80732860c749

SHA512
1ead5851c5cea319a6d3bdac65c74136b776a27d57fbd06498e5f07b83f3a70fc68aac7a07b8c757eb44b4e9dac138613fbccf5c3dd88f3ad36379151494eaf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ab929d2dad176a64f69744eb567484b

SHA1
ecb72e9227fce8adf269dc6a6e467c9a4567e667

SHA256
0937560d3656f4ef5457d0b091a85443521443326b86ef6c26b01b8748c67e3d

SHA512
ee4025d6253950580eeda1d0f9a86b717727e8bcf071b8d9e870638757c777cde6116e46bd83bccd9dd7b783907ed578fae8170fce1f6b23faaaeae9dcebfce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b417987d4243949c0fb1829403004766

SHA1
286cea3177f0e05352b6697676132b40805d52eb

SHA256
c3e5328a5d2cf81ce7fcfacc3dc4dbe439756c58222ae221f58f0f133d1a7768

SHA512
3980d2bb7e88e357091cfec1b7349fcd902f67dc0551780b74de61a100538638b0d6fc406b9b9a00b0fa3db5df4bb5cf8d0924a84b5f2fcd110fb41792288860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75c63297ced608503203e139bd645001

SHA1
2ec0fe1cd8e17e73c5c7166d45a055d33c4b969f

SHA256
6b3e69665f0870efd61b4dde3f156229f2e3fb42846998d220917d6f55d88b18

SHA512
ed2c1007acf6bc049a5eaa89a7f5d79bb02886b9b8eb884c0c675a3e3b16cbdd089c15c35d7e5b610a9b2c986cd98921f1fc8138d10d5557e6c7401e3eab017b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25fca1474722558f155b98dfeab146e2

SHA1
08a0b1216882ba39c7fd94116f7edada2fc4d67d

SHA256
fb01cd1e2b2b4c4826ce2df742a48e561b830dcbc8a3d5e300fed89939649525

SHA512
5ecca44ee3738d0689ac4f1f5605a44a3774f352df661a547fd22b6be99604da02d469693c3f96d9f29074adf6810bfbf44a48ec98c88f112b28da679c5dbd8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
750ff81ae403bfeedf390a0fa8b5cba2

SHA1
90fde559608de8f883fd9c69f326555060b1d23c

SHA256
146e8bf6a62cb48c5b84381f9ee0ab7b179b26b7c053f3c30f7f115566844461

SHA512
4da41aff864e81d4d7646bb5a00803c1765f5240936b8a607cc2a1bafc821543f068ca7030896f3d272a623c2b39e9e9e2bb0ba4aa73c0bb5fb4558f6456f974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ba9348d171170699db8dc52c9046782

SHA1
f63b4d85dddcde943bb4724abed34fb662a747ca

SHA256
433a2fd739b296e3abb8158af25a5779d76f06859188566b9adf146a4cfb8af7

SHA512
b5c7521d6330962b3d293a39adff8cb0a45307936213f294dc34bb70135397d43d659eeb5a627226cf1017c14c1e12a95b7b9e1728982b8b69333f19e47eeb77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d832aa2e987d4564ade02ef9a3e01e89

SHA1
c730e0877c4a950769c48648efe211e85c776f77

SHA256
09d2b01ce42f13ef66e38f41719bf51f074973ce684510c58941894100c44284

SHA512
2254961b37794bba0a82b0f49d9445cfd79dcb65b02b178619703bb5a7a32dd0ff238c02ea375f50d7fbaf8a1a6893aa0b0e2cf37a29983e68b088bc82b53c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52cfb64b31160c37b8820638352624df

SHA1
45f0b520869a71229ac1d9e5d12bdd83812d8011

SHA256
04b3fe7a15d26abe766c0518ac6ce078e075f1dfb2e74db533dab064f15b6e8b

SHA512
2eb583a78acb7e52eea230c13fd57285d5ba1f18ac31baecb803dea9aa76d9578f77fe626c69b70e0bcb80180b2fe7f62727c12d8c2555ea90f4a2f2c47bd3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2731075b07b940c83736d38a9241bcf1

SHA1
16b9745846a84d6bb4c7c84236c360fd789476dc

SHA256
1f8893dde455062bbc2c97a1b66465d0961046991fc4b15c7e17805fb48349c6

SHA512
bea20d2930223124850374b5262a9e9978f23fff88a8a07b06e938e338b284fc9299083283679e6cee9db512e9f1fa772f086d95a9a8dd4d4065fe7af503c987

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D33.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F2D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit