40ff31e2224c6b7244121f06b3b28f058c0c4f66c8a8929da501ed39d5eaf6d0

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

4c712241058eb2b8871616f048825301
SHA1

cf30f094286fa9db47244a8f6f9207b29649b6d6
SHA256

5c7654e146fbaa06354566e33b1647adf2c368c13156c6e83dba119852695cb7
SHA512

437b9cf576b29c0657219532fdf96995ba9c9893201c970f7cb01bcbf9db7db9a60513835a276611b6c941d91322d58db0302aab14328a493f6b00618fc57c91
SSDEEP

3072:S1NDYCkOr1mD1yfkMY+BES09JXAnyrZalI+YQ:S1yFEsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27F147D1-1E47-11EF-BC3A-56D57A935C49} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423209511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2964	1956	iexplore.exe	28
PID 1956 wrote to memory of 2964	1956	iexplore.exe	28
PID 1956 wrote to memory of 2964	1956	iexplore.exe	28
PID 1956 wrote to memory of 2964	1956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c79187306c019b5d3bd30753b46cd860

SHA1
a8ee805b4683f8340769c716f87ce6f3d0be06cc

SHA256
111319e960189ac36c16344fe09f57febd8fc0a0e283ecd5948129eb788feedc

SHA512
56d8c44f2a1515a6c16f14524392870633ece0343c6a7e98d2fa16759f76be97b333722aa90b5ae6dce3e6ca58200cc07769921b24b2a733b64c76e043991e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc6e7c0523cd8e2b9daf5de7437a4e53

SHA1
97e1aa6ed090cbaf0862c95b5df77e8f42248286

SHA256
fd43a0c5ef519ff946df8e0a7b494b1f00e64eb48154d29a6d31c99a8de8994b

SHA512
3c8bda2dcf5c5ddb90d6ea04e74b951d412724df9441fec93cccfc3b2f6fa03ac195ee86c185764c3c1553ff801f23795fcbe4c22b17b3afe182be3b886d9858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
191e54d948652d577e41c29f6ce7d984

SHA1
bdf2b39836de61a36729a4a7bd8a98a6891fae12

SHA256
5170e39b5dd09eaa6d22ba53781a17e8e2cd7f16d9a584147ddc66ac5853ec29

SHA512
446b6823d6f54de18a7a3399de008948973db697a18ba4bad5919e42525b71c4fcb328aa461bf34a136c49e06d48914d43a5c01ea482d4d3e018b0310c090c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d745adecda113df637ab9b9b7644367

SHA1
5f7ed4c8f0b68c838815b07e629b5cb9ace0e499

SHA256
20df68fe4074c39f0ce610579fb169d5a9fd236b80c82610f7e3fed761c40b28

SHA512
9218c8932dd40e828a01d3491977484f037c757ae957d65cdf1e876b6362e7ae8ee51406d9d6e632808779ceefcc8aa2b1f101fb251602b42e32e16015b39136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64eda0c0a01082d286f6398c780121d6

SHA1
29f75acbb5fab56d7ccaf76d8e51a871b22014fd

SHA256
fd579707ce107df9546423dfdc9b8bc410d367f3404a5e9a41fa6686857b575a

SHA512
b2c6af67cae7923409e21df159e88a3b09251f1569bb1395d69510e48cbc28169470772895eac49f58e6d35442c376882daafcd5db4b847579e88c26204163a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37091d9ae00240ea1ed37070b12351f4

SHA1
311e4ac9ef1f5d478155d9b3cd19cc47e9b36cbc

SHA256
a5eb790070ff4fb3677a55727f42cac3520b38c24f837075c32f51b59d7f29c3

SHA512
9936905a3c1640c0bb1fc7583c55f22b50076b31fbcb8cf06a9ff5db03b75331f89f739bad17d406b663caec028b0ff0069ad23d4dfea434db73270f0c8943fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38b3d4bc079fead6adf88ce811081631

SHA1
3e42a64e3845bfa6c3a28f1fe133817d11892e14

SHA256
ffe6b545feb4a7954a22fb009c81710a6f396aefedc0ff0d5d34b07ac1c8a2d3

SHA512
fc8e11093becb9610bd75ad3e2e719e8885c6a1df9902c98a4046cc7962c89ac80545631e67466e2ef0010ac7ee6f2c3c6b9dcde63524873dc9585dd3cb565fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d18403cba1d3fda95a5c143142bde339

SHA1
8db3fa9dc576912747500057bb4f4f282cbc75ec

SHA256
b2714046834ad353f370e1981d8c8bf5b181b8b6a7b2641fdc21050d4225d0d8

SHA512
0dda346999b94b4c79de36871d8a3fde3577c5d745a5eb3ac7a458f4eed3242fc1830511087b56514a601f585695cd58c9735e5709b7a6dec7e68b406aca3cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbbf7041c7afa77f39884a3641ca9e51

SHA1
c447bd4b56288976fccd3dc174c4442a5d2ce71f

SHA256
2eb6838fcf1aebce3550fdfc872bb4cd2702be52fe8d483588b37e2e24faac51

SHA512
f69350e3efa5ce680ec98ccaad9183201e14842c98efb2b1f8f703f9239e3ea8191c7602c0fd13475bea97362e6e06728339f9181af2c49b8628c64fa34a11a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7c7278614b76e79818bcd4dba88489

SHA1
6b3ca27a6e2ffe54d7a92d1c3f62b86c416b0f58

SHA256
f1e206fc8d97aab2e25dee7c137cb3bc8c0645faab050ad58e566ecf54d9022f

SHA512
43de8155dd12d4c858c35f26b4abd7970fd1aefeb4405a317bf16798801a0a018cccfce52dc0b517260be3a88c587a812056c2c7b9d59a6433b12460b2931326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49579a5289bf3baa0eab59dd4206e5d0

SHA1
09e415fb4a54dbdc22a3f97032f26431ddbf87c0

SHA256
2886fcd430797f6da48260acf32cd45dd0c661cb4fcdc6f98a37449e0ffe2a2f

SHA512
0b840d4d11941c1586ad9514d6086a0b0508730b552419966ae90950ddac8fe3a7531b0af9869824a978e836b0490d60e591e0d224ff20ea83ee3bc478d8a58a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ceaadfbeff69711b2ae8c0c64ed972a

SHA1
bfbc474a2add7f0eebfb6a85f3fcc2ee18d8a40b

SHA256
64517af1f8c3ae5149dd3acc7124fd3f6b784c4454ace88cdbf66b6f9e5aebd2

SHA512
8770acb07319a227d718e514464f935930380403a96680fdcce7858f6b8e36ea2eea754f5d849d1238178c352010c4827c2d96d125361344cf859da571ac178f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98ed95091194776c090ea9656c806e8e

SHA1
0d77a486068d5093334d80f6a721c9ecbf2dd76a

SHA256
e89a482e02b5136406fbd4886a3079b36bb77e8b9f3826d1c4feee6e8d2ad661

SHA512
42a37e85277becc69c6f6d81ed9efc2d91ec884f73a31fa84e5f0d6aa15ccc639f863977d485ff97bce503ad411ac78189397ce48606861499abcf9f8367a8c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8adc62071c3988af2d2f6d55c71ce5ff

SHA1
bda43524f8ab9682260ce8a088bc87c73d2e0818

SHA256
0e590c30c42bb589653edd5afa8206e2c45bf076bc52d723d684870716b85651

SHA512
cef9100d269fba8db7f144968d3628fcd68b7a3661a3cfe7ab8f290a834aeb208eed25f4d2fbba6313f08dc660e774b142ae7273e75485dedd1f981372cf9cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0569d770228580732fffc4485dfe85c8

SHA1
e5be324960c88493e6731f9596f8dcc39f3dd370

SHA256
ea391022ab9f110a2d528e6f649ed5e47d52dd8a4f3f497bc6c17c8208fdf4c9

SHA512
f8dcb2e5bdbf8036465e093380541fa8cb7fc4a38a05a2be65adc5296efffe2155958709acbc0392aad8819a19a4ab2b306c1ef5a19b0ffa8571e4b08a535f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bed5f3bfc70e7e769ad23e4d12897e1

SHA1
04c5af2ef198929a16721895ac68d3414e902902

SHA256
32b2799f116daee0443ef5f25927f1f2cf126389e98456ae8d5f38714fc8a52f

SHA512
e75763fce2002924e3158fc62763ae10e34c5f5247d4fed516c4f3a6e99bbc9143d2225d25ad30a4277ee4893aa481ef5b9fa4b27dbf63c5b31db7f2480d57dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63d8d40b9df5777945836e84c3ebf19d

SHA1
6a1fb8834e4193f58ae7cd41239a9008c60fc676

SHA256
2cff562da6c2c7899a1d4d52e6569b5823047ad5fc5d1e5831d23640398a6a98

SHA512
10dc708583f09a0b9d7802c54de360f4147038de32bacc241b5dada38f43d342d30f054208b43cece023567b3a877cc32e5f2d69db52dc86d608fcd531cce6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9431f984ca71b755a016d94f82389f30

SHA1
8dec79cddc94a81c6a53ef3cb2618de7c5758550

SHA256
a153c64906f9f2993c6ee12a13983d795f589a8069036059d06d45b307b5d55d

SHA512
76cb30cd5e0704300c663ec3c85b81e85d04ea096278e87ebbb15a829892b04e00fdf91f80fa2b7c97fc4a230cbd07b137079d4d05e5d393fce49d52d9151d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ab6b4ea8b06d4abd55de904a0fd31c3

SHA1
b5429083b48a18d01fd966706327bca4b58a1e09

SHA256
92f8f64d3ebb498528429d88e449e5963e810d784721374448bb7b8353f52d51

SHA512
96106848118ffb165aa942064047b483f422b21b9430d485072c6982204e98b00b6bf6f96fb907f50d23799ada669368c3c66ee4a333fc91da371a2c20dc1eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10BC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit