cda3523b39c60a1eaed61044a2f5d5a7b5d1d1aa37c9bb20bfb44db04797dd43

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

ce061593e00f7593cb7cb797325cfe3d
SHA1

cd00a1ee05bf4343a66030ade11ae9e3f5098ae1
SHA256

f98a4d4b71db8a0b4240f076e31247e62fd7ecff218d166527b70ae25d950465
SHA512

b74357787eaa24d0a3a8a316fb802f2c07d769d2e9f50c36c7520269bec93a3e5afc2da63af7f572318565dfc7a2f192491c2139a85e0b63ddee41f6fa8d8ab9
SSDEEP

3072:SmL1SZCUVbHyfkMY+BES09JXAnyrZalI+YQ:Sm0bSsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423323876"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BD5C331-1F51-11EF-B1D1-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2620	2864	iexplore.exe	28
PID 2864 wrote to memory of 2620	2864	iexplore.exe	28
PID 2864 wrote to memory of 2620	2864	iexplore.exe	28
PID 2864 wrote to memory of 2620	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb0348085781c6f5957137f1d2d1bbc0

SHA1
deb3bf7991949ef2dffedcd3968f7da6dbac36ae

SHA256
6a8a7ce24dbcb973325dfe9f8b0227b2e25314654a6fa92e62bba0fb34064a6e

SHA512
1f9b1c07ddd55d47c99ce1888b2d78284f29f61804722faa13852cd936e96cc54e8b9794f68c6469e9df611f5ec577e881c713a438ef2175cc05e57084a88c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
889a8ec10d6bd12e79795d6fac2ed67f

SHA1
2bd4c5b70d81c414bd74400c2ff2c947003cfb16

SHA256
21caa57f755659da10deb8802f9755a0e7f50659e4426534a99306e88bea754d

SHA512
9bbbe67853de6d16af3b87320b855ecf9a19603ac2dcb6abd34d1169e9e8d00fe082d937f190e75a0ae12592d014a815eef4bf5712556ba98b65abbefc41fbd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ae1913432ae530ea234c0e49cc23cd0

SHA1
fd736d7016294db79644d095da3a5b9630c7adcb

SHA256
28b6d0ff294be52f97fcefda3ddbe7320f4599506677750db4c80d6be316d20c

SHA512
dac8f610d08b8887d4e2e149a59b26c959491fd94949d3de71cd82c1f5f98e9299e563f6bda3d7f2cb136ae750cb6260dedd243ab210bea0eddc6d724a71da9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24374cae6a1dc719f99dff0c8b199197

SHA1
39826a1917ac3a8e2e3996716935098b06ac8212

SHA256
f72e898ee40c722c965bca8bd48c87c0295a1562807c7be16df5d37a73bb5713

SHA512
a0c1e401a5d9e6d872854c05ae63b5babc00471c97cf79fe58435543b6495c9a615ec4e09dea7100ac9331b5c663214ce01503ea77b0e152a4aadfb5b7b3304c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e055fe5e6609306aa140c5c9b92b59ed

SHA1
3ee4f7f5a7aa186f1175919b30e7646b4166b274

SHA256
ee462130bf4fbbd6fbb2336f7212544361fa93f4441374dfd010ebc15c3906e2

SHA512
08b8bc396a59b9ff437ded91c081e0d25775ac0fc061228f630f6cb37e34d77dd2287b4ef2e6fde2277710a3c23e0153fe34001ab8384f04aab2dc0fb5f163c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba844f631492475e77fdcfc950b2ddab

SHA1
ec65179b4c4913374f35bc0bfae27ecd779c619f

SHA256
7b1ce0e6b23d7ef4c491d5ebf4651791e41c5ff2d79b269998e29352c904b494

SHA512
3278cd28a01bd367aedf5631cc6cce1f99c2e05b42ae840c6a90af28cb59819cb7cbba45e0370bf3f371530508c50132034da92af8ae85547e279f02c3e1f6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fe05e67c90cb562c14a05b93fffa2f5

SHA1
d8a3406bbe400e207bafc0dc82ffc891a0f2e4aa

SHA256
4f699053ed3a2c46702e194faf677b337f31b2f3cea004429064a885610bb6c6

SHA512
3644ac21e259d3d1823706ae02b996c247c3c9378fa1f69c6e1820800cc9d3238c983c89e085f91d43266a9ae5d116a382015f2bdfadabc21f321030effbf3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
428846a21a6f73068984e3f91649a48a

SHA1
4c78297086962a986341170d7a0fc09d289c19b3

SHA256
cf9c05d6276b44fa0afa45a9bf71d20384df35d4f8e3b8c102ede5a040586243

SHA512
ad65ec14165659dab34b4a562e06fa513d4616352befe3c2ff48ac767129269a1582befefd1b8fdee4faf31e934847c627bda13ec53d8548d58cb9f959e8071f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
654a47c97e53fdc4d66ab1758bb06cbd

SHA1
f7f2b955351e863c51a3c81e1a1931a386178d05

SHA256
fd212eb9c40eb880e5b48458bdde235c1a7b4758430053dcbb6210767c649840

SHA512
f16df11f83b4b4c92bebe47be0c9f46ea9726dc3f37304ba3c2223d769e1bf063be186749d4ee674aa873ed1e74668bb9022bcbee84312ea0caaabfcc73479b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
118294fc34b734fb016897b5d9040d00

SHA1
a231882a5bb4d99c584f75b2e93962b662504803

SHA256
13ece0eb0534d4aedafb00d31369d44be41df0fe9ef6d3b62df338503c8e5455

SHA512
a2cfb75ad35d2d1f3bea0c6ddc132201d20c227358bd56ba163d90e417997f64a406cc8d94328d7a6a2b890ba7813882197016d1c333957cd9249c8f3c87866c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DCB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit