dbae4b165523e4649d1cf071246d4c26713def37918c75bb013c47707e0292be

Analysis

max time kernel
134s
max time network
138s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

f608c097aa889dd6a2f0818732ba6922
SHA1

283ccbd2374b48c435cc2e59bc83cf5b43fd6425
SHA256

63a525648b0b95d45ac6a727042f34fc259a6e312794694d33606b3031123c3c
SHA512

59be535c97ff65fe2822b11bbf43d4c990361a3fce980f6acec5ea5ff5a7d4b1d6bac255e3fac4d712cd2aafe9e0d56052879606a9143a95c5f6c1c1d24463e3
SSDEEP

3072:SCVBEt+NFhADanvBMB2EAZpHYhsNGjW4/Y1b+YibpJdrOqeNgPGPBh/xL4XNmVyB:SS/UbsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423343212"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7227B541-1F7E-11EF-A596-F62ADD16694A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2564	2356	iexplore.exe	28
PID 2356 wrote to memory of 2564	2356	iexplore.exe	28
PID 2356 wrote to memory of 2564	2356	iexplore.exe	28
PID 2356 wrote to memory of 2564	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52dc05515a992cdb7f3d1d7ed96cf74b

SHA1
ddf5d996d7e5bb6aa0444b1cf843d1094d20e6a9

SHA256
f3dd6ce5fa19c412b8125b9ab1eb49e1dd878b451ed4438411f2ed39e3abf00f

SHA512
17a81937618c4a534cd7a8159a6bac16e7453b2d982559b723408a6bce7c66cd0cf00fa0a0066c8acea47925d2834d97c830b1429ff5a35a6595828ce54c5ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fab903f515d9be0eb049782fa3566507

SHA1
896c61fb57ddb41e1b3d9ac11f5f510334d36585

SHA256
2e5e06736378fbe6da0e7de8a3ba6f434889133fd3662f9a8b79e0d6652aabab

SHA512
23764f56772bf3ddbfab468751088c5968177a02206cad968265c07bbcede3d6f2491d4ad3e85fa708feec70a873094bb80f9c8ebceff1e3ed37674dcb48b207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86c64daa5d6bae42a220a705aa1f9535

SHA1
a2d21c84216c3b43b5e17fe1c1b734f80d569c57

SHA256
903cd24c5a9469b08a784a27b183e2becc885dc8d299416d25afd096bcbfce17

SHA512
5578c89814c8e425fbf951d1022f14c0ff5d9e246f39a420912cca20272aa8841e2b06bc64629c0aeb5541c545782317fd56f74d0662c8d14b57a3bae366c6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4db4cfadf087968056dbc4f3216adf08

SHA1
e82990a62f944b4edfc915d3937458ad99aa6a1a

SHA256
8e1b7ce7d14f061261a6ef723ee2d02700ae8d73c72ca23fabb8a41f2a119116

SHA512
cd5594e951b4f0e398a7e6153c95e60137e23aa7236a6aaf4a3e6d8e24a05d176a23a4e3063cfcd86e8d891acebdb94c3473c036a44fa562e7aff1b830d652cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2531ffcf9ab3232097b78c55c682aede

SHA1
71207ddc44338e20c4c522c245aee8a616710c73

SHA256
e6fb806254b6f49f60009b42e17533e4b7c7df5c8760751c149fde7ba6f75fcf

SHA512
97bc83acff46f9aeeff8211ce2dafe42559ca5fd5f357cf1710b659f5aa7dc95eeaf846c9067a931f181a0046b71d1036230485e04e4381fc81090ac99198592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38c69de285a4963b5b4e70e75af1deb2

SHA1
24f5b16d4ef87879f08d33130f233f6fac15de76

SHA256
0287cb9564011249fcd1c6037435ddbea60448d701aa651258da0c972768e83d

SHA512
1f4013acce5d6f73aa610cfc9bf2368bba02e14368fc02d119d4ad124537c81a04a431ec92414fb651b89f6decee78ea116364fb863a4269d2f60d9d297f8959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21be6ed575488ab25ce0249c1700c024

SHA1
e160b634ac753151848f49d9978fb264baab4c24

SHA256
5d75144dd7a54e358400e96a1005d1e23c512434da4e830d47b7232e411226f7

SHA512
08db9e88857cd8f08d1cb7af2d8d40b69a2aea794dec99397eb6e4aff895eb106cc96bbaa35150cf98c5bedf12d9741d218bf49708ab85e392f6c3a20cce39c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46bffba683677fdae4ed0b93a5864fb8

SHA1
99577bf28930b988a140888e39f842bd8c0e6fbb

SHA256
d1c568c0b6c2c305735bfe6eb0cddd585a78e65f1c5e123d2a3bb334e768abb6

SHA512
b4df1a9e87a4c857d0edb2c869d843982239819564302e2069b56e40a03e572e8300cfd3f19b519660b6cc0aaf004a270b769311dd20a8cb88842076f3227349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae585b2f2d7a0451b0c66b57648eda51

SHA1
d743e55be1ab689f359915553648278900acbf76

SHA256
e320b112a2ac6cef48cd4069229ea431c06e360d74302b1ed5af6ea45477de69

SHA512
bf59e4699714265dd6491103563d06e17ccbf214bf91751cf2e97d116b9420aa9ab2d140c960671d5d60ace67aafd05952e0284ab359b5a9e77749ed2225d906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d18a0b7f6cceaf681f399088c8f5ffb

SHA1
d18847163e8251a9fb8a9ce0396e99528288a645

SHA256
66cdceb457244433534b5dd9831977f376d499578300df85e302fd54b5f6c8a5

SHA512
92aa6b929b5a43e554d116c044bda1f4050e7b54561d73d23f4e3070c46d0aa896ba5553b082a127a722d5333fc8a7ac5b598215a8e4ea6774fa4728aac4eb82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6369925890f14aa9e1b14134ffe99505

SHA1
8f076f91a6453008a82a54b0210f35514f1dd55b

SHA256
d7ef6e42db8b108649478a549f0203dae4507cd6f94358da7a58234a39897d3f

SHA512
5d822bdba0e13229d852c77bbab39e96bf181592699559b4212b0f84cd9767fe7d050fdd45b19a306f0413a8c2bd652167e5c0aebadf59eb7a516f7873d956ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit