02e27070c8145163ac1168bd9ced806be067484df6b29d84367ab76969627823

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

1578d1126448693031534997aa21f187
SHA1

10706de06b2a1ec8caec045e0d72c40d18b0434d
SHA256

837d4fb915d449e3d711ced0f8a898e9bc94a0a2112e8689fc175f7cd5eb9bc2
SHA512

e0cc4270b4e587ea68d990af6d57d3105b5572542f30a32a422ac0a3a2b30473254af2c08bff4a348129d88f7e7be8c3204dcbeb51728e652b352c8b658f8853
SSDEEP

3072:SeGia2i0bQ3diyfkMY+BES09JXAnyrZalI+YQ:SesrnsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FC1AFE1-2008-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423402395"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07b768e201bd156e218c48241289c04d

SHA1
dcf3658e3d28bf4447d3c4cfa1250cc9d5fe09a0

SHA256
58e8f887c1bd90fa8ebaf51b7a4ed51be476560b81ebbc2ad0ed5a8a21120559

SHA512
c618fdf0a6fd5637349643d85350f1858132491e87bf7e1be1361ddf74d76bb7cde6c63436c4e7e5dae5def052386566fd201415e94c4c7c4ee74c48a97a6a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f07e2da1201e7a446284fcd0e5d1bef

SHA1
932960fc9bc15d3f09823ccb5474e26944933b7d

SHA256
373b2bf884c19087d8394cf4adb1b97ee32a6f196d7cf7c4d8af2a4db493bdfd

SHA512
126ce57837cad28cde97bba9b726f3f0baf4dcaac24e47860e05e954e5ca7d4e49ef5688cdd81c52bdd399bde1915c8c06642148290c1ca2f272e350994193ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02b23b071e33e042de18dfafe7fdc43b

SHA1
cec550cbcc2c171a326b66ddd3b02909cb09cf00

SHA256
8b3acec287bf419f72892ac4e6586dad1c341ac1a092995a9808169c8ff78371

SHA512
c02940519c393c5dce15a04e7c6a983e3647753cc6fda0b62221e023c8d0b77424a7cd691b5bc9d69a73376202693a6cbfd9ea565cde26d10e518d441bd20cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d8aaf5f6c22da96caaa3b1eed2a35a7

SHA1
0cee1627ea6f174a57057c9f5e0332b3e926e26e

SHA256
f69dc97e54a7a994b45d8a0414338f17e2ac07ab19dba9397f6fcacd82e9ac69

SHA512
77c5e5367016947a564f2e2917d92f0a2ae05566517c2bff24d1ad609c849f6927589d68c63ec39b0b471bdee6ea19bd3c16c12ce5d65c2238a6bb945195a786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b268e626bb393c1e7863f3a22c666974

SHA1
eecc9a0c7046fbd61e6c1b1cffb60f37dee81a17

SHA256
4457c16b8106edb2df47d2df59600bcfe457a48e755f3a703d89126324df283e

SHA512
138372126e1961b378be0692510669761c7d1d9b03e1cab749723d084b365b94dc2a42aab719650ef051c03da2a051b00253edc50d6ed0a2bae6bc985cb8d185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
205383775dd7814f8121c5cb913c514b

SHA1
3d281e0b406a0dd61970adf6a7bf819933ecff81

SHA256
7bf8e7a9831d46eb111fe02c121799924f5f6867646be3b1f23b33f7ab2b552a

SHA512
1e27489bf8678483ab328940e0e6c5b91dfbe523728e5a715d3352a3972d21b6b36267cfcb310b62b2935498f55a19c9c847babbd66d3f01d84bd16be115f3c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe008fae529e3bb47bf5f9a7ed1eb8e0

SHA1
31dd675b82cd892e3cb178e1938370fafcf3b3b7

SHA256
3a6ccd8d5d8c25253cd106d2ae2f6e6b54a104e68317b80090e10ab314af99e2

SHA512
d1b1a21481cf59cf50458073e8dc1f1fc64b20133c05061fe2cb824b33183ac4b3ab17dc81a616be7cd1a07ae6da7d379476e791c0841b6c4c141c02eac44277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4a1aaf2f0ab8b96fa5a2c8edfd38188

SHA1
b1407e699b9426ecc9c969ba8dcb363e7b1ecf50

SHA256
7a6a1543139d95dd72eaa89bc842bcecb168914133c6d90d09a275bf6dd1c1f0

SHA512
e39ca2e70f2d579c2aff323b88b399fad9e5aead893f45fbca0589215fb111a78f4faa78634e87f11afd3077829a3851e5626971e5ecf6f27129d90c662e3181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
996a04709eeb1739eb03f3cc494cd91f

SHA1
bf8712b96b56009781edf2b85bb377947f3f1db4

SHA256
cd1c3ecfe6a14526cb61d1bb3749685db333b7aa30e1764891e796d71bf8a77b

SHA512
bc1518f8fe44279134be14871622af2548864e633050448f95e2de742cdc78c88dbbf08932b2220642130ea5726fa6197ee513156e94b4ea485d031202e7fdbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5070f1b3c6da7bd9d59f5f974ec2ed94

SHA1
a662b226a49217b4408d2a399a1efb31be5439fe

SHA256
f67136262eaef265631f3fadbb3eae4916550a640f4ef962167472a0e7626299

SHA512
c85d068fcc2231554efc026e81d3c07f98c3b1d875fe996d4120e0280397fb408f069a6a648c978a1d5ed85926fe3249195bc7b9de2f1a2a32a5d593247bd538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba9bc3ab675df98652496050ac2c033

SHA1
5e00927f8ece86df2d279ab881636a69cd7589da

SHA256
4392539dd33c677c7ee7fd90c060b0f2929d7ad536e33d9b25dded10ea308430

SHA512
961af35398561e113e516937fe504859c960f08fd87c2e08323689825155d5315e986eff3f0b179d6b3a763419e195cd187534cbe0b42584a40baee79536b85c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8950436dd2b56cbd41be34b9c06f132b

SHA1
e7b137326e14e6dfe426cbf1b5c107c3c7bce063

SHA256
0d71ded6e7f5eee1d230631f2662bf88749d6a9163416383a122ac947e61deed

SHA512
51c24d9db34b2c32d57bd5f611e6e1427ff67acdb88c6537841f4a52fa7c16a66e7ba241f0471470f2595b112b2001a6e99f3fc9f52ba342626631a2750a9bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
948825de0317758f972c6fa9571a1320

SHA1
19f15957da26ee6f39b404dd562a331a976f2bed

SHA256
25270611b9a751b8b1facad1a9434d2e8ce3a14d888748de0124ada212787eda

SHA512
df2d4bab40c856254ea02b12bccfc27315f0329dda2becac0d32c5c14c68eb6a473d964b3d316e3f589447c151c42b3a98fe92a20d54e86edd1d24e9cc270670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb981a1c027fdf88736d3b8ea06353ef

SHA1
fa008e72d3c0eaedffb1ae7ea800fa35ac367efc

SHA256
4599b61393e83ce7b1b4d09c6cbcdbaa5694a33087f011771534aa89ce4b1851

SHA512
325c1848866a913933fbedd365a1d2b2cf593254926bbc6fd2d8ab227def3201fe5920f1a8885178f8db55bbbcf1e198f34075755023b8a68dcdd66c9adc8898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bebc88ef8b2adee19d02159f0d717d50

SHA1
a755b1e7643278fab12aa331c904b9b2cf8689f2

SHA256
fd647b094e53a659a11f5263b2b073e06be6b1bc7fab244b5575f0b68c99d9f5

SHA512
cc2a4b18502e53e4c44adbdebdc41254ea05128737358d30fedb8fb92ab8c4954bd001fa505e274189da1d5e0c1f5e077ae55676264c85c775199a4a6380cffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6defd6e5a4637e2ce2eca2d0d0ab6a1a

SHA1
43ae2bda41cf908574db3deb304a31c7559faebb

SHA256
beb04564204b533904f1e3a5478b7fd4ea04d990312ed7e1c47f9fbe3d7025e6

SHA512
6749ec847fb024f417206806c0b6067f32eafb4c408e696cd68f822c50c9c13c79d2050745b8a979faaa667a4e4aef55ee67099a5ab13826bc79530fe2e10e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
722b21c92020adab7224e5c339c9b2d8

SHA1
8a6988b24d52c2265936464100ed3438bbdee573

SHA256
97ba362a62af18a72cbd08c761e31a516656c1119be8bc9eea5dc66296261c76

SHA512
74ae9f1f0f9c50fc4c44c5c7bb45efa0b135326e4ec0fe35841d3149398ef4779bdedc53f820fcd468ceee3f547674a46f280a9e7ac5b2d64e8cb3f7f6fbf593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ef88c9c4a31e99b8a12e40eeea0b4e1

SHA1
68648298b4ad12cf4aed2390338eea3f6c81395a

SHA256
ca954f41ba3e6c31114d556196803e9f037b7f274085bd8aae0ebc1447b259f0

SHA512
30f6d89daac140a76832af9d4c093a7b62761e7adbaf0654274710da4e5b991085f8d4d5a4282bea2a134fa07188951d5c268f0d408165c0a78362547221b736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8724c183cf8ac68a22a64033ab753da

SHA1
5a50b32ff80f9011d04acaf1ec233761c4e4949a

SHA256
c86c1f2ae620227414806736deb70c85518d79caa899061a974a4a6648f3b5a7

SHA512
f7d915b516572d8cae387f033aa2837a9b85a239ff0a4369b39b726e2904366cd311d42de40b2c84568eae8c41b38451fc6a0d9b6fe3278ac4156e0d90aff4b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1641.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1722.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit