7694d8f77f05d36a881ad7cdb39ee48330e73f28f1e989dd97000bc6f79c8772

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

363e095b2a58b423bc05f2a1d7303cf4
SHA1

384968b96767f2f14b75cd2416f1675974f4749b
SHA256

190bb8f1b5ca799ec1af6911b6cff7387ceb1ebe5b1d0184aa11dde4b7989170
SHA512

3b6803fc6d49ca4c299da52bc0ad8a4c620cbbfcac1b65e165ef188d69c6bb2baf9807273959000b44a5684295b525cd0a1d84f832f45d62249910e06274f2f8
SSDEEP

3072:SbGoS0BSVxvyfkMY+BES09JXAnyrZalI+YQ:Sbb+6sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423501065"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBAFFF01-20ED-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28
PID 2168 wrote to memory of 3068	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f931650b017ee21de4570a01a2f663b

SHA1
9cb58bb74b63fd808c0d67c60fd2869623c222ae

SHA256
0cb9b50b9d1906fab5b01399d49f52fa3917a2e39039ea32ec35c0d6db771fd8

SHA512
d6c17bb8663c6839ebba932b7c0a29a94094f49ad0a0af3389ae467fada173fd5f00484d665713a80c1933302aa00f5adb82d99c1d87ef41b813f3c2a5ddbbec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fead35a44adc7c3d9a798ce18a65da8c

SHA1
6c745abab78e1930dabeaf07d45a9f56f98f9092

SHA256
b2cb9c699cd647e6857613ec11956c201ca14be80c730c0dcf88716e24a6c369

SHA512
69c623a6300b26eb13b6d7b024f333675f59f9fca61072728dfcb98a3f9287313caf61a20a8d685780bbec2267681bf6f1578d0207adb95d22151a536774685f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
414f28d528876ad08997efda27d994c5

SHA1
f244068fdd080cde33a82acb2ce82a104cdf1116

SHA256
cb7baa5be2e91685db1bb9780c412890a91cd3abfe60a03c6f9f282a8b042e87

SHA512
b65fef195a993548ae3918c98d6638c711dff5fc5c67bbde5d9c6b96206935404831339967d1c1e33d70b283ca663961f37ee79c0b7f339309917e566f69bae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b200ff350771c692ba2b534f69d6bc

SHA1
80157b6510221d492d4074567f7d12031de3a464

SHA256
7a3bcdd4846f8f5510ce8f6da4172977eadb8d86f7556f8171458c39336fd394

SHA512
61584c1c8fc313260172ffae3f29f6120ae6aa7fd14051e08b73100f9f34cfad536131aae377147aff5a92a11523e207f89a8149e9e9e71af1d1e84a476c9470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc3a5868f11e37d32c300ba71a1fca2a

SHA1
a22dba86bc3266ce0446aa54e091142823ddbeb7

SHA256
1a675a3c7a899545341bece26bae419f9d5c6e24ac9b708b53616cf0129dc5a4

SHA512
d00a61dfbe0ac1c38186736b1069dfda94657e3a2628b6b3cddea239a51b4205461321dbb5ac36b003e82487a272819f2300a52f5fbb1d0d672643dcc83f2482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3af84078a1bac5505064b2c32f5ae7bc

SHA1
f30313c186f6bc2918646ad64aed0afe697084c1

SHA256
c17144e5ce2bcffec4c8f8bb1781c189395bffe3c0c6e5f7fc0fa3269ef1a23d

SHA512
1779a02057c3ded8b40292b9f85447a9412db8448d4e901c95b1d5712f6abda890a3c1bea71520759f449e269bef6a71851ecc892292b10b09c296f43203273d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e768028b5d9db9442ca92ee28e93edb0

SHA1
7b17690555322baf5ca838d71b9e628001918fa0

SHA256
83eee84d1f37f58e31f20be06e57f0099505f3d86a5e3cec2b201f9d086c310c

SHA512
731a545f30a99410d7b9ec810139b213f8939c815708c7285976377f1eb790b19fa77c0bc3bb78e3c2dde0475a2e9129dd58747f2db30a345443d17793020ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b12b8efa77159c4854cac5ba747f775f

SHA1
816b60386207e12906c91236617d619381bfc2e5

SHA256
064407be393a9bb3d6f2538e5eaca637d745f1c5254d05e0ca612f25a5d618db

SHA512
ca2b4603a1068fd22364d02a3e5e3178bc73e7c00b0f8e0186446db5795d0cc8a1fa3d0706a84b9778a7089887935727f0ebb6a8b962eba1c92fc49406046fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a04f02b9b0609772236ea97f995fd80a

SHA1
641cb7a5268957fa356c43871852410102f2283b

SHA256
96f187b932a28822fa69d6da71cbabc3996d179588f17f94f0ad421f27830e16

SHA512
019118871c0989f2aaf082f1d194fd83a6e0d38278719db58b9c73a56b8c3e0b95754f19a60eecc507804ea16ab24aff8c28fead4cb7890259cc2da5e3b5f2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc4ddb41eb1bb3895363d4612cfd7642

SHA1
17e4d88bf6b439c0cb752204142b7261eb82b78a

SHA256
f4d525230481353c3c60b5b49b699dd0caf764980fcb19bd8737305789395263

SHA512
4920bcc344257a79c75bd10c804e67c318b57bfc1a4d11ed8a0fd617eb91c2df49d27cd50addc99876d95133c0ddc18cd3ccba6f23b2a66da52b70f76239bbdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a902aac19a3c13ec4bcaeab543945bdb

SHA1
34b7eabc8dfe4f29e39ef2c000b7fc867b4983c9

SHA256
3996d018272079739783361a52b611674b8689e5fbb38110efb0a68cd5144598

SHA512
d32ff0f7c30ca73790611c64a4fdb89af79b3dd121f0b831e8269642cd8d20d7d94c0bede5ef8cb837828ae4970c0bacf67f2538f5e8fdebd1603f871086a590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fe005e2c5cc5fca28feaf1810d728f9

SHA1
2caf240db747b7bafc8aaa64e59d8d52b8659db8

SHA256
d49defd739e12fb3d199e8cfbc2e7e09121766fa5f90954f73b0a122885ca63a

SHA512
80379e33c7ad29b2301d4700541a273981b2e16e3859a67f93fe00bccb472a81888a86bf04462a91e45aea94ccf48baff04ef97803885484fa244c9a43769980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
789e60be63ce28a0bbe8efe7a81b6493

SHA1
693f9d3f686cefbc95f44c6a172a4e033769784e

SHA256
b3b13ed263d052b030191ab000dae49ec48106b2085cc89a889739948a53ba1f

SHA512
0a77ff51fcbb7abc13c4d3a1ff45805824471333378c9313c21be9e9536381b08d81cfcb7a3a772fedd3102733b27b8825e29c377d8dab8d9895b7186aa132d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43cc2191135ed0552d2cfdb758d652a2

SHA1
a59364b184b0e0d6600c94375d87c3414a913e70

SHA256
55dfbf46895d34175bc8c3a5d1eb48c18d0f14022ce4910f7c4996b7d2dd7c2b

SHA512
c884f53a0dfaba80aa3c7887e39c92e71bd01f1e87af58c27c93a2d4f190226749e2990f1f6dbfb20d60e9d205a7254242aee9a5858994b7c326aba0f5fa972f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
135dcc4bc0bdd824546b6de5e9b847dc

SHA1
64260688e16c12998bfe8841d8577755969d92e8

SHA256
59033dcf86a3a7c7df31c069f734248c2281356a97e1e9a5f179df4ea5d590cd

SHA512
dcd0abd8471dba28314aeba2138ca0cccc34b074c3b2c54c211d49f204a1a031b90df12cf98ed68d64e39b0adcc668808d1cfdc96ce276817d3f50723fe13196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80857f4f29b783f98ba8ca8baba307aa

SHA1
bb6b594589baa0d7b343413abf2869837e2b405c

SHA256
ae2cbbfe106b9b7dbcb2065025b10352d27d4305f79b3ab09f25bd2c3cf43c3a

SHA512
af2163b35319b9c191892097cbeb7bed96454e46a4da20c59356b399de0b4f7eddb8a4f867626b6e7382044cd5588d52a4c2471c3bb0a1fb4ad35be6faa5701e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e28259a5e3d06e454460b6e124fa8a41

SHA1
7b3703a2555e3f5de3ea15eb15205b1b949a1136

SHA256
d7d22576225e3273929464f18448883829d2431a889ff4691c4e7f615fc5cf95

SHA512
fdfac1a790c1a7bbd2b98253808aeeda210b56e8ccd28085dccfa24ea75dd802a96c06619ea08dfdb56914079983d6c279659430695b97181e5f3f9757ab3dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb7e1cb70f06a72a5cd4041f25095cc9

SHA1
a083b03748d09d15f871b472996d627c6390fb10

SHA256
029ad1a6ce4fc49f6144968cd53a7e52a2c011a4ef232b4a238029386352e23c

SHA512
50313a0f825829eaea899681ad6011cd1ea5f578ee5bc53664cedc39171d95b8f1c45e9a0c7bbd1105a4e6bb325b411178dd5f22d49df6bb001268ca228033a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A7C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B7D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit