e4b917cc55ba174d7ab9d221dfb8b11595b632510b65ecbed0c9efe369605063

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

67861aca0d0ba7314fb3ff9dfddbc42a
SHA1

c1b22577eedf2dd9a9e0ff48d2f5932dfa3be0d3
SHA256

57f9d05f3a670d91e2fbbdee50b4e05026cdb747c8411576b1de2aa99b5d7d75
SHA512

b3945c628211b26403a51fa78cc306d83c795f2dd6fb9fcf0ca4583e50e0f0bf6e659a2c9e6a8305e50fd6e2c7623b99f03c46d387c1a9b72c11e0a04d4bbae9
SSDEEP

3072:StYK6SpsQxMyfkMY+BES09JXAnyrZalI+YQ:StBdxsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A063CBC1-21FD-11EF-9B88-D6B84878A518} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423617734"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2272	2236	iexplore.exe	28
PID 2236 wrote to memory of 2272	2236	iexplore.exe	28
PID 2236 wrote to memory of 2272	2236	iexplore.exe	28
PID 2236 wrote to memory of 2272	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3ff1252c9b7365e377fb2adc7dda5cd

SHA1
decb983c10a792a3723d4babd8990385e308b5ef

SHA256
4013fd93f764f317b73787cc4c5912eab39aacc13dfc1ba6bf153a1d68167f35

SHA512
d0ab86a3712f4ae8548546a8677fda69e11a412ecb0efebebb1c11898e767f44969abf578d4b02b72675280f39a5877ce26da201fb88db71a6194eb03c30ab3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c73639ccfba716b6953a44253bb360cc

SHA1
8c95e61edfe3cfb9d3f42fd4197d158017213fc6

SHA256
8dc0727c6dd736c1df0421da5e401a6828add5cee0b4ed640df7104ecb6398b6

SHA512
f8e8f89d2c751b10af893907e00a26a5dbf24ec21140bb1acb5c39d6b84ea8be51b0a9df82d459848ca572893eca9a2b67c1c5a72e14f085e3b07f7d950579ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff68b2bccb86b332e4fb4b559e7a6d7b

SHA1
09890f95032735d4afddd72ea4499b622908d1c3

SHA256
43648e766b3a75b83ae4269b37b8ce5d4a78378ec33636afc301134c05068436

SHA512
4e4ed3dc8fec8a4e7e69e36d72dde657591d75020f412ef633d7b93e2cec5e52b9415de688be32bb62fb5a088c37cd15a8b02b107ee44d66b9e015380349a9a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3f521d087f961cfe9b503a637ee4f54

SHA1
4703a5a53e33ea95e8e179ef1d96821f401fe5ee

SHA256
e4cfa33eca62cb23da7ac368375d9850996dcf2ca4ef26fa05579cf09ae913b4

SHA512
09b504463b4ce1a9304e88bd8af91452f51ec807f8684d22a804d09837398bf74828adae89abe52dc0d7fd2ac03514cf89d1d242f83cbc9ee68180bc6191749b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4e7dfbc767b5aef799fa2f6261ee3ca

SHA1
158e24dc43ba5e03c99e59cbfaedba50ee4628f8

SHA256
b3c40aac9da292c036d0c7ef946483baef16eee0e1b88da7b1c3b461a59f9f5d

SHA512
df0b4cbac242ef9b08c00f56a9a0b6694d20178c7feaac0b84e73600e4dfc584d435b23a21358d3ee109dcbb454be72c57425799740be85e02a628bede460454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15caf1c2c76a0351badf306305e11e00

SHA1
fac0c364174d1974aec3323a240101766d6b0766

SHA256
e10c6a444be0f12eb51f838b0153a9a291291d5b00207369810df4d2ad08a331

SHA512
0b632a675724cf12eafe74d950ec17a177dd3657e01c97352e927e7e064b6de3b8f26b44bc787e4c2125bf101fd84c3fbdfab3248b7d3d4d03884c79a76ad2d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50d000d82a7c54c2a68bd1a121def1dd

SHA1
5621a5d0f7f3716419e8bbc9026b7f746750e17f

SHA256
d893c5f95671c8bdf6b0e89ac470e21d13b089e5f9aa0fdff8bcb46a93047ef3

SHA512
76b3f93ffd2d7b4bdc6f24ac5d44c93c70459d63a0208c20ba253791e5d8c68ac3064a3caf91f1b5b25417184a81b5db865fd45fe63f1a6b4482060478acbb7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f213b9c949cd0c7edf9b6de34c24b42d

SHA1
e46225e1301a545d329ef57dce5dd47f4ec5fa07

SHA256
1218601b0ceb44ec9e746f684710325b097c009f3fb865f1d96efc77d3b0b96f

SHA512
f10a944d990262be05db9bccb2713e43abbb1929b9c6808b5b3b32202791022c0daa677e90bd3c4638b6f26cd03099efae71c609246032d167a3b61e780a0b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26c1c6aac5ab261fddb11befe7c8c93f

SHA1
a5079f57ba2af1dd86dba8ac8016e3640544d5c2

SHA256
6548bec41694e4c6ecf5f56f64141d340b70d9c17208b078c48ea36807cba621

SHA512
007c1a44dc436fad3732434130522785c451af8e780f84fc06c9e5033114d299bfad7acf266d318e4484a4c73413c8a529a0a77bb01b49886f43e91081c1156b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d255def257f7609890f0ccf0d6fe2976

SHA1
c68ec22346cbb4c73cff32160a6577f32e5bf122

SHA256
5f61f1c839b362c49e184077a696dd9b07e6dc82f559abd77b0834be296604b7

SHA512
e0fbaaf84d1f70359a409f8102271041c0c64032b15736faeefe5499d11dc41ad7e55c1529ce09b62f8837068a61bb8e845c56ea41e8395db9d295513d49e981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bf96c0e3b414b0f213cfcb2c474a937

SHA1
12db23b580505752e10f921c1e89bdb29b51c50e

SHA256
d944d83006f2ee281754fc7df0beb867419c8c3e2cedd2a62d8187dccab9e10b

SHA512
245c4e0768988c8b818b5a4d409017b239c6315872946caa9687797b32be1af1cddc1c6cc3d96b639a494472423aead05daa50a9414ce823af14de57253e4924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b83e6c278495bab4ed7972b372ef0428

SHA1
026f3ec708202c25bac7637c1f1174140eaf07e2

SHA256
1ce4e4445a08f1b9c9a1475e84e6946c4216d37db6bc25162a5c379837d65554

SHA512
3e0a32b0088f62b3f1947d74190e3221d9623f2f8fcfa87f9070c6f1534a9be667775ef215326efb53c92dac368ec86b4c8052a49cb50f7bf672847b37cbc402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51449d52102fe5cdcbc0992d005e12a1

SHA1
71c781b15d87a4166493f8c264827220d3595abe

SHA256
d09baeb5da48a5d3bf320384d07889aa90cda2187a29b8d3a821bc68242e88e6

SHA512
71e823438026ce8852395be7c9e26d7ac6310ca34f7515c7569ff51a1568007e4c89300125026b6b87bf2311b8daf01daf31c58982e15327243d594dffb834c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5a5b652b65bc44682f5bc5beb152def

SHA1
c78452277b5337a120e6b18dc8c5599e47736397

SHA256
587762ee1796c54aa5bc823518db52a17cf1a39d18d164a25b07f6d21c55c405

SHA512
7b7770f2a11b37278196ca4ea087edb579abb0125e34ab4210de33c94521850ac1628dc6f01a3bcc941701c391f11a85de8f8dfa22e5179f4cba61b19680d947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2732d6daf0b1c4bbf76e825d577424d

SHA1
4bf6937db50e1b2f2b34584b9ba3bd64b6ecfffd

SHA256
68f43da4de5ebfac9ad4c4933e4ecd4c4ee959acdef31154221c19278a459c48

SHA512
1227bb8344913d7bf9009b132c7383113e201556f5cef3ab9b5261aa92cef309de41a5364af216c30e540abe7e051cedff64a19edab7b5807fc468708c3d7ff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9a41438f18dd1bf7176c23c7efa4c34

SHA1
67cb73711ee63de907e0a253da430615cdb5850e

SHA256
4c030a3c7e7ad1e964991602121b1cad4a0bb3c8681c46943e92307b35c5c226

SHA512
e0c83c803cd3b44bb0251cd2ec6be42f4c3f7599e32f8c12f1fd138c39fc0608a5c5b0bbf10374b56215851fefb533c4ddf36088efe9f09cc74df8f8143ed014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
003dbb3e26138178ecb55055d2514ff0

SHA1
72fb8ec7d4134ac9e1c5178d0b687dbba4dcb294

SHA256
4f8def5e5ff45d1a7443287d8d63a0f18c6793bd36fbf1cf2afcf7c1fb333acd

SHA512
54ed10fae229f6317e1950e3a1c2da8d649c3e5ebdc45bc7aac30fe55b475a9d0b17aece6e46919d8a3cfdee976d5d8d90ba8ce5f81f1ef4630adc763e478e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c7a4a0f75948f6af791f5b869e7565e

SHA1
137657370585c2571cdfc63a46ff68a5fb82edc7

SHA256
8e747f1bfe7f2f58f96a666c3395580e3870fdcd9c6d434104e28ffe5e2b1b0c

SHA512
6dc6a8c627dba0eb488996942ecf7787a90d7e1fb1c3429147224a44c907447596adb87ff78a28ae733a73d6aea646a9e3e41fa6e5bc5407a3866a2422b2295d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbce3df957e209eaf8ad69fec467d60d

SHA1
e958cdff3a6201b8b8abb61390dd2008967b04e3

SHA256
bd26c1f6e2eea4789a5a33d47168611dfee2f79bed692532926a09325a8b7771

SHA512
e6f737d9522ce3746222307f6231af380a929db940922b97f601db589ec3818678981932d240dfd0682308f08a242498522b11306ad1a3be1fa1a63c988e7aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26D4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2767.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit