21c66f470a62c00900947ac1a6758e5c99724ba2c5d98b32f7029ec8cccde6c8

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

3ca51adc6c792ef7fec75964f0c3c2b9
SHA1

cfacf9f050242f52dfb58e2ed0c73c1f1ce01a56
SHA256

f5cbb125658d8fb208de80c93bc886ee2eb72f6b04dc349b42f215be79577998
SHA512

9fd61856b3f87fa0287b6b5889d57aa6456d70bee44277414352c3deaccf048136c1479a8ece836b10136ede86df6013d5e79a7ca394c922793827024ba6d529
SSDEEP

3072:SZF/YD1Ydx+asyfkMY+BES09JXAnyrZalI+YQ:SZNCYdRsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65FED2D1-2172-11EF-91D8-D6B84878A518} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423557937"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2440	1792	iexplore.exe	28
PID 1792 wrote to memory of 2440	1792	iexplore.exe	28
PID 1792 wrote to memory of 2440	1792	iexplore.exe	28
PID 1792 wrote to memory of 2440	1792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
190194ed5ef5ad0ad81b5ace9f74698a

SHA1
63cef1009e6780586421bf4c6ff6efc877a231d2

SHA256
55bf4cb81d787df9427b74c06afa619d83b68ce891fb0f8e2161e42fa65e7801

SHA512
292959067d9d0e43ba4c66adb5b1f66ec8038e99403e6ba3a4993ab2e1d71e7cee8d4d645683e3426ac1316e9c399b00c22d60b6f912f601289101ed304da156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
382f84640012bb28519595502fa5ce0d

SHA1
54695b12affa5325d42f96989812fc5087cb634c

SHA256
5fd16ca82c0936e5a24521d7d091269c0efafde4849aedf61843f177cd70014d

SHA512
60e31b8336f7161743fda1983b601e48afbc2f83ff0acb90d0d514960e73a17d4f3d1736bb64d94837534de295d8d54aa7ffa126ec5a7ee0f86908c879236353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
383f66647f8a92e0707137717e5e50af

SHA1
e331a1cbc1e526d73ed3a6f233de1d770e33826c

SHA256
a378d21e875f8a22fdc7a40eb20b70bfe62834d0218bc72725ac4d7f129c31ca

SHA512
edff083e161ec8f32f26a7f9d8d5841d97f01bac741d97f8e8064b62879ca94266d9a56cfea7e727c52216d6f21d1ad7e2e4c980b97f54f9768cd887bbddb103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21ae49bdbfc6b187082366f69b910eb4

SHA1
ba365ddc74963a364a00c26e0aa92c6f2d8d4962

SHA256
a6dd560db5c2f24a99b76592f6da3a71001c418165f25fbb159acffb670f491f

SHA512
1e8074e0a14e6e875772a5482b7d84df7b9e0ce4f757093336dd1cc7d2ac88d3a2e9240a4ee5158047d6892f1e50445bdf377f06a48543ed4175e5c27d602660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c73e82c2566ec0368690f14d4d3df62f

SHA1
fc7bba3fe997f0f0cba9681d7756428c07b0f4d8

SHA256
e7cdf57f5ae108def270fa7a90bb49bd438212f432f9e2dce3a989719901a30c

SHA512
ea7af41d214001c4447f25be6c464c1c311b5fe60fba36cd704fe5b7d136ae6e04f33c5ad46b6f6847dd3113502e9da57180e36e08fbac0793b8b980add265e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9785ce4a8e278d4b1300f15c36b18d72

SHA1
02834d1465340e42db63a766514362e7d1d4baec

SHA256
df9b34fc1c0eca36648e2c7fa54ce590ff9cc30064497fa17de98191f38e7146

SHA512
9431e40a45d3148f05598d2626c66a2efe1c26a6d70b2b1c1f7f34a8430241756239de9926d825c6254f57b2818ee241aba6044ca21acee15c2c6a44bc6ce3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d080a92162972b64d237ab61fec9b5d2

SHA1
0a54f5c9515d7fe0a2f7af0dcb97efc0023ee0fb

SHA256
403f8c71e59c3059fd5aca731b8e89e4f2b24167dd58d1697c9c0576b232bad1

SHA512
04bf5898beeaa470e31eb06fb1db159e9e68b6a23d1cafd6bf76b7638f4331392ba47f7879f56ad7439cef0504af46b8aacc9f6cf998ea1ea4a381f336119e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa90b26d9bfe44cadb11e7980f4b1290

SHA1
5f41462d4f055208c35f653d921ac54251cd2e3d

SHA256
0287e06141f9d000ee8de1a79d8aa7037a59f61403b4574838148d2bcd6372df

SHA512
38225a34ed165d610e1ac54bf4ab7b9eb65985a1a2e68bea6e785bbee78db25fc8cc7b3902c85d6113187df34666e9a37cdddf4b696ff08e09e71a02f56eb6b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f66dcf941151eba493d63e409e03bc69

SHA1
65fff0eb83f9e52088c878464ec2be3288d2b303

SHA256
bb18ab7bea20e44f68a0f6032956bd654778af93b1974425885fda8bde11feae

SHA512
bcb9925acb4bd71aa653b74e68edc1a90bdf0fc8cb024620a0b65072a6387de26ba99fdcc52dd150e65212abbfd9971997e3ed42e69985d77e6685083736e752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6649e68d4914c0a71a55fa175ae0d12e

SHA1
f752cddce28ff47f779a31dd9b28c35ff22cd0f3

SHA256
836cdc1a73e3642a605c7a0dc6287133eff10243a767c818c436dd3b7681dfea

SHA512
ed2029f5255a0ef757826206ae86cb222bb91105926606e35f46a540f757da33d12fc67fe9c63c7becc5ddbc4d20f3ddc68f4b91e9ac08fbbedcb79f708e24c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcc623b80223ee7368284c209389e4e4

SHA1
bffd9ded343ca9134e9cfd56d174dded1c169977

SHA256
edf3f62d7b67bcc43301b0c029ffac483eb8b93306808fac01e8379a8418fab3

SHA512
e8e30d7586c1d24d82b6e215b8f90d6463dc7457298191246adfdfd7095384dcafa2e6e87e0e2ae600347397fcb907904e0d7e669fbfa52f69eecd50638c36bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4052bcb673cb3453082d3d12e1f1f0ef

SHA1
d6205dbbebb8661707662ae68952da9c4f825081

SHA256
eacdf7a18963f5cf2a77c8fea4ac8c33d79a8b8eac49318ce5edabe104e64115

SHA512
a1b216795e50a5d8463b9f26035168ad8cb157cb06811a6aabd35bb8e895a8d17116e7799592d314c13bbd36b05b84f70c2457ef319ae20d0d3927ea5c543f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd2acc5d69f0dc1bd94449091c21f94c

SHA1
509116749cc7a1a900a16fdde02ecaf5ff88eb89

SHA256
8d62048f2b041dce94cc4c0ed15a20411379d1a05b289b780656a62bed85b40c

SHA512
f34ad4bd499a4bbffb4ae1df13edd2bc3d7b525c2cf318ef7f3c4365a35a03fe30bc61b93034ae339077bea4a4d2b9bc7e92bbad9edeade25f5ca125c0c62f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30c33cb8130ee734a969d801a6b1c5f7

SHA1
7e5d809244c4a6e35c2c1872c75f6476a67be8c0

SHA256
8a0ef7921d6d5375b1f4b5fafc7a0a8a7e21abda073e3d4e8148390578934295

SHA512
4016fc201b84063450a8e47a000ac70f6829fd8585d186910323bf397ed92202f04273ebd5f46a01da96b971c83aee9b2569e1bc7fbbc513e179ddbb03ad192e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3bec7d43978dff8a56d182cda6725fc

SHA1
34d41671e62f75f0e52e2d1143ee9a2019e6b878

SHA256
25326d63a4907274f592a63317e49b4b8344e2359fdc641b0204fdfe4727d9b1

SHA512
a3b0173e2ed2f7cf3adae5c89c665b2bae43a6c9b114e07af4073cdb4f48cd0c702ad9c6de25de889e64616a0e74fc2bd7014b58b7d36573bc8962826eef2b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c0a7b3bbfb6079ad993f4df133f6239

SHA1
95e1e1f545a6ea6b55c84d8c45beee0b72fca0c5

SHA256
89a0f5af4adf0ffe50e74d2cc17b2b8e167de2984264bc89099729344deddf85

SHA512
af4c6fb9d0daee72397e18cc7f10fa25db55843e9d3abdb78ed3182abba306e51ad5ef9fd6671f3a8d249f5a29e041ba12e4b2250102bb230b776d2846a77b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0955770751fc1324732cec8b67340ca

SHA1
852f82cd9bf9c557f04495b9c19045ca6907f514

SHA256
a5cdc45731b8523740e28492896ae6a7e425763f5e45d208258256079fa6e58b

SHA512
5204a6ef3df85eddfbc8c7dd81a3166f1085a20c1b6b6bff3d976ffccb22609d7ee6cbd3fc78bed52b136fb5f2510c0911cd46566f5bc2029d993faf481946a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc6f978aaba7e8d38e88667c5e68b841

SHA1
0a8281af7fe904ba1e5087485576a888f88da49e

SHA256
7eb79896385815cddf22ac2a07473b7fdc7970db4faac747698f96654d294323

SHA512
f4f40d11628e5226639fdd9c4c02750218c5235d77128f3806b844baf3614aa7d7e0f035cc7cd4fef833a7e498deac84c4955c702f53e045717ee4317a63c395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a87e4f4e3093f7af5fa3a17206bcdf7

SHA1
c26d53821eb624a9c1dac33c8efd851faf71494d

SHA256
437bdb5b9e616f80e1f65950aca0cfda30018a4d25886eec4a6abf3101b395de

SHA512
edd2a30a5ca08eb974a3c46d129433981a60796ae4593ddede1345d3ad171eb7f1d81d641017f3c0bd6c2063ae914deea9bb73fad82f3939df15471e9ace2583

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab148C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar152F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit