a8f64fb6c94d4926f2117df905f9ea567a8a940f5321bd18c96afa0574cf3503

Analysis

max time kernel
136s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

80447a47e6b50c74dd4f8d81e96f73b6
SHA1

2fda8c5f17e1e22a712c56aa807537c30731ed81
SHA256

5c42a80b5f4d796f21ef735ac4ba8b72503e752f7ba6705b83713b0e5c55aa3e
SHA512

fca4170e94d95c3ce640d59687540ac9c2592fc748e710051acd3a1faef0d363bf6d891b794b95a3838c300d1c8201391cc9df71dcf0a8de3e4c6f96cd1e099d
SSDEEP

3072:Smcu98j1VDbbAYYJcZj/ayl6g3CCv40I+fbBjfRr4I0NJNZ6JmlK1PJ+Pn3N5iyH:SnvUxsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4DBB6A1-2216-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423628588"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1284	iexplore.exe
1284	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2032	1284	iexplore.exe	28
PID 1284 wrote to memory of 2032	1284	iexplore.exe	28
PID 1284 wrote to memory of 2032	1284	iexplore.exe	28
PID 1284 wrote to memory of 2032	1284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8027aba734e7c8fcec136a91560928be

SHA1
5964c2fa9d9cbb71d49273a2f64f80089912976c

SHA256
3a1b86972348e1688490df2d9f7370bdee1f555bbe7970887d7902ebf96d0680

SHA512
7092acef55ae4082d30217ce0609241fe680a8d27dfd178a8f445fd9ae44914de302c7d5f4c49738ac078854ee6a278cc4cc50e7924688c7101405599fd7a84e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5774317801ac21cf03d1ed92e15f5a9c

SHA1
b84ead2e829240026eed8b64c673bcd9b3467af9

SHA256
7dca93eb7007a870aa0a25e488d37a8890e4a8947fb007cf8c5b5c2586b598ba

SHA512
6ae7413dd1e3b946d01efe6dc09b8209f05675defafca88e341fd6d9d17f0790af425cbe84b0f849ceab90b0041bfecc3b00386634c8be95e206eafe0b098148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9de2b8493de889e8f878489f01e2d1b4

SHA1
0d40758a5332a9857430e86a5ac47b5d59bb15a3

SHA256
01d4a23833cbe2d93d622de23a5976a679c679c353cce7273be1ec8b35d8f21a

SHA512
250e22cd9dd89740a88490173b1f734ddebc22776089a68c07c7b0595921a0c9a404f17f290e79c7ee400e272494ede850b1bee658690e2e69a2e8cb875e028a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cc7a28956a89929308f46c62d83c1ab

SHA1
bccea15df718d652b674678e874a9e99d969a7d3

SHA256
0df898a18c707361edf0a5494c6dd09e23c3046152d9d73f95a98e94d3302b93

SHA512
da148af228ebd2c40ee73301dc0f37b408f87e4f32a24de7d4e6e16815380cac272026938d8c5a9055d791de4be2bd3a10fb94187c492c6853e96ea57cd61fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fed17b8c7cbb6e05b8f220b38ec6e747

SHA1
d4f824bbc8006c6b8b35e04a2b18e0bf6648bf6b

SHA256
6e61650da41bdae54b66f73f4a5762eb1ac7bb7903b0d768932004c6ce6b1aae

SHA512
f0dcc5eca5de5994031be0cef0e4b31eda28547f1029962afa1ea482c076dce9499f341a9d7065e667f9f13f4f9fc55a876c0a03c7f88536f4fb75ac066caa50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86695a7ae3f52c7084a158a3e943aa71

SHA1
e4d818ad6e461188aadf4e597196c84b38822626

SHA256
957c248116dd8b5c3444a5d3689260e57398c40c1859b7cd8c658622e0f3f7cb

SHA512
36a3c5dcec7bde57d9fef39686a929df68b8f91f50b91e03b87f2671c7b64407243bb6d596989d96d1b3e6528392170286a94d4e594d669eb0fc25c8e59c86c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff01dae7bd82d5610df90025275f2a7a

SHA1
d26539910b7e52ffcea63721b4e23b7eddc77dfc

SHA256
5b4c7e329a086d2958b18e19371a8680e84f12e887aada09f35eaadcc6de8048

SHA512
ef46519585b1499295c809b972af7a58639100253f7400a7f52667a113a1ad07b2e72c59c919036a69e8409d967d63f929ca3b2865c20295ccc197cf5da35b73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a790dcaf60337977276eaf013dffb3a

SHA1
f4dcd2b7a8650920cc95ce75476b00c83b6b40ec

SHA256
166858c6fb6630dc5373ee9189381e5d1c744fa897f223144ffca6d3f9eb4473

SHA512
1cb77c44a7f522818534338124328f88f82654503f93a7c3588287501a5c7d14e562fffd3ce0a55829effde2eb24c13203b3c385d182d86d82bd8a4e6c8c7b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a628721f1e8dd3c5c180f738bb0642b7

SHA1
3c333b721478af70290cc8d2d899543a6d62a07d

SHA256
327d872eb8f54f81e6fa9874bbeaa11f8b8549acedd663d25b73d1cc8792aa80

SHA512
d66ad66aba012db0101f985e3a42412adb2c9660f77aa1f3359742dd50d3c1403dfd6425edbb3cbdecaef090a79548940edaeda5fcb61d70ee37762b438103b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e226691b184db3b18c799da70e5ebf1

SHA1
1e08b8680cebf27782fd57f9d3d219b890b6b7e3

SHA256
ff6bca67e4967215f6c7e51a14c957674309fd95a8b3b7959ce683884d8b292d

SHA512
7fff9fcbf525acd36cd11f9f5c92bc8bbb1e152b7b5ec7865e9cf8ac65096687442ff6cfe6391f601979751aebedcdac156e41f38e390d2ad5b16981f73c29d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
498686aa3fb58067dcd67087e1d28416

SHA1
f901d6c61af1dd7ec174272ab84361874c89032f

SHA256
575f4ea2998447f3e3a040264c75dc49d3af41e86d1ad1fd0f0196ec8624b027

SHA512
205c9925d80e74ee973698c2360d224304f26cad9042637345eb8ee52bc45a014a765d3d6072e1bc3a12d7a38d50d7c1a75ba68688f3f59d3ba1ab9e00f97ca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea74a8a2af7b8da1d4334971cd169fd

SHA1
ea94e93309f647e740920277c70ab4132edb2d3e

SHA256
8b1371f29146ebe97318dce51a554145b44c7c7892dd0903f00ec050c6239cb3

SHA512
38aba42bff4b3d3837309b156dae05218f92ede302017921cf337f6fac6268b4f994070f187403232374ebdf9bfb0b32a0a69d215ffb68541215afa81ceb81b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be75f1d0fd11cd5eea10960e90f09e25

SHA1
a678b6bbb648705885fc7494eebcd95b93c92a1b

SHA256
5fc7c0b53f43c0983c62fdc6d14d0f3ee31e7368956953090bc0cb69c22fa581

SHA512
8e239111111fcd62b7bf5588f77d0255bc68611b60f2e84cf4f9bbecef82877dfb9f9668927b266b03827f3fad1926bfa1bada8699881ecdfd68d9ba72a8be02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce3b0fe81e5344a1bd54d67ee62ded3b

SHA1
48017a18638e0b8f5538c2d4dece02510c92b33b

SHA256
cd7107000966f16b26b7accc762a81887aafe37bc370515063ecc894adc06da6

SHA512
157335626bb1345adcdc0fecdf2756884fa5df0ca947d22445d3f95ea540a9a23634bee5112d51a76b2f9dcd0b249ae0acb94aa845543e2b25e829ff223381a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
224a71592c55f76709f435f5ac48bc93

SHA1
3fd956d0475ac8766b8d73a4050cd30b20ac32a7

SHA256
8a26c59168f8ea6ab7a51d7c480f1a80e984a9bb45b50c86c5503e4d8e201bfa

SHA512
9b09aed7a5b17bf2dd84498ac86a5badba1cf018bbd9a0b98e51ab8973ed57159092ebcf00ac97cefa54fb30f6a88f4a16a0c28ea024776422a8acd6efc0ec45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54cf2e6c822f5225afe8312b37c1d406

SHA1
3ea0f7cf5eb1447de70e8f6ee20a9e59392b19e0

SHA256
1d9ff58170eecca20e4fe47a2eb11e6ef1d0d35ea0367f5c733605d2ca593147

SHA512
e622c3bd6c08b94bb7872d7e317791aa8ce2a52252c00e86c280be98b9d919e9ac0c0277cc0221e141be1149cc31c0c5a79d5f9c9a6bad9c52cb85b229194fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81bf5320c1d758b2d3d0afe1cb1f2107

SHA1
e179324d02b8000bc1161660df6fc60f59fd1d4e

SHA256
8d508d47ad182c59773265ef680f8a8ae8eb5291afced2a78d97f48eeb2cce83

SHA512
2d11cc862989d68b1ba8a15a6d3eb684099647f88d0f2be655d52d2dec21de696df0e1c0395165032e8330bfcaf02e4234c17f5e74bc6840f8f992f2ca3cf9cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0fbaf3fb966078a5952c56ba26baab6

SHA1
eb95bca33359e980a53692780daa9b5e79a8e54b

SHA256
eec6d724163908b45e17172b0d9dbac81903f6a6da4ac502d9c36642c300b77e

SHA512
d14bd8b50a75bdfdbe4e8dfe397ae97e9cc42aa5fc438cd168524d7c21904e583a77280c28bac402ce35118dc402c4e5c906e7b478f83cac59b795392270111a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28a4fa5c0b4ca974788d89394a5de1a5

SHA1
10f25edcbbd117df16d7c05b3b8ba35fc0af19ce

SHA256
6178c365b603c4fb041715445f8e7c9d6d622d182b4f764028be26964de20cc8

SHA512
cf4bccf3c192c0066246b88e49aeb62f55b017b9aea61fe7348b48f6c1d23cc396a489dca4988793a5c323e369ef62f34daf01cd31b8e880e8c357d913a21cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E7C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F5D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit