d305d7932bf103d4f2022da90be899943f3486d83a59a25742f95f637960a244

Analysis

max time kernel
136s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

312dde3246ace06b05a3bccc306c64c5
SHA1

258c3f23f99eb23ea542b21de517f4ddb02efaa4
SHA256

aa7c9e2a312d44af0029b269f354084b3d8f8c7398b95ecd5adf4131e8fd8b0a
SHA512

5e86e02e498a6d32d09675d80f916678cbf011895232c1aa79980222874b218771518f3810190c58e6ad1c381b55cacf7810b5ec278c7595a25afce14ff9590e
SSDEEP

3072:SXpDdDEpR2BFMoyfkMY+BES09JXAnyrZalI+YQ:SZSuUsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57211B91-22A0-11EF-B6D8-6A387CD8C53E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423687620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2496	2236	iexplore.exe	28
PID 2236 wrote to memory of 2496	2236	iexplore.exe	28
PID 2236 wrote to memory of 2496	2236	iexplore.exe	28
PID 2236 wrote to memory of 2496	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed5016380b9f67c00db32cc430749089

SHA1
e50f0d0837f620625eee66ed4181dde47befc36e

SHA256
f095805a82045a7f22c4a4262c66d4357ca7010f277f8e31f5d6f4811b7df5f3

SHA512
e08d4a65cb2198860aa14010b06a49fbe48685bdeabd601fadc09b75ed67a68cf5abea880267af7dcd0d39b3adb9c46b8360918423b82d23b9e3f99d634d52ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d83289b708490e0dd49476988eb757c

SHA1
6b6654cf0186959499f7a5484ed824846b4772a3

SHA256
7c22308367ae850545aee481e2aface73d6ba3f58c29784492b1a2e0344ac8b7

SHA512
6ed5d9b4482fce2f5cb6f437312d66e28d2a6c9d5621b1e4f728c4f4b7b1b40a0c7aae0d3733efb0bbf256e3926ea3a7ce87e1d32fa4d9b7dcada7d2380f69a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3ef862e90ed86c4ee7a665f5544bda5

SHA1
a1a2ca22391381ee2eb399e354f7b3d65f51745d

SHA256
ed05c5a3ed93f29efa9a165621adba095576c3b5e7e4bf69418f9d4483733c9d

SHA512
032c0e3e055c4c12cfcb579175186ce5949892780bccb1385b68141fefb81b76d8e2bf55ba05821e119e4869bb9adc5a55313c9aee940e4ec02e69f85aaec5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2a8b4ede85ecc145bc85694c55825be

SHA1
0212f9b96422d548252a51b643dea41a4faf9c0c

SHA256
46dbb34ec7d97d2e19143e29e8f580313d61b1e6e9836f75f1e4cf51b64ce735

SHA512
6adbbee251a4847a73fb1996132387673cc6849307ae2b94432b2ae5f4c1d4158c3a2229267e2feff8780cbebe344d3ff5992548bedd5929cddd7cfcf7db628d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a726c5f67a3274c56a7e43b5093500fa

SHA1
899d8693b43131c7f4e66e17683f514f5b5ca44f

SHA256
7701dafa66a9620a11b51fcbcf11f63a35bfb0f7fba9eb1e07d1678213bd408c

SHA512
e749117e8ae0663734ac0d4b92df5458a96acac87dc0c3d036a655c55daea037091b82d6aa0c2c85a76f88763e23dad2dfcca1b387e4b65b48e2784da432a583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48791e61e608d73ffecea8a5c3c9bf8e

SHA1
291d24758e80250286f8cd13e3c38b14aafd6bf6

SHA256
edac3f513d2d3088855dd7622f56b7b2b825bb44461c684b40f77fadaaabcfe0

SHA512
4c358ed087f97aac7b623629c3764b80260fe0b16213e78538244149843e882ea32c05cb966c3f87fc2e926f0b8d1e20a4779dbc43626bea2639f4ab5858331f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e89caef3a275db0c65621e9741563e47

SHA1
9d344e20d48ef7b6189df25c4db3ed618113377d

SHA256
67bd6cdaca8302f64fee1f27743527242dc0cb2e0a6294161516975cf0625571

SHA512
0cd94ebf0f745e183b0398423661462e23bea34b7dc75ef0419006737740cffed4144635271efe1980f332848b7d0d6b31dbdfdd55e277d724879cf6f021794e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e13d275e677f51fb1a570b95cac2b32f

SHA1
5ecb171967e56aeb66589aa1b72db08df2cfe07a

SHA256
afd4d5c94a5dcb36492e800eda65c0002dcf9519b6fec7fa35006c5326ae0be2

SHA512
a4d34d05bc36692fbcf28c4336785e0435563e7978853503e36dd4c0e85b4ea499de83b1ae6114f0354542dd8b14235e64437189e29944b2b3493a917e0bf90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8508c289fd7b9a2a73180cb638c8b686

SHA1
b4e324f05cf0e318354480828fcefe7472335929

SHA256
ee13a72ff1eab90358fdf96db37806241d105913f87a8d52bacdf6b4207d52ba

SHA512
a4ecfa8904c82ac22157063b5828eab0634f1d53db26034b385944e985f6dd08979f6e42179f76357936578a6a1d781b841e78c55cac44b394b7534747b34841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9ee168b6b5430a40eb25e91f9f9678d

SHA1
20feed60422d22b89b2f15188032c287bf78d665

SHA256
d69687078f57bed8e34c263012a6c8d4d987d40b5ec6ce8bc12507965a16b280

SHA512
2ec5e8dc4b3d5442e3d9ae6e6f8f4fc87d47db9d99a4bd9067204b8a81b02cddace8b180fd4f5550af74512448f19f67f4370e2cf6dd1c7d37400ee7f1709c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77ab44fc0538933d787a287172d68f8c

SHA1
38d1a2fd4ca0ccfa2045ec6da76ca692994d6147

SHA256
c9ca0cf403016d27b3ec0365bbe5a52649ca3bf5d7612863d3b968ec11c504d0

SHA512
d160607d10a9a39d274c314309050055547c3cabeac0f94f54e9762a29085b5c380a6643f93809e4114402e204b4397804bf702f88a9cd94a0d10971c314c20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f424d8a0e990a4c6653eca18fd4b1281

SHA1
8b6292236b8ba93c233a04c2908280c0722c22fc

SHA256
e8edcbc0c3f2857fedd09ac625dd75dcd679726776646c42a19abe2010522c1d

SHA512
5092e4f87ac2d2437923c72547b266ede1c55360b1807133a6d5887a0ffccfbea4d073c47739d083cb306f1584fe2f35a46d4a841d672d40f48641fb2d6df35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a15e45270e91316ba686862a30feb94d

SHA1
38db30f1479ce15f6dc3256703259dda718c56ba

SHA256
ab62cc793d7871f402f90dc1fdb0ff123d73b86e42b06755cfde9fdab04ea0dd

SHA512
c434ba177e23615184b81f0eeb73fd9f3912214c085f3108e0c8d9c33405c9453719b3677993e8f494f820b1fa8a3b0bd9428c669c450402b9244428ee0a160c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74ae653dba4deb79d8afef750d3d6919

SHA1
c296a5b4a2a056e57596ad037260b44ae0bc0446

SHA256
92e6fa92c5095b14e7ceeb3a0819744dd6cc23ced82e7f33faacabc3af740d99

SHA512
79d28628b65070abdbcf4111ff1b353b360049ae74a415d5a5475570b2cabb2cd7a0b13ebbffa3af48e58fdbfb9e52e29f987aa04f83c7b99bfc8c8f1f2b550e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b09ef44a2b57f3cbf35e6b3356e2992c

SHA1
e01225d0bfb40c1754d4a255b5ea8f0b6d2dbac4

SHA256
cdbb3e3b1af23e3852de8e28726aa678b73acc09ae602a6d7ba8f2f2ac4a8d7d

SHA512
fb04195721b5aa901c0cffc3f6fdd38b7ae70b0f41edb0039ccac306981a5c578b40a20f82b21b0c3462a59c0e245395767759ce4ddcf58e766da5ce1262fb10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab198A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A1F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit