7daf3983cd233fba95d837dba964198583f717e2459ac529f643a7805406c7b4

Analysis

max time kernel
135s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

dd4d49f12a67032b56e96a8c1821ea44
SHA1

99e37b93a3e03e913aa8cfb1eca9bf017da8ba87
SHA256

0172f259052173d61c69e72621d5e032e935b81d8fc357f3f822150228d03b76
SHA512

22e01b12124031d27c523c663ff5e45a9d9f6b88111103a406b54a7dc09c71e472774649672f68861e37fa5dfc2bb490644c290a6c8efd9c3ac7f0ff8a6495fe
SSDEEP

3072:SF7TRDXLBTYyfkMY+BES09JXAnyrZalI+YQ:SFFxVsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423713218"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE2DF451-22DB-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa9e69636bedea062f75b41f8d8420e9

SHA1
640e176317f1e683663142d00653eea4efa51dc5

SHA256
f72642e501def09bcb184e4fb56a9739cf28712c56faec73d82ff2a9e9edaeca

SHA512
11a2faefe1af26cc4f3819bf92dba22dd2bec13d2a7c67f306efc4094ee1587c7e6ccff298f5899e572eec97ac0681df995a9fa39802b6342135961b00d910d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98371a1b59b7f1e6d81d2dd644e29c2b

SHA1
a859440bc61afae24ac897c3d6a050a937cbfc22

SHA256
96bf5a1c9bd4b25e0dd743910c4a730a5d6fe70e1ecb314588d3058fa09b0b28

SHA512
2d04f833bb1f965714e6700331698b4d00367eb4c64bc36b79b89c6214543d77c957aabbc09e18f36b98a1fa4ab108651410ed0887366ca74bbe8f8f931af79c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46d330359f6d02da37a4511ab64ca8d8

SHA1
83ebb6353e38b02c066cd9bf8bf02a8892afc298

SHA256
8520096a25b96243ec9c2f8f4d8827a383d8f5847e85670245d38f8f180507f0

SHA512
32da54f51b841323c776483f94d6a9c467342b324160c174955881746381dadde7a7b0fda7b00cb6365a67c6d6954ce0d09f675ff3535139e0d2353661a66725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4367a953db824b2d0c413957d49be0d

SHA1
92172590c5b65a6bbf538d696048e1c4fc2d1d98

SHA256
036ee0e7658bb7fa67d91eb1bd50c435d664c630cabdd0335f9bad27b949334e

SHA512
b1538b61d7d3195a53364eb4fa45dee58b873b66c2d47649335db8e674fed254b1341bd27e96bbb1576ed7d63baa5be45588537d61a2502d15b413bac0609543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef5534fa5c8c7b0b0ee7ffbef2a45d1c

SHA1
00f705dbdc0a5a6c8239ff029d35938837b8d51b

SHA256
185ed2031f58013c82e3293474604908d9d02e0af331a25c08b850843ee11f8d

SHA512
90b0659f5ce62a32a56d83faa81269bc4f74ae90712739945e2b536ba40b9a18225a008abd29151ea980e91aa27b217c2200ed5810f95a9a3c8ab0f39d2efeac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cacb16c364a1ff52ec444170fa18c94e

SHA1
d70b33a2ade7b5c926c224f81e009afde9571fa9

SHA256
c001fa65cbdc240ffcd42ab3babfa51b29479a509e7054efd80d06327bbac5ea

SHA512
d6c6137bf40656c626b40ceb8d66795860c0ef623873315032d1c43aab022083ba0990248fe6432db9e9f0f0ce54f034f9c87c53c4f6e3a68d20b03eb9646da2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0767e4db3ef4e671c802717f6af4394

SHA1
fc774d3b500c80f0fbc8b76140fdbe376b04afeb

SHA256
cd4dea6be36455dd82664e8d00ad973fb8eee281525a1554c46c3bc610599af5

SHA512
8dbee25bc45f1466184c4b63472aa14d2f85b862b9b1dfe5d64496f8fded2d53d0799311d60c68d4e017224ff84bcd9a1bf18fa032327a28b191ad7d662a8faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aeba08bdc314e234152da3e37510f6eb

SHA1
2456a90df801a71b47cf073fedac280b60a1001a

SHA256
c0df2fa16013cd42deec2b1845f4efa299bd7eaae7fb2dd78fff589be77e5e2e

SHA512
4ae21481a69b920c48c5a40730f547fcf30e29f1cba4a8f883f2228bd0306b15ac318e6d4699b85938689208ef6c0532225ec480b70bd00cec355f80a23472e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f78d5e2f4f73e3d54d087adc6c48bd

SHA1
7eb4f7be747153b97da75bf60beddce3a6b95c95

SHA256
a715ff206943d1e48ddec70be4fb6c57508bf6c5f375aceb3c24ff124ea95e5a

SHA512
e93ce4f5ca2b1f8238d8283eb0dd2a3ae4fde3fcaf8cb8b3a0d9266049a9df662edc0af77631e3b39f9bdd55c00c0a09302dcd0425fabb62eaad2027cf250386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a03d8c54ebaa1b3df0bb72c589c9db86

SHA1
b3f8d0cc592b7d03ec2bdfb756853558535dd5c0

SHA256
97620d47751935b7b42b2f55b47453750dcc8074d26094bd62fba9ffa5fc83ee

SHA512
b17da0474ec6535a758a6606741e3c5d2a9c837e5462cea76bcf1779c296bc8659320c3630c88dcc528ad965b7fb2181ff8f52be14873682509bf23113bb1d75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
896e3e192055da9529a362c6824c0ac9

SHA1
4ef325f1ecfc282e4880283f8d7629a04d123a75

SHA256
6edbb484c822b4a23c6baa5ffa780f35ae012617c35f89e4e79c079ff37208f6

SHA512
8cce12a2c0afc22810800dc176e0de60ad9ee6e4a159168085ebf728df1c89ffafef3465f01e7f23db5d60b67d3807c814f706fd22499949265e5d7b93bea7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ff2be2385942f49db5788be07eefd47

SHA1
dba550b815011b5773865089faf6f1bd28fe4021

SHA256
9f70d5da6d845fa33ff3a9c8f4c8ce738777ab9ab4d66d8b3022505740fd5103

SHA512
9ee51bfd0627b8b1ddd5012227f23f06f5f067db9e04d4ab85bbe525484a626e1f377cd438a8a431b85e875f57f8c2b4d9fda6696eb386813dab96e2f0a209a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a21e8aa4423942dc6b52a3310ce4659

SHA1
3b9995ec856ed65c81a7e5f6340d142687c55174

SHA256
38c15089ddff4dcd9baaa289a58f20c6611a9afb54a699a881dea2da2fc502b9

SHA512
64a892a476e426bbf17cb1e48bed9023c4b298d76b1b7d7ab70f71322e29975d905478a69c9d18d0913f86734aaaedba256b5777d8e45ebc0533d8331cad2a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb99d4e223d8645f4d8563785e0169b1

SHA1
1a0c75c46dacbde0649ad5101d1028f9950e61fc

SHA256
937ede9aa8b54ad4113be3edabf133fabb71a2a5beb257756a3582da6f76f966

SHA512
39aa8b3bb4059ef268721571eefdf72f2f0e5798130fb40a632fb96fbc3a9e8da0184a92f49c907ac49c67921c45e7af42c36768eb507e4a6b5061a8cec99bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9117cc974993bb25425388cbf0ac8905

SHA1
aeeae0518e79e983266468ecf9b1dcfdcac32ba6

SHA256
d7d4fec3b8856fb79b4ae974766c388ca6cbcee5baeb28ea97fdc59dc49f28e2

SHA512
f9ab7f763c15a08174283d36810e891c853eb99dd092285aed99a3b481c6a987d844ae2309573bb77f561cd7756977d0ce6a287bf82a49ba731ddc7c309782c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46f06bc404e51824610f94058edc9a4d

SHA1
6d7e542d127951195ebcf40a91cc041d3e4b7736

SHA256
d670f3c23bf4064df86323e057f2787be3cba386fd8ad90ee05f5a5dccdd57c6

SHA512
4996ee9d00654b581051b57f2f21dc7c8fed44cd0ad3f3ecda4c226e8341cea8056a9f50e5d2ccdf3680dcfd0a906efd5e67f940f5340223c6e3203591b14282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
943366879014f4dca153c4f087475a5e

SHA1
94d6209df351ab77a56a0299f3cb9fcbd26d22f8

SHA256
ea16ac61a329e4ef317da1fa93867dd537808af9a26c05eefbaec3f120424e47

SHA512
00757ba3bd3cbc48532783d3bf8e6f5d66041a9f0e0d920f242b6f85b34f486c4b380a72102ddab99d7d83d250f0b710fc02de7a2648e200dbf97ecdb8967dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6771b7854bf6a65f9a2b9c66c415b95

SHA1
f7acec6c6a3400848bdf483bb196e0aa49d5350f

SHA256
041901395e879f3114d17d28b01f3ace3f394ff46615ee96ebcb7d56e3c245f4

SHA512
51dc0ce3042c2afad779702b8d9f444b42d3161904fd53b1cab2835e05205fd7cb2895d31ff6146c7d17148580200e2af3d35c0fc4beed9533ea714f81ccb913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4f9eb41f2de1dccfca600c9666aaa9c

SHA1
401dec951a5fce081800938dff50d5cea18b75e5

SHA256
22ff90ce12cac6e94ba76fa6670b90b8fa31b0e1886a968ad7725897f0af7782

SHA512
f5e3e247331425088f790823e89ac418567556dbde3f14c791d4b1180986af6584f30e51d4827acdecfdfa1840e91281556ba3bbf00a5a326d2a772280ab4780

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D3B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E3C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit