dfb9ca363a42800b315e9cb32e5ecd3e387019a5cd571accd864f75460c7d1c0

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

0d85725a21672e0fd13e9d27576648c1
SHA1

b383570f688d69eba9a1a499c8cdeb6c8865bd0d
SHA256

bdadf47a68e8341dc9ab4b1c6a9d96451a2c5d23f0aeeb777e8805e21c1a10c1
SHA512

30e6fa65abed4b07db76fc8b479123a1014aaa32fd603a554172abd52eb1150fa8e97360bbe2a9c16a555a2364162c681b0439a101146893fa84a95db7a75023
SSDEEP

3072:StLcdjKpKbNK+yfkMY+BES09JXAnyrZalI+YQ:Stkw8AsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5031BE1-2811-11EF-9966-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424286147"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2516	2156	iexplore.exe	28
PID 2156 wrote to memory of 2516	2156	iexplore.exe	28
PID 2156 wrote to memory of 2516	2156	iexplore.exe	28
PID 2156 wrote to memory of 2516	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e16d7942466f26e3f6d0653d66531cb

SHA1
7686646e2ddf67d06aaca708990f6a00b08fa1a5

SHA256
eeb0ae597c75179e99fac1970d9bb407fd65e5fd6602f64f1c0201b0880dc65d

SHA512
2a1bd13bd817d960dd6fa2f6dcf359da7ab550e4414ab36d2da05773820b068c8e755c02b8a29bad382ff3a470b7df8219a729d4b27ff2a3d1848688aec09936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fafa9b6d05659579a784a100f6e5a9e

SHA1
2ecc92c1bfcde0c6ce55ae9f9fd02d87b0954884

SHA256
c8bd5e85636095b21111dd2f2a4f60f4c3107d860e3c01eb27f92f6026843718

SHA512
6e1aca861339829e306202092b89012cb9ee954f0bf73dccb483cc89ec3974ab927d55718e82952fba7caebd214830feee6986378309efde4bfbbb1050b3cb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72d26f8f5e60ae9985d2c1065c49d39d

SHA1
39c3168cd0eed4d5f16b7076d3c4318df8d7cd1d

SHA256
44868561ecf80e387f91748efcc1010bdaced4c814fb522c98bf764239a8032c

SHA512
f2528a228f713d5937b929d8e4ccf0843fbedad9e026894d62f4302aa95c04e9e8f3af447df3fcc0331631a987471d29fee0e6b25dc70884d45ef29f3d266ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e28eba919c8edafd91209e0ba1fc974

SHA1
b427ba41f29b4f6a5237c19f8bad4d93dfec8e8a

SHA256
2305c1fbcfc9019e738f28d736cc91cf49eccb185f697cdcb6724a0b30338e46

SHA512
4aea3e0d1d8c1828589afd489a549ad2f782b58a9d362b571b5e5ee7e10000f94b40578572076cd4fbd2bc06258d6dc32d0faa1f684c0d8dcc156a5110cdaf1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c390d84e68dc535c1c42b7f3846355c

SHA1
87e189d6aa3e8ae71d6ba277f93b10ce453ac00d

SHA256
587b8fe4d546b0e686d9587443939fbfa1fe68ce80e764e3174e4d6e48ba58fe

SHA512
dbb3e583ba5c7c43f1e4cd2ed280da9aa6b7d473a15fda7d55fc42519db644956122edd0b5071c0d8c18ab29e89f1fc22339ef384b536817a25e3f572ba553c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b296e3766e67c162eca9fbee6364d63

SHA1
1ee218e5b8427a2ced964cb69bccdcdc6056782f

SHA256
87d94e21d97e1b4d73efa341c75f55db8cd4c08639b5df04f305d5cd082a174b

SHA512
cb1f02dc1908eb76e035ce94da1f37d7e1707481f6948205908e77ae4040c8e2a2873f36e07507ae4f9350e50ec6ac3284f6f2528437d2a692e8a1fa24cf9ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445e83f0858416bd8ac7cd94aec046d5

SHA1
05c26452150964c8c196a783c6983d3efcb24013

SHA256
591cd0860a0c8ec6561141061b1ac919501e0e27b5906220a1fe1c0c27725f71

SHA512
efcb1c6ee1c7528f370c485bfb0de643eef363602a3a3b4f93fca83d11668f5d431b5ab52c91b1ddabd1f9f550be7641de4dc7c9151ab78ec5635c24a762ff41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7321016006cc6525b2437cad5bfda64

SHA1
40558106a55b186619f68622b0ea6dd968978904

SHA256
95ba88cd7025aba6401cc713c6eb044697ab89b8ace2eb43d49bf5da89a89bd8

SHA512
9e8f2aed16b09cf09d2bf4264ab4b763f77ee644464884c73f0851d927797684c32ff4b1d8121b1a8abe7abb4e4bd27313a066bca77486cc0e50383bc3c80fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96524e29b0e4114e968c8b1f1ba2d420

SHA1
8de9fa2d2e2032e080eaa0d68d7e8752cc25e5e0

SHA256
b6a50d3abce04560381a0a4d807ec1faa962ecfaaa3f7fa46f9825dcab0a9707

SHA512
f13de74864f9cc1172bc1ef4c7985b4c00c06753a72ed1e51523e5ce1caa70539d87614d5e5754ad4871b11c9c4e48110ed4be789ed4062ea259208ab4ffb0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60fb9c242de88204ac1e46e0e253316e

SHA1
39969a8af009771fc958724bef877ee067e0d6cc

SHA256
c0dce277373d5c098e77c6a1a9d1b9333beebad57d3f7b3346e25942674a57d5

SHA512
24e9c04355a13540c3aabb96861484e14f7f28b2ca9d4446b5051d43def289dc56e0f5e3f4afd9a72769a5e7568001d37229dbe506b9f30ec7a07a989ca566f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba806e021746899cd85347144093889

SHA1
6f7408f708390213e9b826b1d24a4591a19d5146

SHA256
e51b391bbcf4a3eb89e0924ee52917e2cf2bfaa74b363a2d7213bc2b468ff5e8

SHA512
58b0ea4d2fffdcead8dc5c27175733e32c3ce3744c75297d1d9678af4d4c8ee5332cb1c982dca9e7587640c1c5f97db2ef910a0487c91ce77915cee40d6a99b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
896562c9d4153d0457b7566593ddaa7a

SHA1
d7decda8871695ec134ad38e7cd724165d7d6eec

SHA256
e1d0e5b894f6971bef1bd9de71a38d3edfaefb2855e64d2e9f5fd9dcef631e92

SHA512
3a2213e9755e42b201f594b024fabe5fe64a189caf43c2670d908bfa01190233fb8e36502f3c41987a683a1b31abaaf234fa5dd33d7473dcbd539f7dc4af3e4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89fa515713b62908d065853c8cad5e0c

SHA1
05b058e81f5a5710b8ed8bfa81b9ea8fcac3169b

SHA256
e7292509b726deeb76b87c4d5d9178efb55d6585e9a7bfe5770571971c41ba5f

SHA512
115bf25e8a09d6f9f68c13ca69a7f235f6f022aeada4ce74f9dd00ff226735d6477832e9c42e7801fb3a482c13979c84412e826f62fd2b4485d2fd1c7d75f31b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de81168fcda7e3177028b42b56c2816a

SHA1
d6d43cae7e10dfa54c273ccdf386f8d71e7695ad

SHA256
60c8819a1a585321db1edba3201cea9fc82e546665d6bf1b2819668fb34524e5

SHA512
5795949e73b957b0399df01ef3789e08734757e9d53644e9d9345b022467c690d6b9f61e84fefff97aced965668080ac0b9770e94013d00cd16fe3fc3bf848a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
541b9e888104d48b2e89d79a20ea9135

SHA1
29b5f9bdce101e1b937abe13ca998fccb87652f1

SHA256
7bb493ae7e8acf06f7da0a1f8b9207a24f40b9e42a58abef31f84b4b76e893b7

SHA512
4345a2438a08613f8fdedb239b98aadddcde8eb5ec101655276df20086abea668be788f003f6897872e6fcb413a8e520d687f62fcbe9d34d6f0c47390a4cec87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9708fd31113a31180061047764ea5b25

SHA1
81f4483a63ab9e55dbc7efd23e1ed55808f93ab0

SHA256
af37551dece18fcfbddb2244a0f114419075b0948fe2bd0bca7e652c385d5103

SHA512
9776206dec9900a78eb049c4a29617b2a29d88abdf0dba27245db412db4cc5445d81dd11d5364fc08a7c1643b795043453f31aab6ba7a01bce879e37f422f5c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3540859806a317eb5663f1474e4486f

SHA1
3fd45d3bfb076809a2141818e8779822695a8355

SHA256
420986884e4dd1292a5bcb62f46a18878bba9cd58f93314fc3f1e3af5d1bafb5

SHA512
758f19710f226e763f9b6b27a9ba4f142e8d084c74d15d53895762213fa75bbff812870aeb7d2ee9659faee6ad0020dfffb9dd68ee4742d293932a05fbc91271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
731f5aa417dd9143c474aade23143af1

SHA1
067517eb1dc3b076b0047d4fdc814990d326a8e2

SHA256
39ca2af359aca1b395e8bdd5f6f14091de914b515016a54080e205c031d98f4e

SHA512
a58d0b679ae0f6bfa0be46bf24d9527ceee2a070b9742b5c2d3376ed2d55ac875bc881445fa88f62d381b5db74b5e017ed4d1bbd0bf0d81db9fb82044a198986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab232C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar244C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit