6a5dc8737ec31955aff66e9bc3907a81f0316cc0822036dc4ed95bc3e582c9e4

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

b7478962f9afda655be7ad0b73cf9a44
SHA1

04cc85e242a9017c169a0aaa74b0e9a33e88efb1
SHA256

e6ae4964c7ea9d89e4bcec313d314d7385c75fdea482859fbff5c4860c568dc7
SHA512

2161d67a511ce091ac9a14e6b000f7784749412f12448a565b66239bdf99e89b742b12a2648a34bf9704e51712d0fca188e26a71fefe4087f5551725c8049019
SSDEEP

3072:SCe7GOZrlna+qyfkMY+BES09JXAnyrZalI+YQ:SCqBwAsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{212F9021-28A9-11EF-B73D-E693E3B3207D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424351102"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2980	1640	iexplore.exe	28
PID 1640 wrote to memory of 2980	1640	iexplore.exe	28
PID 1640 wrote to memory of 2980	1640	iexplore.exe	28
PID 1640 wrote to memory of 2980	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d17ad5d4aa7f218ad365ba47341402a

SHA1
79d7876863038c0401cf146b42411ff4d2ac1cf9

SHA256
f49c418acca20540dbeaf4d61f4f514252346c16a773285ed48138fd2f29cbef

SHA512
aefb9ed950493331fe30424b65f65092b036803f4bfebb84ff646b3c42c77957321f4dc9d5a0ccb53c025570aee482eb1c197c1f3aebd8344402e5e8d5ebf390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a42c63094e10bebaeca9e70d42517225

SHA1
3c3bd58f8b871f44093e2bf875d1121db81c419c

SHA256
0060c1be6beff47a11b5b6adbce437e5c98252c3a0a028209ec1b045e5decc98

SHA512
a816de5cef159a51a213cb41649b67db85a0637fc5c9376f98d94af675009e24fa8922fbaefacd4e96debc71acacddc5036550f6903375053e114a7920271b3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e789809da89adb5f0aaf7556ab5992b8

SHA1
9c1163d9dfbbc3cb836edf012b068bace2ef7ba6

SHA256
6662c56245897c8f2569cf66a6e806a78076346a4da8c28d1e809551becda741

SHA512
80557c799ae3361ad3fa79fb10e6e2f965cd32d900d577aa970b3027e56f48efc3c6281c8c2079e53aa29e44c0e4d3963d177e0d2d2cfcae6b6704f885e0c089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40891686d05bbc343b6140bed753dc44

SHA1
bb10903d248753c4a679c226b515e3414e540b1a

SHA256
251db2ae403fa96193bb8492bf7d4d259cb65b7ad5c7b64308f9e6f8eb8b4970

SHA512
41b1a55500ab1b6960f832fe07238760eab2872953de75f6837b215d68ff3b8bf7b162b6f2cec651b57eb4e8a2fd9a87886d41dbea1e47eed6b8915988b6f9ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
557063c4567a9da66749422ca49d2b11

SHA1
dbee9adbf83982bb441a436cceea396f5d2fd237

SHA256
54ba6bde117491e03bbfc34783198402f91c6ecf3ce0f69aadefac84015ef5ee

SHA512
5258511e45acc1f6d2acce181b5821f8aeead4487050740df63de774163643a1bedf5dcb6c1c39757a8175bf70846e110bfaab2643a6fe59f956c691d0ec78d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
958826a78269dc1304496346202f2da7

SHA1
3f8a4cd775216c5d0929c69e83e405145172ad37

SHA256
9a6c6969792e485f8f53866b0e67dd106856c4ea641788b0a82eece5cf953854

SHA512
ba785ce78076823f8d8273d16d12f17bfda481277b1e161cca3f5c3afe900dd2201162417caf78b5d60728fcd8ebc39ee7f970c8fb6a48b77cba6cf4f9c2c463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65065ad9c30e74ac312e4e6da2cec21e

SHA1
a85635de971a42e105de3a5ea484427e2454fc28

SHA256
af4ab36308bdc3b37fe2982dcfbbc97a0ca7ee45e239733c638a8bff71af02af

SHA512
ca242a8fd866e7e289cff6bc00d655df62f83861d56051527da2eda7831bc125f7cf27968eb6efa22c2ef2e28b5aae2ca7ed86606918efd7e62d03ed266bddf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe390e311529ff52e318d853cc9e5700

SHA1
612d74b553c329dabe483a9f87ef760b27918970

SHA256
cd06044223754a3e129f898a39dfafdc5965cfea254c3be725d57e83488096af

SHA512
e9e4091f35c5ffd474f1b8d07fed9ef3cbe45eec6530f8f14c5ec9ed5c5f532a30124a32f22be217740aa814529f4039b75b07e1960ef532f751e7a357ef6b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80a17c5cfdb2421a774bf003a09c55c0

SHA1
be5dfc30c625d91bad9034070888b80a411ee823

SHA256
c4517a80116352d722f2908d78a6c5cc6e5ad0e60f15c12acfd4e1fe6ff4d69c

SHA512
88548a254d63a6635dee910676988e0f0a7c141cd7be6e922dbf784c988611f64a565b1129b2ff3e58397764d0d650d83bf61c0b98ca231c187683f5eb7788e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14856d37d7febd3bc78851671fc95979

SHA1
9f65a800a3b23cfa73b73942f2ec683cde1a3505

SHA256
9bcfbbb84e86d2b596ba4784383c9cee25f664e4a3d88216d40058a22ad230dd

SHA512
1a89da2994955d927bc4a6684551db31c144951419a18986e13e6160e2b222c55a0e0fb84dec4d9226ae6056c4590d69031f08bd4b09b9cf44d63d6eede28dab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74d48d0e3bed28b27e101d88c6bc7273

SHA1
61c76dd0a7fddddef5d7d4b12c1135bfd3aab545

SHA256
a9b2c4b9af934353296229db815422cd0700d72ff60a4d5313f9338ead9bbf67

SHA512
735af32ff2a126f4dd408b4ad1adf18fe3ae1f3d548492bbfd63d25979265340dc9c2dfe4709fa4d1e3dd43d7ed23dd85c0634e2bef7204e35419fdb0c84349b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
166f55d7fa86f419667f014b7a5852de

SHA1
8dc6216221c911ae784e68148f1c2e0e0e5fc0f5

SHA256
f1542708818c6a0c10ad489008ffeacf6a0fd1e59bc15b4201f3b253b8484f9d

SHA512
b9977c8aa31fac96f08657215322d831a3b1bdde5611e466710951bb6d43dbcde689e3dea230aa1f96ba58ce1875f6777cf113876cab7d9748cc3c6ca58ea804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e94e22bc1eeb7a50803fd1cde7b8ce83

SHA1
496ba49a8583f2f408dc005cb72986265e3c6129

SHA256
894eb7449ded63c48c3c365a831023e9cc8550182cd371dc8a8daddb6d275d08

SHA512
e41ba1bf22a472e59b05510343a345e942d0f00ff166a0b391575fbacd157f39fca413c51c018f723fcf2f9889c76fa6dd71fd0fe7fb8b849ccbb34a7182cc5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50d26e02fe1502184f6d9995b6b776ba

SHA1
f7f0abd46381d60db88902b4730615b76da9bff5

SHA256
c22071665f0baf1ed03bc149e73cc5e67c240afafa3d1c76dfd80183b46285a8

SHA512
5559d79bfdc20ec8520e96430f76c14a0172aaa6b26c81e81e1dff1b3b83c59397e387e1e7b1e98fdd5b80b5e68f91de646019de9a8d18001cf159239df3f001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7d7a905c96070a8bd821859e68a56bc

SHA1
3a55c26079cacd1dade28ac4bc0fccbfc3394519

SHA256
e80e0908d36a2d0887dc4a8af5ea3147dd9c41f6aada2f09c15736ee078c13b3

SHA512
52510987515e31cca0e81a72f75f8625907fc9c38e2e6f582c422de5e01c087795c3df2f642743345f3685076752a88027ad70de40322c4cfea465d319c5a981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
740e3bbddb8c51559f41952c6c757f04

SHA1
a04428a3dac25283d4f7e2ce9f8d22fd9fbd829d

SHA256
44309c1db0d1321bee89ad8e6122fdd194225a76fb7be1c0e28d008f029e7a0d

SHA512
fc9d00e99e80b15e86d7e5947e99270b12e41f2ad0920bb8e27e0a3a36f79dbb48a50240c8d11cf9bc61654da2277a00047d0e3e2521f0f14c2dda1198f59bac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e44bcf9cd20c274e43e3efabbf8c313c

SHA1
3f72cc44551e1beac5333e2eeaf098b8c912ff46

SHA256
54313de11fe90fb56f93e75943412f22b7658dfcdd1b304139efece8f0fe7146

SHA512
fb6381e3f86af9529433cdf187148b31ce01761d658ec48e248f4f9b31225cdcb3aa5116bfbbc59137a23ea614b2b7c65959659bb1997104aad7617c1a18def0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e15c5a652c6615dd13619bcae33eeb07

SHA1
f9ce80f206aaf2aff0667825452c89acbd15ccc6

SHA256
934eb94717dd3b9cbc0f9b7307c798e34deb2f85fb7fe0a1391b07bcf1e8eb8e

SHA512
fd388b702992b19392ffb86bb75e13e48b4b654c7110218768dbae31fb2e0d215f47189caad0818b96f41c34c43ae4234c9c731b0a3f70a3bcee49ad45a5b197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5237a83b5e693fc7bedab47fc9ba0b62

SHA1
66c0ffbae0a0c8b271c120bf2060f1965eea7561

SHA256
ccd3b8c31f248adba7037af26f32021c968cbc3bdd26e045faa56444d2a325d8

SHA512
7e963721d1121c9c8c6730c7dc6541dba339728590249835cc475fa26b89f8d5c6835ef2e848b77514f402f937e38e657bdffaa91376309b586d0c754b78daae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabABC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBAC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit