d60771626b76671366551420c6adcfac5d4a040ccb47eee44561bd3e9fa15189

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

e4bed3395c2b76a6d28d7043fc0f020f
SHA1

395de178de7a9ff6436e1604203d665eb6d5b68e
SHA256

078cd867034e7af1dd200a7f47922313aa3369c621980763509514a9603fbc2a
SHA512

1a41fb6c56d461ac58debdba02ee999a500ff8e1eab692ac534e43320697b4d6c24cbc256eb6f04385453fc6ccf102cfb93ffd85ca01188cd1edf7972365e3db
SSDEEP

3072:SteBRGIO9DVyfkMY+BES09JXAnyrZalI+YQ:StBtAsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B607591-28AD-11EF-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424353025"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1216	2080	iexplore.exe	28
PID 2080 wrote to memory of 1216	2080	iexplore.exe	28
PID 2080 wrote to memory of 1216	2080	iexplore.exe	28
PID 2080 wrote to memory of 1216	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ecf783c2ffd20ef00af99e50806cc9c

SHA1
b7f7daa455f2bb5fae524c0d394baf311da497c5

SHA256
29565f838caeed4f7b74a834ceaa0b62b9ceddb953a3c218cf16e0fa1fbab0dc

SHA512
44013b4339dcd96d405a90cebb32a1d0369167825ed4bcdf2bed034e703bde50f89134bbafd0d308493084a59677f6ead3ab0db5a61af146496dcfcbbdb5379e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d40dc6c5c95ff2b7528f2781b294004

SHA1
751a0c78aa19b1d6e9379c6736e45a5c24a22ae5

SHA256
8ccd622d202f6756472fe521191bfcb0cb368ca8785ac3f12d83cb05d345cd7e

SHA512
43c6659f27be0712f150425c5eba9fb84642ca17550256eae318fd79450da44a10ab4d5f06bb23aa170d96e1fc0ea7b3fc7f781ac6ad404865edb94c87832952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b327b3213c634dd060bf3de5d7c089d6

SHA1
86a6470c6799ef1eb6fb6806b8a2e51fe6d8a7cc

SHA256
c4bbb4d0c917031c9f9f52a364af7641faa7f190194d54748e41a78ee0b73935

SHA512
14355b89fccdb46175c9839a5966c9bb8622d6d30376608a5d16e7ebe79fefbd3d9ffb62a81fca45f7fc80837bee421873fba5fe51db44f0260bf73282053f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fada1c7cce739bfec0557f0b989a277d

SHA1
7ca8ef8fd154cb0b969cb39e0ca95975bc87df29

SHA256
d2e383bbbb85ad6e67d921a54302bdb3a7e3d52d5eef23b83ad61ffb1c7bdaad

SHA512
e78a37f2bfbe5916661d02d9edf9b9288d0da6738663c4a850029221c881d3ddf7ac6a4965c920bddca90bd578f709db1a054cf10ae1fe2024793e839f63d181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09bbb40313b074086701e4b1ced4ae7d

SHA1
726af02e00d744240a84895b62eee899df310d47

SHA256
5b626c24b1c1ce49a705497452de31626f5f2c7a18f33bb194da72c286070c2b

SHA512
5018cff5ab473c1c78d1bd49ef3dd4fe163546da5c00374b04f2e239d27fedae309e36d521cf6214df3b86cd18de67a9aa807777581aa52b8e8975cbe3a3c51b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fda701d14e6933e0b9b91aadde9bd8d

SHA1
605048556416336a4793ca1adc172df639a3f5f0

SHA256
71438b610734906d91f1c2f635e10ed2be5a105054e36db5890de46f549bfafb

SHA512
3a1bd5da80b69577ce389f502c76f3323e7402899f4326e706437ff6129c879df293dae2bed44ce1896d01a9b6029f52b17f0cc61c43b0e7a29f61f23110d896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35c084017551673c5d7befb11073d033

SHA1
5109163a299294b8f7c32967e6c2359a97175f3e

SHA256
e387b702429bac885a4869662ee3bb3fe4b7d3265ad6b06771f854a94bbb4493

SHA512
acec46552c55598b73550ae4e02a9a34488916dab2d032256614cc7d0dd9798b2c9971ab2ea68190bf3b6d03f37bfdfb095ee9880e8d6da653a3f92cd1ce2a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4f464e010980e18648d3b85d1230323

SHA1
c6f6c50f599afd2f4612f5c5e299cd1e61c6a8eb

SHA256
33107cf72f0cb1badb6bcd1ddab5eab64aef1ee939eab34a489dc321295f66a1

SHA512
f8da30afca14c50f147f3293141cf116cc06050030221ccbbd0235edd160eb4fb5883b685b7ac50cec38715300b4910dc91036ef5c2fe39d543db1292b1f69f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fb6a66fcaed6cffea3c105b6872d535

SHA1
e294619a9cff4dd7e01701f4403a2aacd440c090

SHA256
a2bfeeec1129cd354a20b451473c5f17ee0125277c1df95337e9c90078ea9956

SHA512
369808d9f0abd323aaa8dea0fc5701d8436b8ef874e28970aa89911e76624dc612aa813b53f9cfe7229a7606c1386732aba06dd7e7d3ac9f8d9a665b108b586b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2458dee0bbd0a8d47fe8757e8eaec3d5

SHA1
a0482988f2cc09122d79e8d5a103c1ba80d34604

SHA256
eaed24cbdf2628af3ead63bc19bd8f7e1a06091aed145e7b0c3ad27549cfaa30

SHA512
d8abccbae1822ba41e73e0ed5f909ef0fa4bd1bc97bd5829221f42cac9a1236e6b8ac77abc6156f85bbec8817d864d75c0ef60f4028f2116aa26cd48a05a24b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e66145d7fec1b9b79a9149900cbe4153

SHA1
7d7d03abd854252fde1a056aa3ed53ca0b14b677

SHA256
3a9c042e2127cfb79347a14b62553b8f6e3a297085bc0b821eb2fee10bb6dcbb

SHA512
acb721279be8218fa3251e6b0b9414b0ae277e22a19247d25de6c664dfe167de79d4bd6c3ace80b9b53472b4933bc01060a4cddb94a394f001195b50868bbf61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1af5e5498328903888c05e266934828

SHA1
4fbf15c217cb618f9625f3275106db89109c6d6d

SHA256
5bc0efe25e409b5d171e656fca5ceeb2d16b4ffd20b2ea8d06328d6e6372b3ac

SHA512
b677b72962090042d32ed729d54b2d9adfa6965c76282c449f04be90c3ee0f4cbe8b119e769d3527042a2f93f292b12c70d4dfdd6a516284f74aa53ddb9f64b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5281fb05fdfc57ca42c74370d8dbd5f6

SHA1
67e188079a6a0819d21ac87984b60e618597d196

SHA256
879d573c8c147b8275a7eb3ec0c975f64f7e58eba8f33ad31fa6378132564749

SHA512
8f9d8092787efc220f4799a59120ec466d22327a02ebe98be72f578d5a7b54e05d0e25a289275afd340e00d393fe454a4e719d4c8d7035b3734b9fd65c38b0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5c850e04e4c60eb2298c85b6eac63d1

SHA1
c32342b9506c3abf60ece88ce74ab41ae5e67f7b

SHA256
1a105873cd5beefe7ff2161c29038a63b717a29e702fca2a6caa9c4b4e18f312

SHA512
441b605ecc32b4789236065115bf86377b0fc4909743cdaab38a89dc9dc28a612bcabc0a138a21a92045736d19493158f41417fead3f3c2e05a7d5205d400d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1875f1a2a4735853bb0cbdc995e8e78

SHA1
47942c051a66a901574f8f04b07cc54863428171

SHA256
cb825936d8ebf9b3d8a3347ba56093990a4938cbcb6c7fd114c6152b72519744

SHA512
e5ebd2e0dfda94fa0b723ae10b91d83f3ffb8d24826a66f3753990851e7b530a8b5ac2e151d6ec0d7a753a6033c7cb8de2c34aa1cd00cfb5517f19881524c505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3943ef5bc1fbdca8bf6bde89ec9cc491

SHA1
ba60d037c2ed593c2178836624da5b06f740e76d

SHA256
61a9cd7f9d9f272207e1b3fc7ef80be7a14f48b52a85ada646047967f27b23a9

SHA512
427f263f0ce4b33852ab3da1d592efae704dacc7fec9fe23ffdcee952716e424fa42e284ff44a2c3cb476ca8e62e82f0567fef0ce1b475aeca036098257a8687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2620b8f8a54959e87c45b169a0a0833d

SHA1
17f061968f8a50ce38d887ce57a823a2fc0c4970

SHA256
702fb80818173d7a33ee672b93874cfac473c4396b70261339053135c246f85d

SHA512
477b89df965af12995642f342b2a363dde06ce3ef2924c6a1880b294b6fcc4db997bb5323b2e8a71ca897a515c119bba166cf845b17d4c0ed37c333376359572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cad7f5637660f763bf988525e84eced6

SHA1
4f60fa157d752e2f55b9c2e564eb359e09b4275f

SHA256
f3687311faac41a3050ee91c71b43eceb3db706ac9f8e94b49873973da03e32d

SHA512
f61493c95378395af13da081337d34bd661ed8f0ad7665a81a733c7975fec20bd8d596908286c16c183b6536583040da110645d62a66c4336eba4086b0dd7f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab168D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1770.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit