7df8055edcebf73d6c7a136aaa8284f66090d00426e9a7ff7bbdc9d099b18aac

Analysis

max time kernel
135s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

40KB
MD5

9a64fab89603cbfd4f7d613e2650e873
SHA1

fe3563f85190255fd6eaf168f9a8e79c8711a103
SHA256

d3ea0a8be94c68685de8aaf157035d5ffcfe99b85e0d5b6007780c88413026ca
SHA512

f2323038dd368a0b4346b6c1191bd146804d6541df714243009073aef87c24c04a5a5bca429f383c920665801bb8aec947b17672e9e203bd8d81a1e975085ea1
SSDEEP

768:Semh0OfXpFXjAc8ZO96KPBc3Z8vfad+eeLI3VIJ+ZeClV+Y+Cn+1OBZj+W5nAB+t:SemS+nXjAcj99Bc3Z8vfad+eeLI3SJ+F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28C2B151-28F4-11EF-A499-62A279F6AF31} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f05953eecd5c224b84008789b9ff313a000000000200000000001066000000010000200000004ddee9a43f222c0b6e6743c220a5c2963e2838f7c61c3bfaa970f73361a3569c000000000e80000000020000200000006abb999bc9da44941d427f4c715f6ed70d8e1d40171ea8d4c54f49bec2f7c8f120000000955a8a2c33c585f1391671c72b4c91a843778c9f814d841261f002cdca6f6cdb40000000e3a44842a58ae3a91f3258224e0929f6dc0ab6be14f92df15a1e37e3047ca71dec44728db8ac56d2158358f8dee9d6555e5620eabc8ad24ba7b289161dbdf47e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c8fc3b01bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424383328"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f05953eecd5c224b84008789b9ff313a0000000002000000000010660000000100002000000041bf02fe91f4e6d8857a0812130d0267400dece2a8ba31a5076dd592edd3ebd0000000000e80000000020000200000003e3e5ff6b41723be2e3db8af9056daa8649e515956a4a3c22a4b125f465f086e9000000026c86d6cf6a4c80132090a0ba8c0d48ebfa3d510d4f71b0199208bcb1c8e148c5d3923e67bddc5e597b572ea10ce7087add262e34225f9d98fa5bf69b5e1074c7c970470b4cea60624f42088b7ce40b8f0b5de8589afde1eb23369bc91171ad0b2835cc1b18f86b99e1769a9362b665d2cd789a075ef49e2294842f5f2885456ab6273ba136e6f0a5687dd155fcfc76d40000000d4d6b8b9a235841fe6ce9c6ca9ab94a92297c3bf3726fa692ef961ffb1c21b856bfd238caeb4bbe8e26e8ce8d00007a06cc71d8aa9db2778acb6827091954aad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2556	2000	iexplore.exe	28
PID 2000 wrote to memory of 2556	2000	iexplore.exe	28
PID 2000 wrote to memory of 2556	2000	iexplore.exe	28
PID 2000 wrote to memory of 2556	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dded3a9e55606910184c74d3955b413b

SHA1
f73a642b6a3c7a8fc5cdc7511c7819ae9c8a6aa3

SHA256
986bacabb5045fd13fadae1dbf94ea2939d1fc5c052f02045774c99b95d99513

SHA512
248c89e0322922eddf22013db22f5c1cc9b44030b71bb34f755f67ae25bbd7acaf2c42ece73abd7c73db64e8747e844d2096d35dfd3ba6380501ad1df69f2073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6961d0b2bfee2c3b771f680a27cc00a8

SHA1
a6c2e6bbeb6e3c00874ad7b0540513f7b3efdb48

SHA256
7392073434c90c2e2e139708615c4416c984b70e73919740255b06ef8c1299aa

SHA512
8048f6ae24ce147c3860ebfe84fb8cc9e59ab6d815a83c925e4f402505f1dc2e61177027ca1e9f44b6652f58f3d18cb4d3453eca497224c77b13cc3d067df845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
def7c5b60df0734f11912f2c17187f9e

SHA1
df470bccf67d04501e5277a66bbda394599ab698

SHA256
0cfb79f96b575a6c329de4ae443ee015682fd67aac472da115a389e86b2af174

SHA512
2543ec2225117bd0a501551a364979fbbbb16cc98c8b387b5f52de86262d03c337a9ff7746bbb64618f215157a1213e08731f94f57bee058d33b27aa33a842a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4bff413e1139e12ba6e5b13cb04c3b2

SHA1
acd918e9a438dc7b2875d2b37623c7e70a82b710

SHA256
3c810372861d53776ba29b148c3f3d9575f7d8338caf9536043dbe49a60326c6

SHA512
9f9379b6ad87cfe47e1e3b9f5e7b9bc0a65dc5be0246b4edb814728efa5f667c59d3009bac67c827947241b210e2f54d6c75afeb47d22a61989276c56eefa227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6d28a4d90f398b6b7cbc577ac4c8bdd

SHA1
ff1a5f395c28ad679ce071089753676f39e14880

SHA256
89f99e10f16709fcb4dbafcf500af01e635d0f238f5b2c32206b90852e5d4958

SHA512
ea896fbae72c9181162b4e28a9e6334da2660822de609e0c74e0d7abcba05f870defd71dd30a6072f54f5fc068010c6cf4b113ff5883a3d177a4f89f091a35f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aef439e6ce3fdfba313f44b8ec9d578

SHA1
0b816af2ba6d0a156ccfb42674a87e74e03c74e2

SHA256
72ec1911c23c7eb1e76ef1c47a71cbb73e9a85c1dabc607e8b75c942f775b5e9

SHA512
9d698e096e9b08b1ba5652eeda6447b9dbb507be22b24ecd9a6ceb56f0c84dd9a233b10cdb9c3be0b01475491776183aa7aeb6423aae510ff2f83301f88245bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a644599c1a4c9573e5a8c4a1f92ca64

SHA1
c20737933d7cb327a78ed6696773ef880d70596d

SHA256
f6827952a83099e88d667164574ef266aae95fa382598a8fa8d135ab3f236aea

SHA512
f44203cd92c312c71852d16aa5e6be203a622b58fe7b2e94686ad7ec115d0480826dd3b3dd6ed27603455cbf2ee068793be80c8aa502a5a2543ca18f05f4d8f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf1548bb20e06dda9231ccc492f12bc2

SHA1
2dd42cdaaa17cf5f320deb8534a57275faa454d7

SHA256
0d4c523303aa4faaaa3fff109488c95bc30d86bd7ef4b0bed947c4bd3579e445

SHA512
16b4cd24d0d53695b373ccbbb6e4594977ca6c650db68b5b440083cac3339738fe66de686ce2b6ba6851ac3b011f8607e373b7fe93470364513468ba781d783e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b9b86fb86dcb27b5f106298787a859b

SHA1
9f3911d6a01051464dcad5dc1e45be8fcf7771bb

SHA256
18a64e7f3ce9b804e4a155c387049377e41854a0b509cdf45e17be09028c89b8

SHA512
31b98c0efddf834254c228474515d27e4f24ec34d0e00aeb397c1916fd3037fb66fb50eb05656606ad260efdcff3f877a3f20d2ebf0204f02ed324e63f2a45e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
774f84607786555cde57da8e62e93d08

SHA1
79f8af9df596520bc6fdd00d7b39ab0e3306e1de

SHA256
37a68e60bcfb13cac79933517f42087a20bbeb2e5ead2b095addba901a372718

SHA512
dc6a0fdb961922dff1d60e750932f1fbcc7d58c9ba68fe263b4885ac3236c3f21aea6d71cdeeab20364f09c2849abd5c06cb958242adbe5371005ce5189722c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10E2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1233.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit