a9194f08e33bfa3aadea4b5fe7d51f4539575cf15f14137296bb6fcc053f84dd

Analysis

max time kernel
144s
max time network
143s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

f30174fae5325afb063521c77a88b403
SHA1

5daa04987b996fcda82d2d38fdc0d1ed06e0f202
SHA256

f43d57e4738210abeb4e9d047ce1c8af5f951571234efef84ed93601a590f50e
SHA512

133d89ea4440e7802223a03a12742aa176cf0420857a1655461db3b70c3b4a721b39d54f1236261e00c0d417ae1145ab25fe4dddff1e3f387c53f055dd4bfc31
SSDEEP

3072:ScAEHAaToZqQyfkMY+BES09JXAnyrZalI+YQ:SHE/ToMNsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20923d4e8cbdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424443057"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000eeb8547265c192dcd532f645a99d8e39473a0e20c3d42ff5c75237dda46c8085000000000e8000000002000020000000614aa42a0f2ebc32147197a125a3ffc9332f3c3f9e20f4a14d60b687b25d741590000000c758234bbf13b3412f18df07ea334d8c54cb862636a39a80de3c687b3b179465fdff9753d1da0bcc053e384791b2ceb4456774210a4c3b69c763a69219786acc9b974f9b6562f7ca9bc27b38f033dd5b6460ecc140bcb03e787c4d87eb0dea40d70a2217a130c16d41ae9402b95a561ef13ed1ccdb794131ce256b994aed019abd84565e13b8a3c81ba95ad316268c3f4000000009c6344a5b56a53aa0154efdb0cca43c432f9e4b6d6a016d1579863271835584130835fc4b6b9b60a17627ff1032f5f1b2253c9f19dc2cd0734efc74f22a38fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{365F66B1-297F-11EF-917B-C299D158824A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005c7d503078aa497bf702e635f0bb53f0c59f5bafb7c02b366f37547acf4d3f8e000000000e80000000020000200000002dd42d1e7df89be62d3767e1be3410c3068e384ab78c5090fddc400c54d1fe17200000002a295bcc7a0e0714dac81bafe1963cea357e785487e24da632241490fd3967af40000000a9527f6d1ad83ad312182d8ff3be687203d697048af953ac4be7bfcfbbf2a97ef63b0d69dba2c39ca2223140113ef7d4ac1f2203d3c364148b049eb6f6c48739	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2428	2924	iexplore.exe	28
PID 2924 wrote to memory of 2428	2924	iexplore.exe	28
PID 2924 wrote to memory of 2428	2924	iexplore.exe	28
PID 2924 wrote to memory of 2428	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c47309d725780d374fc8adf13385d324

SHA1
134577ca1d2bb5e0990e8554d9353f59c8567680

SHA256
b3260aa13a3317117a76dc35ccd0b86035edf8b6aa9a5bfa12699540b2e1220d

SHA512
72f79e704db543f6202ed1c869c03a76e78f5bfffa7e8e7aeb087a3f8d610d5b645efd291ca4c4af887c3d11d279d367e39d8201f7519c26ec942cc70177ad0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5acadc9db33614138843101decbe000d

SHA1
2fe5adf608c599e17c08d5783d81edbaa20aee15

SHA256
83801189bfb9f18d34c2377e50867d585f8942f02ff0aa7ddd427fdb4ed572be

SHA512
af239ba7db205dc0af8cd3a4a7aa220822dee99d79ea67072c30dd5430aa785fafaf3143e04cd00c66688420e5d867acd0b63420c54adc56093ce3bed487e6ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53666d1afa009f3770b16f882988fda5

SHA1
bbe490e80aa12858c449406358297d3144552a0d

SHA256
45cb973cf1f75519ac89e129457cec8eeb3cb37f8960fd259ccf2114c85525f8

SHA512
8604d6ce83d048b56fe135277393407aae8c026eca3b786461c1d188d19a142c493615917aa0dd91f6a592cb95e4ef2ab0cccd8d594517db6005113d3a24254f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
197da910acf797d34c5fcc301aa50529

SHA1
5f163a504b7ecfd64fe5e40648dfe6f447b16efc

SHA256
f96b2c9edf95eec14af3490cc50f7fe84ca8ca9c59aac9ece36a40fc25dff813

SHA512
38561914688892c399715626e11c06bdd71ef30838155dd3aa665d1bb663cdec2247a292d80c3c919ad6f9142229a1eaec83052a79622ffb6ae3841c2e83dfd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27dbbcc81d00f63cf90af59fa83d47e6

SHA1
ee53fb3dbda38e682a72e9ca2bce25b67adcfb84

SHA256
98adf3ec41dcc6018317758d5d2fd4240eae0748c2b8e7594536997679940d1d

SHA512
6dd92d98e812f3aaf97d9cee50f25c119d42c6635aa89ddaf3135f506c40df0aa0b6976420f219d4e8d296bf0260e3639ac9b53fd00a519738d22e0f69b707c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a0a081f059a155b20761ed14550dfb3

SHA1
3fc099ebfed01634ec49a70a5f749a0895fd5879

SHA256
793ce0b39c0dcc1f46b3b8fe6a58cb789a2417e5d53da7ad68ef7d76d688eb83

SHA512
33db046ecb4a044920f23e40572fb6869e929079b0f70028aeaa94070eb731f1025a61e65d2011e6e07183f6f5f049b56242a771f93afc2b9894c7c1b69ddd9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff9269920b9c8b6c007ebf8f0707888b

SHA1
72e1d333755917103d9b460f15711e8c2f19ad93

SHA256
78088ec7f7633a301225aa5b2395fe5ece10013b61c4cc19147d7208e7368c52

SHA512
03a4590eac713ec3f8f440cb839eadb4b6332f6551889dc79df06ca196c1366eb0d8f8605ce23f760609aac1ea5cbe02321e0f36079a16033fccd7fe5945b06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a3ee9b898c358d69208c78368ba539

SHA1
f37681f35fc2841aa2ae84bcbd64b2551b0b43fd

SHA256
e9d8a04f44c450bdbf61f52f3242ef4ddf9b258ed31c883b16e3a6977193aa01

SHA512
ffd62cc020765cd0a9b2b42dc7730c6caa887e7db68ed233cf82a06fbe421223d3ee1f5aa36c3a0d818b0d0098da5bb870c382dbce339aa55392217375c9e5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
626f098f70fd096da63c770af9fea4cd

SHA1
effd46c69a098feeedd321213bd03e69149354cf

SHA256
de7ad51d61ac6b24352ed377caf0501ca1c814d070ce03c0af3579a18f9f296b

SHA512
8e1ed7800165b51600c06acb8b8a90b9d6fa7c264a0013b8c0acb2c1eae9c371bf08b7be62a7d1e1655d95edb64f9e6ccdc3009af8c44b23f9f2fba810f5840e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7348b1bd8327166caa6f22405ba202cd

SHA1
d52f45cdf5b0b3382671904728652b0e5827d6b3

SHA256
8bec0ae4a96649ad219ec6a072df57d7f5083f5910d9075dd85724ab34e98190

SHA512
cbdb5af1de10ad92abad5fc67f0cd57290940d468eda959d9d537f54f2d1472dd211cafc284a063445873cde5ef05b7d115051d4574fc2eba636ce5caa9ecaf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca0f28333ab1d121b60e9805f6fc548c

SHA1
126e71cc8d3708fa099b0337c05b7159ae332b9a

SHA256
2ae44f3a570ca86fa4ca22021917920b33fdff1dd430855e9bf290ee1c3e0fed

SHA512
7912b0d875cf169c7945f7b227b91dcddc55e213dfa3b5daf6f81d1c83fb58456784e654d0e0bda2fbf94b12ee1ce639341281dc272ce4e931453ac897a3d3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbdcfa43afb530ba92a309f15ee672ac

SHA1
9475b6507194a7dd6c8622d5717a5b4e3a488b46

SHA256
941ad19123358b646983508be63593e437bb29b996eda02dc3b0a48e7476332a

SHA512
407ef1ae6f3437c4c7dd6c02dc6e3a65217feec8e65adce47ac2bd25b06ca0b5ef252cac59ca6918796b9fdd40cac97d3a2827f808682c9426ac3155e6a7fc0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7336bbfbe714ae5f2635aac2549a8827

SHA1
3c064f38a8451c0a1b05bac8288ea8d64c5d8808

SHA256
63437c3c7d06b2b0f0f713f7bffd5dddeb6f5b7dd28556f42ea6a5d43b14daa3

SHA512
520688ea66c8e8b24c97dea99caa943387b7dbb2d6e91d348081e4c556e1980348be16b724a1ac4faedd7da38a9a2fd74b9640ae4fdf3f2b9c1b02b48ce854cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA209.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit