8cc8d41b99080bc57e036763a122bcf3435494a4b968aff2c8928cf578269f07

Analysis

max time kernel
134s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

6048789c9f258bc91ea332a8c00bbfb0
SHA1

6a41ec84fba1feedc5310bc24ac5a962b50c9542
SHA256

8fa3fc9e7e88d9d414407ac845e7ea057b907c651f1b2504e3ee5c1291b6f671
SHA512

d42af28a5c2a6c028b5250da7c3551f99e783d2abb1f57941fc9b5f916deb2222fedeac74509bc31efa38927baa9556ba362b9392d954f3ae15f4af4af7b77b3
SSDEEP

3072:SF1BGTWGZfLgyfkMY+BES09JXAnyrZalI+YQ:SFG5psMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424544547"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{876C3E61-2A6B-11EF-8414-4A4F109F65B0} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3012	3000	iexplore.exe	28
PID 3000 wrote to memory of 3012	3000	iexplore.exe	28
PID 3000 wrote to memory of 3012	3000	iexplore.exe	28
PID 3000 wrote to memory of 3012	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1190ec523c68462a825bdd40221bd788

SHA1
c11de9ced4d1b2a96dbb33c87dfe662cdd07eea8

SHA256
eecea863a42eee7b0335207ee2ff5b3314faee2e22e6b32c79c03b9dfeb290f0

SHA512
b0a756ce5689c2bcd1fcab07941882d89179e1b74570253bc4c9c7a50dc1d497a3cb50dfc31c5e85aca543f2ee4f56c0cc21047b93d46f33c3e1ea2968570ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61cb9e64dc8b1176d9b1e0cbbbe712c

SHA1
a733492cefc356995eca7f0b9145c43be538b7c6

SHA256
e6d82b2d887389a87f500840ac51e6bf019ba07024db23493ef5e81d5f512981

SHA512
686df55d54c398f4e182023d67237fbefdaa426f73c94d845be4a776cb35684a7218c898ed9b49a575cc0ccb757edd38324f7fb2327572dc40d310168dd82a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5e660412faf728aabb238dc6b3bf177

SHA1
8b119a096992b794d136e1f7f154b72084652274

SHA256
de1d57fcac53b6d0d2539650029962ba3e0aeef8da47288186a5ab32ed55c28b

SHA512
9508fbc760c0a0bd35eb2f99b9095a85601117a8372148c1c5a3ffbeb9daab55a20c34bc03c017dde249dde2fb76547745ab84098c67a98ed9f0f4891dcfedd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cb0846938f0aea031548233d3d6fec7

SHA1
08a1164cd58bd8962046ed1c7af6e2e99351ff32

SHA256
8e1e2ff8e2f131088f19f6923866430de8f95ee7b178d4102c5d8d6f57d34be3

SHA512
87a3e52d47f0575cff763503f26d4e1b080f16d9f6a40435dd81385ef5bb5a989caf18e616876a0891f1da671736704620982112e4eba975a693dad233fa859b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5c0e9ffb8547d62e852182ab0db6a75

SHA1
7062fffa2fa971077d6352aa106f1b48330476cb

SHA256
88461a9e15a52d43fedcd46375f51356a61f21ed3ff32f5d9319d7b93d8f63ce

SHA512
d080641b4637f73c5384ce2b2cd8adb4c0b80d75a066d025966b9cb61c503ab5819905430751e2a84bf11ad36a943c3b525f0a4039469ef3758e4fce574d1cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69feb600bafdd2c335e2e4e2dc8d0b76

SHA1
a6c345b2bb619a5b3b15c1b0dce15949ae10cd4e

SHA256
8ceaf08d2456a4161f9ed625dd2772e268c9f9698c745c37aba6e3b04156bb96

SHA512
a5a5743521bc44a2c802737d358ef631b18755aabf583e27734d807cf070cd1e55f08aa67701ff2094a94091c957aedf7701b116765ffbdcaeab48b520e54c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edb486e02d2bc98e33900dfc610369d7

SHA1
178f9f9afdc9273504310e889c7cfc2071f344f1

SHA256
bc13ab4381965b574eaa6a7a4b0b2d33d1b853c0bd13c52fd7d27ad43963ab20

SHA512
9758dd677794936dcce865d0d8e093add68371fceeb7990edf70d1a7519508b699228de2ce75c106dd98c3406b606373802b751a1374c11265290b03124776c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99163d603c04cc620e5a52f995deb4d0

SHA1
551f0973c1b66569f8826070ae3273765dfe76ba

SHA256
e1e8c90f6793bebf93320c2624451b0c261fbf9392b6d2a5ac980198ddd437c2

SHA512
57593b932516422d95026a1100d0480b0cbe2e0f1f5b983992ee56b2597d860de6a5a6f8a7055a17fff18816189e71c3b0e9774f25f2103a75f7e9a7f4418b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58ec448b7d1c1d1a8c958dba8d728238

SHA1
5efbff9d7e9bd2f8c8191bf18f5358ba517d29e7

SHA256
4f3e4bcc7dca9ac818d41c3a861785dc4c528f26a6e7caadc948c09f1735cdcf

SHA512
be86c11ec67bcb0af884db933ae77797886d694d5152375aa0b5e460fd18c2d2d0cafe298e09c3e57db44606abb6fba11f583b033442d8a11576d0299e93cd0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28e029530e04269de80affaf8e01d5c8

SHA1
cd531bfbaac1e26bede798ee0efed6bcb492ec93

SHA256
dc7447385b852be8dad0922a8bc8725ed141c2c5d792fc29c27097deba51dc34

SHA512
63788fec6cd7f41d8edc130a37b86b0414c9ff707735e3830b451627ffb4109a79828f86833663053df8fa0c8f0eb4bf1282e7dd1a4548565e4e2c95cc73de2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be16e7d88c094ca22b1083fed9f148c0

SHA1
1e47519131d88b7e4a1bc5abe3a9521580185720

SHA256
4b174547203fb9344f3efc4fe153efcb43b7f266dfa94f52a48c0b4d4bf2b75f

SHA512
1240c6011e565aa7f981214f838c8214b50b3ecca3b3dba832f8ddb8ff2d37dd34bb4fb4d98c419711d23e21b8d3904656689bcec390543e20e5b5fb0684ddbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ac105480f0ebf0495171462a4b9d0e

SHA1
643dea7ddf2c3fcb8a8977cc6622c33d9ed1f07e

SHA256
c62ce567221020758ea854f71ffc6bebcb174e69462bcb104d3d9d872a27a519

SHA512
36eaf50f9aca364a2e86647c936816373d5fb0667abfb6e8b5b08136253afcae8eeb6d460182fd4b0337aaebe539cc73de4784ae37b59ad6d5292cb1242d2aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7421dbfb82a070e2487f6c39221959f

SHA1
bda27e12865b26c84d1e22c729d84d1fc436c0b1

SHA256
2f1db834f2840b18c17885feaab4f6d9db10fc0b8583354192f283f5f66c861e

SHA512
384d3804f6f46ad5d0c40420ae83eab1dad866a6d681ad7a2cc35ffa6cd1e8f182868b05642535b9a3dc5b76a1264483c8829fb03e3c835e75b1eea2a6c51838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d222a92348c8880cf21e8149d715f9c9

SHA1
1dabc21749cc76c044d96f80d01665812e736724

SHA256
c28aa33494e654be8fca461bc0b48a933d58a370af2eb9a1b8535ced744f3bdc

SHA512
787800b96a6656dca8c5696fbff6a5491c9f218bccaaf48d9a76865d53e8aeabb67acee1d067b30d54043d81aade6a1a139fd152ea27c37196814fac20fcd69a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8164824626fdf1fa1c94677a46d92411

SHA1
3e2f4a7d6a63cd417ddd3b1edc2ca514c152a32b

SHA256
933cfe01b06e19448f64bcd07500639dd92fc85a0dffefd1dba3d9af8642ac69

SHA512
cc12fd587534bb42258d62ab9dbcf2eec16baa31b26db8c342117383d7a0488fbf1bccea03af70e738ea690309dc89ff452cb00ad227299b19ee30e7bee655cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d646c19c35881c01263fd8f24821708b

SHA1
2bdf8657c38e777deef574b6b30fb28f2cd109f9

SHA256
e4411da44703584ce44d3dc60f0be7186bdbe51cd235baf6d93ea5551d07615c

SHA512
79305dbf41a9dd4562c341c6e7698f3c25a0669ae4e8cf16a6c5d1d1b497b00c4b9aee927462e99b035f3915c2d2803356aee5944d93ed50291669c1a9746977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
073448213d2ceba03a0a3de60c1608b2

SHA1
73d90c4090fa65c0deacda681cc16e0ca7a1569a

SHA256
56a2004089d08965d857b4ae1db67498bd94fbd4d443981f80649291aadfc22a

SHA512
7d4ccdbf88cd2aae2aa4280f81f9476370c112d01f16f37aa4e386dd8cf8cfe38de2103f80da3f9578bdfc221c395eec79c1446b49e0e9b4aad7ed172017ffde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ef3e421a57c08273a85446becd43248

SHA1
b85a7b09fd3a1c21bccdd2636a5ab12cab27bc0d

SHA256
5bf05904d40cbc342589dca854c2d868c86ee930b8a91ed63d3ea0ccebcb6787

SHA512
63c0ad67fc7cc58a756cb8b266529b1f805679dd355aa8ac62e832a37a2a275c786c6795c06f3b89b2f3f2557dfd40e5180501979fb103e40ccaa7d58e7eb9b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c01292925615f1b47aa77e0754f5099a

SHA1
c972384bcf1f6d988a0c94d7783fe5af59d9d7fa

SHA256
42d93fdd4661b926b62694bba34d4ffe47672fabf6a7cc277e41741aed08d287

SHA512
6d701e290b9bc198fd27fad1becda6358cfb6ec7f4543c3d0fa8a540dace25cd09aa6fc42407fbadc3997df2999c4375784d1a563a6cb0a2d7a3861d13feebfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2158.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2249.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit