20b345f2a030cb519d922dc79fd336f52e7fba8a1ca3ba4f99bb7fe6d070f9d7

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

da9240e0e627060617e02b8f3a791b86
SHA1

8caee315cec339dba01737c617e3610c1bcd17b8
SHA256

2167e83ab3a88ee0fb40abc9e75fa314966a709ac66d47127ad8473a719feb0a
SHA512

c74e300ca7c4924c4a1a46bbbd77a852ef3167b1a26ce1e51fb8843cea8311275bbb9f3498c86306dd2c6a69e4a4016d677d468c337fb913c87e6bbb58ac0c8b
SSDEEP

3072:S05u9Rv7f7wzyfkMY+BES09JXAnyrZalI+YQ:S08nXsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424640528"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0084A001-2B4B-11EF-9520-E681C831DA43} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3016	2852	iexplore.exe	28
PID 2852 wrote to memory of 3016	2852	iexplore.exe	28
PID 2852 wrote to memory of 3016	2852	iexplore.exe	28
PID 2852 wrote to memory of 3016	2852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d51c9ce347ca3369e2ef225b4cbcb38

SHA1
c035d8836404fa5205eb2f75e06514d07c0ca3a0

SHA256
ac970a096b394689c16667102a608df1c10b391a931176646e58a062d3075609

SHA512
7355bd3e1a67d1d52451190352686c308eea527ebd3ff91290eb544b6cd7aca67387c0a2351733594e6411276e68e7dd5ed0b4036895723dfc8138ecaefc43da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f14fe306162f780d7f8d5f724e52a4c0

SHA1
1fc58bcece4113868f72d13725c9f4961c283623

SHA256
59434b02b4124a1807406855c36f85dfdddef8fa22311ebd7a07d701eb72a302

SHA512
a197632f1ba75682a82222a8c50799b581ac2a2f45b5b1c2641edb4da1c61ea683dd03eac272a7d868b51b864b92eb551b750e0336bb307144c0d2f071930b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed4c0ea68d39f9948f8abea158e98116

SHA1
691b95bc5e404661193e7ccc5e9c9861dcc1a1b1

SHA256
9fabf7e2e46659704b5645b6cb9f51f5581fe0011933dfb50630ee2ad2fa8746

SHA512
6fc34e54859def9fddc070510e0c31ed3ce09dd23456070bf6d290ca1d3b8d20a2d771f269cc28a852b86708d3d19e7faa2e4348232cf744ee5474856f1b3e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6acac21298a3de4d9a82de455a98804

SHA1
65887569df764e5856419b7db2a436edb8137d73

SHA256
d647689666ce76a89685a4ea1e379e9204da846a85db45275b9717c75c21b350

SHA512
4ac083fc15cea4627245dee1c6466bd7036eb2dd744aab415f27ff98a965fa0042350d780c56065dda21e00978c72f2a98c86f9660586f097437fe5e9bbfc0f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
267b7d68d6cfe9c032d99a211dddf898

SHA1
7ef445debc3705c0b526bd72190abba0cc994152

SHA256
56467f4af7c4e9201b0230be95d64d9bad6ef4fe0d165e1f56e17ab4dd5120e3

SHA512
cf5ee1fedf846428e24b0c1042a2b3a9308d3ef87b7639dd0b744463134bad6c3b70806e1b96055dc62d3348188682691416ebb70a5b1eb4934b78cbfb4ef43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d6db069b0d7f2df7402c288a2d020f8

SHA1
f6d2308f91ba930c6c6eb719c8fbbcf635fec4e5

SHA256
af7f32b8122626e1490939dacc7e616a17369b6e59591345b633f533befe46c1

SHA512
0f85a0790a175abd6cc8d830050534cd4c17e431b7d7c32dc3bc0213e8c6563aab12e79d8acbc9fcc2ae05f623e5aa05be757ee56f53909c268842e33a38a0a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92b2751aeec5f059308086e481e68b0c

SHA1
d171a6587e51a65a2a13137726b4f4e900faf43a

SHA256
8cecb81542ae1b14f16064f3ec8cd9b12014d8537f1c776e99afbb3e7b34e870

SHA512
3d4f8ac999df5d469d64f0932965b7fbc35a9f2de24b53ad288c586951e549af574ba47ec4b612d7313558c5858c2ccfc3fb11f4ea7140c65afdf7a260238333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e242ef5f9b11f608df43bd5e89fdd1bf

SHA1
6f54153edb6d961a903f155f352435ec9011c760

SHA256
429a8772bfc98a5767d4931a2a55bcb7fc87ce9912ac097103c81eccd75be1cd

SHA512
88389df5736e07dbaeb1e780f30ccf7e59cffab3f53c08e49ebefae50e4ed8da53759b28459711b6c324aeab39a2bea01b0313692083dcd0a9f191b1c4d7453f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
384781c0cd11072ba67584de235e88e9

SHA1
809b11b8fbfc7b775d48b68d131890251f6ba6d3

SHA256
c26cc93a305ae6846d8fbd4c243330333eda1b6cf2637b1ced83d64a85f504e0

SHA512
a37729dad5c3c773ed5f44dcf94ae8ed73eab5ebcebac31816366cf1eb34b676975acdf33eec63ef55dcc8934a5a681fa9e90b7cb8e3bd00592f087be962c0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
692481fde5ae10cc2264894f3e23e43d

SHA1
2db2e250fcb6c1194715017562075df7d6b1b12c

SHA256
e172fe2fc7a85caa76aa19b2b56659dee0aaf17188a5ebeefaefbf70a760befc

SHA512
88b416882ea416f2ab92180038dc3817a76ca1bfddcfad96ee99f64662a35107a5cfd6a894f93010b4d672a466f91d2bf9b391939d4dc29e6999a303f63af855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ff0c6a528608f76d457ffc5cdaf7a16

SHA1
09c2fcc21f7ff9807f5156986bb2881d617387d6

SHA256
66bcdddb487733537616f8041f536128e244d98484aa1840c4952af49a9dd603

SHA512
04893244bc940816a4fa39f3951e2d11be85a498b932afb2160e74ee4285c3660d3d8cee58a03dcfb11ca94298fded77bac9d3ee8f2d6be57c71b9290f89515b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2a771faf45f50f1a1b93e6942657d0d

SHA1
b6f1eb1c8f9774c1b1d16d195f3c1db81802d572

SHA256
2dea3db8fa62864d1a91df53fc39914446fcf9b5cb77b47c932aa972f4e4ffa7

SHA512
6d59e1d68caae92adbf48b694aceb8eeecb85cdab929ac99510f36a3063b896ba2f7dcb2a8f4b5dbd972394c17322aeb2f1f80daea21f0bd8d4647309bf2b9ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ffb4210e5ad7662e9cfb728fa7c63f5

SHA1
9ff132020113377b6566575a4a62e4a95d39da3a

SHA256
3fd14139df086a8c784109dcda78aaf0a3c6242a0f00806386ed2b09d3c6a748

SHA512
70434ffe4a168a54c3cbe257175894428a2d21525fa235490764d1c831ef355c7b1dfbd0e3c151c2bcd3aae7cdb34bcac34218c54df60d27ee432e098f6992ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9716728d154ec115dcef8049d184dfa

SHA1
067b2b72090d2c81afd82fff20149821fa22bbf9

SHA256
4b4b6bc0ed10c41f886fd220404bd3dfca279e27dd2d18884d0e77563942e92d

SHA512
f77ce6c704443f782d56b62a3345eec2451ae305301a1b3a01303654e90d613a021f195d0c9282cafb5a6ee97cfed41094e14aea0641a4bcc4e3652a94a08c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8896d49d7b1503278467b7d9c93fa00c

SHA1
186115124897ab81a6ae1b6c4911c95c03ea4dfa

SHA256
0ab5cde339a47d8c254dc4ac7ce71869cdac9457698923c94e7025f443394d83

SHA512
0f3109888f45946bae8574cdc3eb91621f823a04aa6c94d9ec3b0c91d41c046c4aa145416f618abe57919840ef90ce675eb5c30e21a6574256325ab35a4c27ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79e5ff34aa7268a5b7a08aa89eea3ebe

SHA1
e5d268e6273df2cf2b8ded0de17883344bcc652a

SHA256
247f08bc1a7f32e4c0ddf8c6e5cb0c9bb613aa7bfa5b4cc45309567d8077d4ef

SHA512
38eb6d3b6bf114f5083afb85c23ba746d711aa511ac06472b103545f71d38f227485b4acae4c88c425f94b196cf5620bfe50119d3d0d2f7da7b2dac0592ac14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41d3e8eafa7bb6f4ae4a07482958a6fa

SHA1
71db35a3a3d899e2adc14f4ecd96089ab3e552a0

SHA256
d5f26c76c0f850d8d1d3a34bd95f2d451668c2a1e4d9ff656673a050da016b03

SHA512
3587805212ae4485ef9dc508b08799403edef1a10cea48050675f4798ee09d2584f7f6082d126a522d872f497041859ac6afcd62f300ca7c73f8250fcdb7e80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
052afd320d4d9eafad7c09774138f64b

SHA1
d30125d20eb93c94005761a038a4c11529469743

SHA256
f59fbe0bf84139de5cf3957a3943930ff7d0bc76607c7fae2a8af9f373664fb0

SHA512
26256a7005bac73efc2ca1cf0ada9870db56f49a0951feeac919e49ddce35e5f84b935680cb4f669988ee1dcd992820e7aa6ac28d10a594f62602f918795e330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b9acc79ddbc680da041bf285a16e1de

SHA1
f45b2c1d0814566d076ba783ab10985ce546755f

SHA256
1a3f59ced59b457618166ce1b213a3738ab5fd1e556e61cfecdaff84d43181be

SHA512
ddbf787ddd31fc7424c0c15c015096b820987de65e2270d2b0662391755dd1addf2056f8a7eda82153741874d592d4c1224be92b2cb32b050ebff879faf6b686

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab172B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit