097c335d8208f8c9c1cca999535aa5fbace46172debd5ff4f65f6668b8ff7a61

Analysis

max time kernel
133s
max time network
137s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

7b2d90f03479cc1a3c71905f13b59db4
SHA1

9c0d2754da67ef0466096cb6001601feb1f65d35
SHA256

c5f35e7cee0d30ecdcd6fc1e8af09b2b086b91cd32232364715a3582c5930e8a
SHA512

8698acc449f1b07e7a5e9b2fd23e1330d2970307382e5c2791acb7b4056874ee12475532c9eaee98da79714bae4fe25cbeb181f0f239447a949ea615f2338873
SSDEEP

3072:SSYlM8od7whl/ByfkMY+BES09JXAnyrZalI+YQ:SSY6cPEsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424657933"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86C8E181-2B73-11EF-A85D-46C1B5BE3FA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2152	2436	iexplore.exe	28
PID 2436 wrote to memory of 2152	2436	iexplore.exe	28
PID 2436 wrote to memory of 2152	2436	iexplore.exe	28
PID 2436 wrote to memory of 2152	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d65b996450fa65e999de56049ee7e4fb

SHA1
757f5800013214f1a8e032f355c264aaa18c33ba

SHA256
a0e1239469b8a19c4251ccbb72a07b9c0c8a27d0b7bbf913d3a8a9e5547c7c16

SHA512
06415ac8b0de36119b3e44dedc80584581163c735dcecb52d92f16fe629600ccdae33cebe399db4367082146fcd2f84f4f987ca179687ccfbee4fc73c826a9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aa31bf71953363344d41ae6c09cd0d0

SHA1
64bbbe7fcc81b6f6c8c764a982552b901de49792

SHA256
982760459423c3428a188a89216ceb2f9b19329acec4e0d654b6c27c380a9781

SHA512
f1448eb1ee3affcb3b94c92a38a0602b45319f9b1f09f9b0b38d1e2cf945634d6759fa6f42a2c81c7799687735bd008a21c17ec568b8129983809ecad368b300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af0867aa851432073cc86c14a9141196

SHA1
5837bd33914d1c1945786f013e3f6dd272303eb3

SHA256
8f5c4d4688d8a0731c1491f8ec65641d106f0f9e37c0f1d563db11e9334ec98c

SHA512
ab7f07ae5f2036848fc768c59312b8376bde9ac8679bd9453d895ab07234cbcec4109be83f0bc2f76f2f841696a7f276aa9a7fb1f87ff6b70753f22a302ff434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
124403109c0f20e1fa73a510aca4afc4

SHA1
7c4b7f9a53b020b34b4cd679bb55649e52da554e

SHA256
0b22a6987c918e58b8bafad16532410edfaf3d93441bbf3b344076bb2b08c411

SHA512
1b89927aa4f4ecfcf550e6f3a22b7a6f7b67a09223368549969ae9347c6ecb0212440be158e531b0a985081238f49d5c37706db2944a77ecc41689730eb0e477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8b7bb9c7dc7a0045d1b49cc40ce4157

SHA1
81a53d3305251788782cd041b2d3e6ce36b3d9b5

SHA256
e9139f8a0807b02f76efd926a748c1f084a95ac28adf6bc0283492a9355404c0

SHA512
99e2545028d690e76e9c89e199531d3a14729f0ac860e8a74575fd3fb2cc11d16e0b715d449e851ef68c33b16288d2d35b8ed6bd1088a5d8c5f4b1f38566bf7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb286c6a8f4625320a9707c1ef3a4867

SHA1
59391d4e4efabe82370ad2ba0b40e899bdc56526

SHA256
e87a506bac5170afcc08f4e0d75b4e003c268254ada8ee1ff8466ba71bf0f177

SHA512
321434f32d2ae9cc1c7d5993c5d85c1599994217b2273db873f547621c0c55d260ac91aa74e0329db8873e4c6d1894d35244f3352c8a2de910ef776f3b77a8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8263175ea93b2b326e615d3f03ca4b4b

SHA1
fc89da18ba3fddf406c21ee64383a12a03fdbc53

SHA256
8c719b2a359bae8578d8703ba56fb083976f79113197b8df7888dc36f7e18c2d

SHA512
22d53c10a22fd5d025647fb1d3c8ded7804a71aac74a61cd66389c630197ee1363e88b53b5b50099b9e8dfb60e27af2d4bc384de57c3b14e806010db8fbaafa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28b548082457ca7ab7d81f58fffbd8b5

SHA1
f46a78e7beeae1c25d0782b61e33e49b88c54b84

SHA256
037d3075906c9cd66419ddd04ab410450ba47a166737c0136f0b10a5d9d888a2

SHA512
93630780434afed6ce4ff9f99d20499bcd27dedf65573af173a862cb6bbe0d3e99f568a7c542c0b8ee56ac3ae5d0da20008d905a5921b4ee4d11c35ae8d5a8fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2953f0208114324ff13d1eafc24fe121

SHA1
daca77bc0b9ce8aa779d47bf518bf1aed92f4baa

SHA256
abad82b77f852036f628cd3e2bae00e2920e437f6db5826fbe23a6f4251b99d3

SHA512
3ec5bab806318128d84d160b09eb3f33f19fb8f78f792564a851e5d0ebfc435ff35536b57244c9995f52dfab425187e67c83d8388dc4f43a84960b741828c51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b788ffa59b89dda7002a760cb22b5f55

SHA1
2cff11ae16f9911709620e49e0a050db7d2148a7

SHA256
c4e1c0db0d618338815a1778726a3e79c08cb8b2af78d1af4ea5090b30636776

SHA512
ef88572f6b28f447a560991eabdb4c796250f7ef5971bc26dc02949df5b6ae61f0d97e957679941fb13a431e235af745330dde7aea600b1113465e13d45449c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4c4698b7d8ceea7e5549015412fb7b5

SHA1
d040cddf254a34da8868faab58947173320aa359

SHA256
8810462101a7b3e0111729241a33bf6dc7c9ca68d2366c975caa1f4d6f58d83d

SHA512
b9e74238f489469ecf40605385e7bfcc1ffa8a83f0ccd42b41dbc3ad2be9e0838b237df0b139833aee35f426b115da6d9c62432f380f436efed6ae00f6beb885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3c5e608bc316ace72652717875582c8

SHA1
4b58b05e4ddb0cdc9bff4a788a97b845a88fc322

SHA256
674639512019ac4dedfb985cd7e1736b886c8c917883b8175395e5a286cb7208

SHA512
66abe6f42f4a951882bb6a1e4dc0b9bf0e6b38770006e7d4da2005f2f03836c11472594af73f70785adb2af4e5d820c7fd636a57687d97addb40b848df4e4cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
158aa00de43088a767012c3d34fb8e3f

SHA1
1ea7499299ea78a566caf0487fa501c412ec62c5

SHA256
6f4763f0bb84e7612ef18932d7b492eaa7acf428fe66a844c43c4dc7f4814bee

SHA512
6c358249d76b09d5e2a536f9cd7e2db1131c3bfedd067112962df6089c28e26c9c00bcbe6cbade7589b317db34e5fc9490cc6ff26ccee9358f9ed2e45fd6fe1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb1dc24dd37f4995ad39221a6e566fdd

SHA1
9e2cd8f9c769c2bef27b836206bc585d5d7f8f45

SHA256
df69f46bacd7279fa5fe0747310a7c0d94a799d107227544ba5724bfb13d9e41

SHA512
6c016952228afb72042b7b610ed458d78b43838b9647f38b55f284890479939c73174b088adb0906b8ce94ef56280c414355c0f3bb0931ae745a0a1e338351aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b98f9d64dc3ab8c4d012c52c1e73c584

SHA1
b7e37f0cf3158e90f3cfec42c60ed4b47a1868df

SHA256
72e9d7110d3f02d591528551a4630dfbbacb8c845d26718c7e426327660bdbab

SHA512
7a6a448b930f17d79d79c5d8328cabfa1f73ee60b866b3034d25f5d01491a37c601c76a2e346d96053659d4da759fe5cc75ec99a4e5abd45d6a7dd7ce00c7fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe18e7b8d1eb6af28e3843178455acd4

SHA1
88d4cca3498802ce15d851f6fdbacffe7a3d6134

SHA256
127914481d9b59da0a0079a6d6719594be63cf4b78742a376620c6f4b7a6a70c

SHA512
f0750b1fcd3181079bfb9cc53eb5b34100035f69ec2126fa1ec3fcedc0bd558d78549f35825e20b92ebf9de51e437f79a14853d93f63b02faef8f6449d195f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
023cc4e621a3cdd107d367277550403e

SHA1
90c2ac1d3c7a36ccea2410cde43bcebdb843696d

SHA256
92de457ba7f40852197084d05445b87f805afa275461b44c67637397b868f3d7

SHA512
f67a38fd2620e27643ce2b890b46c6067908ec1ccb76e0f373e5cbaed9e373a28a3e7343c29a641ffb8fde0c59fe7e9ed901f1dd5faf9b0107a57d51c95b4b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1603457e5d141a85e92df88eae1197bc

SHA1
f888b84e17e6eeba112c04961515e26e3d16b63c

SHA256
7afe0484f8b2f5baf85449accad665730beda44d58b96851a2992669527facc2

SHA512
bc47ab271241fb8f24b331b051bb7d34b57b4ae39562a6aa13d9ba9f9de8a39fc61bf086aaec4214047aa9f160e5a68bca78f53d18dfb60bdd331cc219f8df7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
295a7357f2d3f3e02289eaf02f5e3324

SHA1
f4bf434712ba74ef2f9f689e9f1ccdb34c00edfd

SHA256
394dca6c9830586ff48b2ac55ae4d7fe0faecda3b136fbc223e6837e981dcb3b

SHA512
039549ed3690f0647ff6c1d3775c09813cbbaa3d1e8ea0379c2feaa1d188e03a386a1b35a00922ed486f27bdf8559ed68eb3dc288826c20ff5a14896daf2024e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F07.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FC9.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit