1b7d73172ee889e5b54612b112516dfd926ea3ba35c11aadb00b562cd4aec86b

Analysis

max time kernel
135s
max time network
140s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

03a391a8f1e3f4abc1baa9c4cda80b03
SHA1

f47849564ba5e4e44bad61f30cf66f10ee00f25a
SHA256

9593559b175ea828d4d33c280e74fb544e045858463a1a61876e358db1fe5300
SHA512

17873d7c36431e86fde0bab3022accf09e6a57b094daa51194a4f96701d767d82397a83e2a7891488996edaaa538d2f4e4518ad4de32aeb7ae96df9602cf9a0e
SSDEEP

3072:S7xpMOzpvKwjKyfkMY+BES09JXAnyrZalI+YQ:S7N1TDsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9112EBE1-2BEB-11EF-B489-E681C831DA43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424709491"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1444	iexplore.exe
1444	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3056	1444	iexplore.exe	28
PID 1444 wrote to memory of 3056	1444	iexplore.exe	28
PID 1444 wrote to memory of 3056	1444	iexplore.exe	28
PID 1444 wrote to memory of 3056	1444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b77386f9e427e69edcffda4f78c1de07

SHA1
98df8f86d327b1e475b6ec4f128b2f72db67f9a8

SHA256
23754bd6e21a97efcae35f188c42ba48215c9b770908fab9342f99148b5bab55

SHA512
81bdbdbd390fa4892f1268bb584b3fb48f6a6d16983a26f23850ac506e3fb102085e3feaf6aa67aed2e5259220ef3336341e1f2d85283165226ebd2d8f9537f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8040e205230a0812ed7206903a267509

SHA1
5e8f03a19112d8634f127c5f17ded82e684f63ee

SHA256
d98ad4352db77a60e9d5f479642e1207464c2bed694f1489bebaf2f3a3c14f05

SHA512
1bbcfde0758210c1289b5980803be5972039fedcef853b61faf355ffb9472a4eae806f0277c64491c8f9bdade372faa20edd4759247cf103d5ded3e9a742db9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63461070a7d15c58d0424d5aa352c9d9

SHA1
4137000f866ce07b54a3b8475d5ffab451b29f70

SHA256
2684da57452515d1ba987207f64256f0649ea5d737dc6b8891d74de765ffae0c

SHA512
8eedad4587c6dd6229315687a4e02dacdb0bee416a68a5146d4607ea9a5b2c8087085fbab26c863dfd0bbbb6612618e97f8306becca5a66e47e733fedade615a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c796a0ba238bfb686bb159414ac920fb

SHA1
eef8372acd4799e123d4968a9a7ca23c3fc1e2ca

SHA256
34ceca36f5ed6fdc3f710dd27d92e6fb5eee4313b8f1fe27eb6ab23c9ba31d2c

SHA512
cfd454b2639bbdc3c755b448586f334c86333f3cd8b4a4369ec9a1fa96722e86cdda4d382cf74eaeed9e4abc743849ec3222dd7aae7d96bceff336e9584576d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e6d4895928913a1632eb58595876dc8

SHA1
bff63c8841494ec4316b9b169b926c891dceb879

SHA256
ceb438f3daff2fb3ff46b81a412bf4a1549c90f16fcd127c4ae7e8946d89ceaf

SHA512
3b46b319a531268ade36bd7d2d1d5d1dd9585636336ced8940f11e5daa0634842a442bba33ca7a808228c7f6e6772bca15a6c03c031e1560d50cc3ac1f971898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2d0e4bb28242f94d4090262c31a172c

SHA1
d088ebb9da81139da77fe6e9777a9241854837df

SHA256
d37c6241e093a7e7dd91c3a0c2cf77e84744bd0ef723d0d72d99f75dd85d7c7f

SHA512
088abdf258442f42e9f860a0def590abd43a0f569e39fcdca47be2b95e9855c0971bc145da53ca6a2eb92399dd1ac7d730f0de4b0f597da7ec9b7f3a35f63658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1fc5e0d0450367104cf7da79709b44a

SHA1
c5930f90c7268af01d4124863df410cdf3871112

SHA256
6a459812a020c9dd90d31a06aeae198ef54566b216ffbcba3aee4433cb282421

SHA512
87eaa859a76fd8e8b7778c8d1d14ae9f35ec54a3241c6bb1bffe74bd37213227b570e4cf092e58f92ac4309af02ce39f31dd1d152590afb8c06d4b50ebadf64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
040c18b94bdce8a23e0fe5e7ec4a139b

SHA1
fbd911b73793014def8c76d3af909cb0b1492c41

SHA256
1377f8746c636d94ccca284d04c30d8ab57710a8195afc555523927e9b48c982

SHA512
13128edd3402b430c1adf1335a2d161b05c190dc3d1f53ddd13c229a661228b323e5e9b23a7859fc1fbdb2331cae562d2130c783941d1d32f10b6e4f10434f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47acb97b7c648307bc38a3176d2912d0

SHA1
2fc4652eb39cd51dd99fffe0d378fb42d21874f0

SHA256
12dd26e1759ccf87f6e253fc05c0b20359c3f943353b61f6a9c6760b1fddd0dc

SHA512
a98907106f9f688cf5d3f94ea11b6f668919ead6e85ce087b6ff218005ae7a805af8b281a59e753e2a20bbd263c1efda6ee2f7a403fac593decbb699bdbf258a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80a0a35d7b88e31d52aec74ff71e84ac

SHA1
470855ec7deb30be052fedee7453871ef728a1c3

SHA256
43c2145f081dc82294695f6ce5c234f0468e9750836be68ae20f099129347522

SHA512
7bc66100566a4f2cf8132d8fbe2d203c7e4f04d9fbe8743f26c99995ca6a45e6f20bbef979f7bb6c3e5f7990c43ca46a9cfc146f23950c47bee47c5b3e385031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67731a2b6e0af7299a2b04664eec2c9e

SHA1
ce4caf9b6b88139ecb926c2b38e3c378b649d5e4

SHA256
16ae989bb2e81f6bfe4743b2374cd1753bcd944b413ec48346ec841af38bd852

SHA512
e4fda41555f214ff3bb7b3359b49718555c459e7315a498bab9c88baace55133207d07971ea6f8aef8f32108b24ea6dec430cba0e57d77474d10aa9a238a2eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7e822ee6acaa14ae242cd55a019d6e9

SHA1
58c14f68d44bae7f937d743c4136fad3cc3871d4

SHA256
eed9f7997265acaae663fe1da2ba690a03712c60d5db4f30a3b9189e4c0ab796

SHA512
2c4a708ff55f3d0f2965cfad479da1f764cde3c4a68ba28922cce501007cc4cf0effeef6592e3cf3b13f3dd953571cfea58423dd0930b16d7a241267cf6c4b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd113d1f580eae479a2de9e016ce30b3

SHA1
4dbdad7498bec8f519525abce7d998a42472564e

SHA256
ca9251b536d50c459808a8ce70a54a821d4c43a099b0e7626d5f50a29aa83cf8

SHA512
4791de9631309305f767b27cea7f31788d1449312fdd2b5b9c92d2aabf437ece282290236f1cef45844881d110ff47b30eca009b82798b96f8dfb6739853b03f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06cfd83a1f5a837715ef02adc1ed9534

SHA1
c7ec180b203c65367a8e25f583a2415836261c5d

SHA256
ae572fa77dd13652b78f68daad19516caf30926707d19ac89598f9b844195f50

SHA512
a81f1c5fe3a6fb88113aa2eefbeb47a0bf83f6eee459378de445893409d63352cf32fc7832c3c9397130baaba0d3c34628526605edbc0142b8ca013f91d92886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b416e53daa17130457d543d2d535f79

SHA1
de6563790fb1ea11996ab0d46e63be66d44fc9e0

SHA256
4454b49657fb1e9648f783486e7b5dfe2cc62b0f415f9cf7a321465219a5bd41

SHA512
5633574ba1b99ff3c23d3695109c27da1b87324c470364b2ff77079ed52a08c641d7f5bbd20f38a27e66868d9ceb2f21c05c43762852dc6e666150568511ad98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06accd9597e1f1b18b08f7c981028a87

SHA1
98b48f65e2882416f9793d73195f2d9d9b57c91d

SHA256
00a18831ab139e0188446d100690b0742926643f8a0bf525f5eb43e454b668a3

SHA512
77e9327325f9ea8e5edf67ec7f1f2b02fd02a6afc8b13792acf5a76080fe9d4cc075f8a7656a043c3ffcb233a71036ead78b3228d68aabeed751e0d4258e9fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7273.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7322.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit