fb537126bb9d9696bbf36ed6161965719c4079ae93de40d2d1e8e1af8c05978b

Analysis

max time kernel
138s
max time network
143s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

d9deab58a84977568ae7d8e616fd1cfe
SHA1

871cdf2195f823ac5495faf31b8e515c66bad6e4
SHA256

39ce2aaf1bd7bb185943aeacb7d0306f9f221affd2e8578907bb773d95169d48
SHA512

90e4c2cda05dc1f6518df0a397fd93106c1d65ff94f2ec0ef0ea23dac73ce1a6fb888ce18ce602186334fb5010cb87b6eb5bd8dcdcca36e4c1849d5a86d2ee9a
SSDEEP

3072:S/pdUXy2+TLOke3yfkMY+BES09JXAnyrZalI+YQ:S/zUEwCsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424751306"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7842AF1-2C4C-11EF-917B-C299D158824A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3044	2440	iexplore.exe	28
PID 2440 wrote to memory of 3044	2440	iexplore.exe	28
PID 2440 wrote to memory of 3044	2440	iexplore.exe	28
PID 2440 wrote to memory of 3044	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bfcebc51ef2a26f13f00352be0d4379

SHA1
94c923a5fdab175344d11c22cda80b6bcb2872b8

SHA256
d30ec8a59da6e30f91dfbd897696166d8d37d9843299ae7ed0cc8c94da6c9076

SHA512
dcb989c5f7dcfed42204b37f112f5ab8a4a5bbecaf024ad99ea92d24c6fdfe3c8527199624d4315e6fea4f04d11c672166fccdbe3faf06f90716b442523ee341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a054981c765d6878b6f251b9dc36a15

SHA1
145edd5d5cdf0a8d64ae0a3cfd99480af72a6c2c

SHA256
ee0fc7b23375460d6b2014af44c82c65b2063e5c977c8a3eab6a6e940810fc5f

SHA512
5d150853cda80d02ea5576b7afc45163c71e3f76724a9a2f1ced0fc2cfa7f1df2269349338d1ffc03aca92af700160cba11520d09fa94ef882f9e5ead10a29d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
245c332b7e3ff3108316cafedb906275

SHA1
64fd0edcc5e08bca94cd48835f648615b8b2dc83

SHA256
b43978fe517bd39f9ac6bf78223bd5744ede1f10005b84e7e29c593a2b388553

SHA512
0b68d893ec217127dbb4e0e249a2cade55ebfac433f365769b55c733754c056378ff1add14c5889ab8321e3071bc35188a21cc67d4a3dcfa9013f0c150ed5aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
601bace1a5657d012f176e06b91798a6

SHA1
f3f16ed874311f3947e36c8ea0f7f7bf7dd421d8

SHA256
9ce9465dbf3f6a697aff4f1b00db4c4ae5d1ab6ab3c106d3bf267e1d1707a585

SHA512
ebf6f694e04fbefa195ce1317f073e9067051acf28fd89738f92d909b979b097f0735471b72a6b81813f316aa48b08fb6cc46a4d939b1067c21ac5500b49dd05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c064176e480bc34f42e9d66853067a0d

SHA1
c32410f3892276a7009ceedbde333cbfb397bf12

SHA256
adf5473bd9d72c5337e513c0506ef0f8ecef6cedb5580bda4f04502d0c20d733

SHA512
8d9aea017756b1d215b700ed9ce64a40ca9b2072d777129f75730a076dd947967270eaa8810f8eaf43f349971f33c520e31dea3ee6ebb0165afd903143e761c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fae47f0bbc2ac94b3f623b594a1ed02

SHA1
11f1ecc38f2b13c2cacbb89bde3f3183d2bdaec6

SHA256
92cf2eea46562577123456f75f1fabb50ccc7c7db9c9f9120e67d5596a27789f

SHA512
cf71bb57c33c102686b13a48d5c8a72e090c15fdfc51c2b1b0588cde23905e202ff3a5a11fb9b6d95e5131ad4c72115a17c28c6b36d086c460a4f75ee753f563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f07c319bbfdedbd4e51c44e0680da0f3

SHA1
de5150d99aa8784c69967301acaad0fe048d28bc

SHA256
483fc51d19049ebefeda19435126f646fb4893a1ed018846f9dcdc4e50236c0d

SHA512
ffbd898da8738c74961b5f9265b95a6ebff19fd2f43e97eef30dde632c10d31ce5f6a4a0d3d8b7561313c5c90bd760f47ed8e9b6a6e3d4092303343ce1fd32ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99c82345fc0c22da4f4a37d959c1f532

SHA1
35286b5314c65b11cb82e2c2c678ebb5aeb0eea1

SHA256
e67c593883c8987b7da409e321f60579e8bdb3c0d9c146a6bf5911394de1b0fa

SHA512
7a48be4e017ed73887d13fb068e0d5d6e99465a06d4bd88ba90f875977b6c99c99751d78a3d0d712e4b07fe2d88167b5202f07cb0b69e55632b7aa42180201c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c55db8a930c6df8d61cab803216b8100

SHA1
e36460ca570d34bdcbf98bcca968cc00cc75c280

SHA256
4301a78a765e81908135b278a475e4166eb1c0501f73202a62e98b94c1c1a8aa

SHA512
a3fc863e2246bbb72bb3ae478928e01b471398b44387fb51708fa48cf253d4556da87c593b3410b0659f6152d44b67af58b9842dd4d609de1599a89378f30295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baf7e3a6f1c363b0faae67537bf5b914

SHA1
5a8e2e6ebd8d9d224391995bed93e314b45fc7fe

SHA256
7ca10f4173a57c584e45500bbd9755e142bf8e7843e5135a952a0b8fb512b61f

SHA512
62506dedf2d779e3fdad192aa7b19648a5681e2f217f007e77cc63beaec2a31dd7ec5c66ae8aad4b657718e78e350a67ee295a33f4d3f4baebc45cf9b0bb7706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f237c1b538c6cffa359dcc6f838dedbb

SHA1
298def95edd457defffcf4057417b7be43a2f5f3

SHA256
bab7b9caaf3f171120d595746cc7c52755448785fa752fa568348c1c95766cc2

SHA512
c5ad84226df78f9552ee6eb31aad4ec29742155da0e5fe4bbbaec75c9b6e9d34ee76603a19567c863fb2b07a96d8bbc7e3d77ce135ed08cdcce2ebbad5f728e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a0c573dfe29856b5a813c6c777a4975

SHA1
84f3a96c6ba2b73de24d74a0bdce57ea17e136a8

SHA256
5972fd717eca2c7e9f1ed530c47b1a6a5aadb70f50635b4d5094f187e8a2d7e4

SHA512
541e5105f033b59033562c0cff310198be9b63d4410564e725fc28e2581a85b49ef6ddde745345c9ca5c7d4e2e772fa6703a5cb0ef37500cb91b72237f03ad38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb9e4afe1a83ec4ab69a8ab5e3e5c911

SHA1
b3301e2316eecbed9ca0e3fe8ababd6ed4782bba

SHA256
427d7c049fd2cb2ca315e16046e6b99895294a3434b79218fd25030af349e088

SHA512
d7b698262bc6231f5982b3b4c54ed0e305f80bb0c883c610f4c7c6cb018f2b49016e19010a4e20d1928e4aaec9d4254263eb977439353824f9200ff6f52f4957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9fb2931f7f28c0f5de72eac120629f1

SHA1
370867b898d5fb2d9d9e6ee13e9cbc04a6f140d3

SHA256
2229ceea741964cafdf93f2281521b07f1640a454d7e073f79604cb3bf1d9c05

SHA512
7bf6eda05b64ab21fa2d80aa0b42c725fad5be3da543a878064d2e03fa5bb3024026aef624eaa0566da7aba3592d59c4803cd7bff87ab3022d2d2b1b4bc7f708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c666eaf4bcf553f55c01e0367051bd83

SHA1
b91bbd4ca97c7ebd90dbe16bd35c485fed5593b9

SHA256
e5b95bec7c98c66bbd1c12683209d2849502244aaf985bc06a5f80b5e7fe5dcd

SHA512
b51d2b2f82b256f2e18e5293c892a75604d24b556af891fc70a6e216c9bca1e66cc494588b3701c748b4c13fe5da1de7f747bf891098fbf33ca883afc8a8cf1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
facdbbd0c90c6d4c700ed8e653b81add

SHA1
3f4588241f04af4d0473dcb246d3e68e34c6b1c3

SHA256
a716f4743fdc404d0ceff8e963061e2f98106bfe372699bc6347fcddd6313e76

SHA512
aa80c7c962804f7bce1aeb8d001535f76e0dba040a121faacf5115bf570eb10d2e6a3cc48846a15b2dd944f1705f21dccf6ce715dcb3c0d7670c6f412b32b022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a15bee5b2415c7f8d46fc395ccf17a9

SHA1
cfaabe006e35be1b5a1712ace65a2a2547d86f53

SHA256
3d3be7880295e747256faa2b9482489a78edbc135436d857cc6f0c551d6195a3

SHA512
34ab3b1131be8ddbbcb776004fbbe8e9903a4ca6a62ae74c5f43b0106e2a8ed0c3067dd57d52fa1d55cde4272ee02ecb3311e583c88dc88b81a01cd9edd5239a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
544df9b3f2a3296a0348850a666013fb

SHA1
7e646e1e3a3cd9e10b673d66365b3c2f1f85b67c

SHA256
ffc74eb040b750031dd8f38457fee543a5287536d4b5207ba686a5be1bcf6bfb

SHA512
7f5fa9a1d5c4fa00024c572170d0fe3999a81aae05509ed5c5e5539669a4b5e0ffb3291ceabed68752e0f181577358f82fad9beb3a5d37ec165c7f7068452f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF3C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFEA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit