hxxps://olfaprops[.]in/mnevery/

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://olfaprops.in/mnevery/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008cbb8e8177db90928301b952408c600935d5a9c2818196fab367952c51346f9f000000000e8000000002000020000000fd2ed7a19f25c6586d5861ab5039e4bed31840ef5d03837593ee07b31645f278200000009a1ee5b14dc6de0a3ea2b8b5caa1fd59759d5f6eb4d5962d3af915394105c67e400000003d7c7aa0b529c8d9c3cf9192669db72b2965182d48c46f44e03a715170f3fb997f34ba9cc56c5cb5b01d5192283a411a704a8c38537824d7b7be6cdab7c32f64	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000016e297259cb9936d2c276d2b788e17a794e100167dfc9492fda4e450e263139d000000000e80000000020000200000008b889cdad400e5cca2de1d3881b0cb18c27be9eca536397823f84edc26fecbac90000000e56526f3b78b41a3aaecd94d2a531dc7a708efc91a45f70023d08c2978d31d551682bbd0fb58663322eb68367ea9a77206bab2cc93201b8da4b1c836947d149e6077689527f84d5cbcf1df0884046fa2b183517f3fe07eedfb98223c521148063804fd3a722eb06cf1b8a98165349f183558775168710b08000fdc03010fd6f3c9d37ebe43e2110e1dbae4454c87f8664000000068d458787bc49cdd62ca54c0924bd3d394b5cdfd4981cc5eb98621fa91401a167b23d771a8dd91e54a511dba1eda3960ba862fad3116c47bb8715b2dbf35cc37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5F15D01-AF16-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305e78752343da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410984112"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2668	2284	iexplore.exe	28
PID 2284 wrote to memory of 2668	2284	iexplore.exe	28
PID 2284 wrote to memory of 2668	2284	iexplore.exe	28
PID 2284 wrote to memory of 2668	2284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://olfaprops.in/mnevery/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2037f5bc630ca0fc09239d42761f40b

SHA1
ea668a821923334ce8e0574c9b5fe0a2063221dc

SHA256
ecac5dfaba16699c57b7739ecbd9549775db1ab32dda81752fb633f01fd3c26e

SHA512
b4abe9ee2b4aae35281c7310b238967724cb0cfc9e234fd884ed86537dbd4e8bfca4d49ab28a0d60df2736cc2b734328fff9f5c7900fcf63460e8b3be3eacf31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bf1509e3726295b988cce4ad7ae35f1

SHA1
6a5c0e32bcb0af3961324c2b18bc43a579c040e4

SHA256
170cf5261cba6b390a7a2b12cbcb9f9cc20dada167241822f397279956b6decc

SHA512
744ac276d607d3d14dab46f3bc835e8f9a69c3c49368947c09b128a9ea6c0d0dd8c6cde5ffaa1e9177a98bb6356613ebd4541c737dd6d88096ae797567f250bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ba2f4c3854055c01cea54bb5c1ba7d

SHA1
da19630c449810f2b07979ba276be966336557b5

SHA256
3af9f6136dd1f1ef3b4f9b962282a3f30d76db5512b152d2a2870ad79b016953

SHA512
c37a51d87c5c5843253b1a0f871c700e7e16dc0c0090ab5e617cd4aff095399362409d745b3d40cfa1b954ace7c43176494ead88c223110d9a3b6363fbf6a02b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79b66c271b07a99b753c18294546a9fd

SHA1
d9e38fba44c5aa9891df241904623ff8b34f6072

SHA256
a15a8a0989a026395af4560100fd7480e703a65d3c883e2abbf5148326dc45c1

SHA512
a09541ec7c3af2054cac7b152b5fb2506c77aecc156361c9b1ac4e8f205f9db4a5928181884249247370d6b4f2267cd5a0d475231c95a011fb3ee08dedd790b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3887f67c6c29e30e1827fd1cd5f01c3a

SHA1
97d188ae17df54148a01b22d9ee55c4e7ce55615

SHA256
55df2995988fbaa40db9128b937787b29ec59264fa8b09e94aa18b72745eeeaf

SHA512
12b70ebfa6200f7b4a3ccc0ed4e21e36e164f673c64d718c6874f4958cd61a359baee4ec63305bb8fbee3e9fd3c2d16c86c5faed43bc4bef3ccd32fe8266bb5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adeb306d53c3618aa7aa3360a32ce965

SHA1
35a7f7732f3cf6241df862ed826d57628be84301

SHA256
22d2153efba6ba3c58c98f6f33f6ca3b3f8b900967df43b486198dd6f10d18b9

SHA512
96dbb59288c060dd7fb4d227ed9c576ccf5752da3d26a6af161a955645017a4c99cc142ab14019c3716bb55f2b3b55d2467ef3101ae3e348edb67da904c7e2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22c09452c7ec002fbb48f649bb4b5a63

SHA1
61b9dded388050e5e6945d0eb493eaf4d8597f78

SHA256
e0edb1d43401103367d8d9c879ec11dc8bf63d4dbf33eb51045cb9c1af92b014

SHA512
89cdd1959c1e1657c3c034a08584bae32a75827c6ebfa0bccb8adf344aef7309a57da0a13444e2071e17366ccd2fb9f6dd4025579248dae7ed57067509db77ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bddee46ef58f83527656cd76cbc554b

SHA1
f4e71f05a761a23181d895975c3b38762c894194

SHA256
4ba55b65ec7a27312dde9539f36abec0896c36c831d3499b56ef516188efe4d6

SHA512
a96a13f17fed8fc3b537a7b36e6d6b4b41d0ea055ecbc2632ac772505b73f2a23b4bc62c7037099f1bf164d19085d24b024bdfe4e3c856af95de42e122edb7e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5c280a8a2ca646b995457fc1543978

SHA1
e9ce8df493fdcfb14cd43fefe72c2619d89cefcd

SHA256
01e24c5e9437f4cb9ecc311c1664cd35bfd24957f38dc1cf86147700f0f4d6cc

SHA512
8a1f1c9412246fd317c42ab12177c30e166918b8581fb42fe8012dbac8218703e7e3b29b4e4bde56a24ed5e44f10863d1e89f9441fd7a2c502d14bfccdf39376

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E00.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E51.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit