a115138d451659b3df396fa719e60ba44509026fde245c8ca6499cb1376f4cb1

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e03041ab046e00aef3442f1cd24ce467.html
Size

46KB
MD5

e03041ab046e00aef3442f1cd24ce467
SHA1

a33dca1713b641ad577e9a6aab9a3ff0d03351dd
SHA256

a115138d451659b3df396fa719e60ba44509026fde245c8ca6499cb1376f4cb1
SHA512

cb34f979aee4474ccfacaa0c175f6c7fd865e502e9a303d6222d8fbe877383d4eb81a137bac32679d72afecc1b45474c85d393e31b5f27d1ff31923f83dae2d1
SSDEEP

384:F8fVl4a9axyTxeARGwwBhvBLKycExjtOyCgYj41GdDJ/oaxyTxb6aEuw:F8fVl4aH9RGdhdcEjt+wGdDJ/CV6aEx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000064be363d7efa0fe280fa9428bb5bac840f8c4292ab44cbe0ff95dc8a26997a8b000000000e8000000002000020000000412f385ec20d4fd6ddc8200acb51915db722eb1201001d4038c6d3d92985f0122000000095669b536e663dfc310cc506cfb94850d9b4f7a89ea3da29de0f14345718f31a40000000e25d87b251944a6a2a86fed7bdbd55cb0611ec790f3c65d8187d07ce76bdd48c620393ea589cfd7bb0ec06171d1ba3e7cdbc7a2d0de60d7a48fe311a991e985a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906349c1c87fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000003d6b61a456ad70469532a95264c271350e051ac1994b03408413630cbc8ed302000000000e8000000002000020000000b099f9b46ebd1ec6ad4457149d7187407504ff1f56b6b9aa60d3d0a65726e0dd900000003f4cd4377916fd2d1423cb3ace936619817deed5a4bd5676ece4b6cfb95a4b27b4572616498874ab60107984a4b1a6be3e884c02acfb29956d2c935413c5cf97637b5444f53193fb07296af22193f155f8b0ad619dc44e0403b244f93155e8f0be9871e84cd92ca10dd9b3971bc7be519ef3f42016f26bb927cdc9605f0631cf21499b37afcba92fd6961f7b30da26dc40000000c50bef9a3bcad9e876e1ecc9aca9f86950f5271d3346dbf61a5eda7580c6042b5babc4ae2f218ca03cb977220737401e18ce27de5060e52075c5645aa349a23e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD05BAC1-EBBB-11EE-BBF2-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417652146"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2992	2016	iexplore.exe	28
PID 2016 wrote to memory of 2992	2016	iexplore.exe	28
PID 2016 wrote to memory of 2992	2016	iexplore.exe	28
PID 2016 wrote to memory of 2992	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e03041ab046e00aef3442f1cd24ce467.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
36dab44c7326b4464e648824f48a6c1e

SHA1
5b91bbbc444b9a50d5c754ec915e6df1bd00e7b1

SHA256
0b450d1342fbaa0777b05716a605a94038b7fb4b4d1dc6d7cbe4a069220e4814

SHA512
aa1226c500923930b7d5f1639f81917ec1b388eb918f6e2644d8efc12416cab88318f9b54180efe3a1574c4be45aa66a33b36eeae6b296ff5001717bad207294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de834c0e0e92dd79fd95c47a1572b78

SHA1
44cd2f1036645e5982ffc3d1990da110671986e7

SHA256
4af1c5abbd2e1f498519389b5cbd4d2e1132c7099bdb2f8a2fe5911bf864cecc

SHA512
d1ebdc95a70b04388798bb4d02f7035ba90d362cc32a8ea33bb98040a8eea6152e9a9fb9fddfb3d72d1285bf71ecbb77233b02dcac2a5dc93ce1c4e200a20fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a786579bbe8f44e5d87b4088d78cad

SHA1
01c1b65eb6525a10b602752a2025cb965777834d

SHA256
9beb82aa922f93a28f0653940d4a5e887a83e46c854121d50b579c66c5f8c5bd

SHA512
cfdcb83aba21937955ab23cf72e8194ce2f8e7d0054547b5c08365c4ea9beec2902ce3e5c42c98f4b401782df7ce637fc83c019663a6674b0aee8b17709c54e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343d8c7cc8a49111e046e51ee81033c3

SHA1
dd925e6fd567168a32d22ec7816cc68c63a79670

SHA256
d57d6e82129c43041650d882a528450e48fcb8f9ebdc0e3f4a3d2c8dfbf8ae78

SHA512
d6858ad4fd6fed54f56b81f4c39f4fb5829a680de2c04eafa35ad0435275f6e641c0fed2d815678c3003f6fe2de36c5ff636251910dad401ad18535f6f1031d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ee958036cfc88513c627ec64c1de159

SHA1
8f35b569217b7cc7a0108e3d9d64784821d8c8f2

SHA256
5cc9c773e477409e2499e88dd1043ac9e04261500465b5ebcc96883ff4ffced5

SHA512
58f2be948b0f391fdfc673c8dd8fea8d228d06aef00986cc5acaa788577b6bc1e9d0be31ed783c46556a9fec972041bd2814da1f6ed7acfcd986057a5062035f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
938f102ff75b4c9299f8c2434d07cafc

SHA1
178435307424ea6db8cd607b67ece3af80937947

SHA256
0773bb3a396f7380a2d30e3e23c0b71f7179fafc641cd3ead65bd681716e1eba

SHA512
f78355d577167f8db1e261948b6b75a4c309a4726f1b637ad1597d0381f38101907fd66111e96c8ccbb11246c27a172c1aed44530522fa683abfab835910fc48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2f4f3bc2d79273389e8eee2e41b84200

SHA1
696a361b4aea12b8fdd60c5fd0b9ac3e6f765df7

SHA256
0f9c1874d28b3ef76b4bb12fd194b8249684e7b27cb75f288a0fa2ef65cdf599

SHA512
13723062d070297fc0c995a37187ae41c39a71ff959ac3b487d5210bb1792b5d984afbe158326eb62c03a94dca7e26940a6d802bab9c1acda22e05c33184a21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LF4IFORF\brand-management-slick-carousel[1].js

Filesize
41KB

MD5
8e167b9fc5208b1ceafa2598d0eb402d

SHA1
58e30fc9af55526a085c68fd4f372e2d123da1f7

SHA256
252f9ad8a841eb09506a3710f50e9d119060bae2857f4d5d2f55f6b260fc31a0

SHA512
9a60fac6137e181331314c056060a7ef7b8dc2878721f426454286f7f1e94ec78defd542ec1c4ae82a5f4aef032adf8748f90eb42c40fc7a2562e01dc80e738e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar633D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit