34d1e2ad6b166e6ad1a9c8b2006224868103e7e73606fb6eca0a6c2f9dd341f3

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e03ef205c5e1c5b751520e529442076f.html
Size

1KB
MD5

e03ef205c5e1c5b751520e529442076f
SHA1

58343f1c077d66bd5a58586c027783d29a5534ad
SHA256

34d1e2ad6b166e6ad1a9c8b2006224868103e7e73606fb6eca0a6c2f9dd341f3
SHA512

d985d199b07f7a2919b53c2db52869632a40bd5572b6046bcb6992aa9857989d568452411aac352ef2975ec8697c94bc5d873735d46e53b7dda3abd26273aeba

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417653944"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000009c83cc6b3be996a82b57981ccc51b7d0187ceac6b6166b2f62139cd9b6531ce3000000000e8000000002000020000000be826eb3868fde81e00ead249ba3b1136b2aeffbf8f4800ece245ce5eb2f7dec900000005c96054a59bc1e22a4eb77d43317c00c75c4ce82a93cbe19311ba40967cdef1250741117346b6807b24926f06492c5781ae3725f0c8d122d72dc845ab146c1e7d3b99e6e967e1373585e35532420d484580c15299a1abc49df09cf589228d036dc83fea178b916ec4379296f7d14f67ce103126c476d6b8cca6c33a729cfe07987c7d6cd8c9e09dd5f6135d3d4d3986440000000df1c3b00dde81ed36e634b2b778c57d67eebe93c73b5fe8d4b632e2708871fd49c3c1b3e1b42273fe555f7b36068a4a00ae80d26e6ace104c5153b4c946a2d4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{097012A1-EBC0-11EE-BD6C-424E8F757171} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000005cadb6e999687669bfc31986810ca954294304fcddae9b7e049211012def5b2a000000000e800000000200002000000029a99d5382f003cafa7dbe9de58a8bef233a42e734d5777aaa9a321a7afe8cbf200000008655ca55f2bca70cd3ad22a8b8626d9ef3b07362e98d4a8bd3b7176f1c0a4d0c40000000e1927bc3723d33af07f01756aa81a1f31967a9ec7505be43c9608f3cf4d10ee7352a0916602c3b64f8dc5bbe3be6dc2b6243c94c23d6d0d0614d11e8849b7c7d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01cace1cc7fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1396	iexplore.exe
1396	iexplore.exe
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1336	1396	iexplore.exe	28
PID 1396 wrote to memory of 1336	1396	iexplore.exe	28
PID 1396 wrote to memory of 1336	1396	iexplore.exe	28
PID 1396 wrote to memory of 1336	1396	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e03ef205c5e1c5b751520e529442076f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93056f7f7907b8c408742b561fb5ec0a

SHA1
0f40a2afbb9b87f45d9cfdcd4a7ade9079d89fad

SHA256
6def493c819d123140ff56400a27b3ba0c93a8b5bd73a2a94e8f9790207045e4

SHA512
f0f033b6edbea3f9962afbd25585fbf40adc716634ebaf93787068d0d3da9a23c80666c54bd05ab71e7861e74b2d134027b8c5b18aa56ad7dfa255d365ac7dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc0754121ad738a4fb6aa996f453480a

SHA1
714d149f47dbbdd240f1fe4f95f8ef19addc1b5c

SHA256
bb00e2dd71bb7ef3be0e93a66b7a50fd53fb923e9dc03d10b191023f64616167

SHA512
5cf7af3f48afa81fb3c5378b41ff1939a2946f0ef9c31124c0fd51a59d60f689794d660381b2795c3e5337491d709d4390741b084802e4ac0a44e316ee5e3d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ba75a4607b3f925f31650b95b1f610

SHA1
37129ea87fa17801075c44d807559d4e6ac064c2

SHA256
019749ea11bee5ab94acdb65a3304e99b1bec8e281ccde7bed0e47a6014f7855

SHA512
a7bc27b3b6e6953faabc115ef69d79474fc47d651df4ac283c702da4a8c05b0c29a3eea3e1c8b55842fc6091792ee4bae71f0d9d7903d7218638b8a22a72a390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f4b32b7e1e5311eff82033f14eb951a

SHA1
c9d13e3437eb04cb15bbbb92713fba45ea84c620

SHA256
5064e07e86aa5d562bbd28ec02effc6044ee9868016d1421357ff1206b6ce001

SHA512
488292cb79586b6bd4549bf12db64a2ddfa18a4931ce26681a4381e2954a2a929888d53755e845b9e0bf579041dc9e8a5ed1ed3e3586fd57c668ab1b63ac66bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e762fd6a1ffee90779acf0328dfdbf03

SHA1
cc32b88af95e1a1c4c46ff013f9e808dbe13073e

SHA256
88b9bdac2cd83015392884da80679fbce9964b5d0beb0a1cde731429ac6ed3fb

SHA512
3ba6cbab482a61e081a364f7f89a9ea8fcc284ea61f0c8010eef9ed9d21dc8f9d6814bfe9ab13862d56af38e71285fea90f3aeea31ba28c749dbeef8d5bc1d1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc4045d2aade9848c1db222240c0d88

SHA1
9b41ea7fc9194d972369fa887417cb83cb7089a1

SHA256
caeaf9b9dc574dc3d681dccac323748c3784816a5ff73a0bda4c25d1de6551f6

SHA512
c2efd671d54066883a5258ba8c0ce4066d7f79c820b5d949c09839261a058eb13e2dae7ebb33e3bb72a477c954e99b4ae9b4708e0e2662e1557b992bc35653a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6377.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6504.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit