e41be2ff009b9f86ce7fda2d7ec949a964e23cf4294d9a1ed662af78483f07ae

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e052a006ea30bfd46d6d002d33f59df0.html
Size

6KB
MD5

e052a006ea30bfd46d6d002d33f59df0
SHA1

bbd2bae3ce422c2e4dd8cef3f5f1c43bf8c1e83e
SHA256

e41be2ff009b9f86ce7fda2d7ec949a964e23cf4294d9a1ed662af78483f07ae
SHA512

f83969a6dbced118558fec09d50e5d9c48425bdfff7110bb1a36c1d7972d8a970ff3b1786d4806745cce49df403019af0d72a5998eff3d25a231dd975acb80fc
SSDEEP

96:uzVs+ux7yZLLY1k9o84d12ef7CSTUVZcEZ7ru7f:csz7yZAYS/Yb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417660889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{424B0DE1-EBD0-11EE-92B8-52226696DE45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807a1719dd7fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c8263dc101806c82a26e49cdb1f7d97900152e932270188fd7bb322ebced1149000000000e8000000002000020000000b7c4b85c1f816c94637de58469c8431a599edd68719a8b4ee680d8e6950eeb7b90000000e86bff2836b1681fa716d12940f86507be4b86de80f1a528578b20d48f77499395ad4a8df08a9210caf6537be507ea31fa3c021a998f037f06c436d5d85767d38fd2513f13a93f9cfbe921001bba7b31d2851273b8a9f8befe2087ef6448e891eb078c13019b19ad6c9fc10e54ac5f8aa3a9dcbafc5996a71d4fc48145745f8a6df307125de951a528b4ba6979093ed6400000007bc6d34bae61c2d1074d8ec9e6be0def2cc700f4473569bd9da70faaff8e71d424ee40240c9deff05d2357f95388d8401756ab943a3782850b7642b77ae2a20d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000dfd0f8437b366bf9e2bcdd49ea8ca8a63460d6e963dd3b51f39a5fc4d7165d3f000000000e8000000002000020000000e4180cd4c3d8176d5c3a2137d9382f6b94fad1570a399fbd2d23673b0865de302000000098d3395826d8f328274230f81c25d5d6029acafa6cfb24656ba5d02ed2164b6b40000000b33fe6881231eb5f31a87e19bd2df2d55bccd9f061605e39b8ec2c2dae00bdf156fae62fbc4541d74c69c21cce73da8c01f3a9505de71e0786a0971dc73ab1b3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1856	iexplore.exe
1856	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2124	1856	iexplore.exe	28
PID 1856 wrote to memory of 2124	1856	iexplore.exe	28
PID 1856 wrote to memory of 2124	1856	iexplore.exe	28
PID 1856 wrote to memory of 2124	1856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e052a006ea30bfd46d6d002d33f59df0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8bc51618e5d93d0f172b1fe19fbd5e8

SHA1
a5f05ff0ea5a3de72fe00860c06bbd9699e5f7b8

SHA256
f6cc2ad65bdd237470bf24e94b07d9982f60ca1f026b37e71309f60f44d4abcb

SHA512
1dd44ef800e25bac4897aadeca13281ad03c2da78aac008ca313fa6ed541d9e3d5c4a2b49084d081ca050ec755d809bf9dcbc16c9bbb9c60bb40ea80e4d90e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6a2c3f0858f339138ee5b7d5544e245

SHA1
2af4ecb1e16a7283425f9edcf991adff2e60fea4

SHA256
15c4512b955b723611bef7146d4979dc197a3aa05865e35d6b934b9f7575201a

SHA512
ade75bcf9d50e0d93f4e0b62b1e1d665739e98bb35b93e9a510360e7676cf2cdcd8970c78bbedb91a627975f6ecd59dffc482e2b9c4d21b99c033b770a8dfb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b407ea6e0555f1a7ce23559b76c9945

SHA1
b1dc69d45e2f5eb6afdb8ec04893e704978bcdf0

SHA256
e02a1cf48456a22c1d225f6949a215c6a7426dec94a8f4addb64391db49a2e81

SHA512
4092682ff71b29b452bb74062d17c26b5fcabe216ed97a294a1397fd117e344a1f88e54ffa8921844c2079565e6f7dc7b548af1a0cef6457d81123f7ac79e957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b53be30fd0bc5248301ef9f2562f869

SHA1
34e62367699759334e409a7fe3bf38d678f29428

SHA256
896f71c72ad45b8ca6f07ccb62e016340346630c3733b6882eb2a3a015639ce1

SHA512
88a569d6697d08f29835cdda0e11d407e76fb8f4081b691018b575e95538f93be47402a391305c0fdeed7b442fb07fdec0703779de50734eb9db3157b3f64ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b222b31aee53a8119432d129ee0d51fd

SHA1
24edcef869adf932775b3a32a9863f03b9c73d11

SHA256
74566e160ed641b61fa5a85f00259ac3d86349c0c8e2968e3a791b45c467cbde

SHA512
40d21d85dae44e96942d9312a84b65ad4f29d9e747cca5d5cd486727fa58f153f9b23cecf7bd89d3c4ca8b9456eea02886c8bc2c1241a4204412930f296af199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba6f74346e0eb427f0618b042e5707b

SHA1
a0da93e483f1de152f31b3ea43020e476a11c01e

SHA256
cf12e2c679458ee937c3972060e96e47e0e9408ae6bc2c87dafd10f6d697083e

SHA512
0f0afa0db28a657200f5cd44c97369fecfb2fe13fe96211a6d2b9a0741a3de4144ea85f57e370fb03e8bab0af5cc5d66eb26fc89639f277f44638330f843d363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
977e0b977fd6bdc76520c7a1f6aba4b0

SHA1
e7894dae9721692ecf35919376797eaba36ee796

SHA256
81d837e1016350b3e61a85bfe8e2bae435e768410e34138a26701cbca4fefbe5

SHA512
c40ec55936dc01dde7ce6c03ce5bbcfb06cd2be6ee145f5705a7fc3a0561906fd101a2a1a63a4bfc9cbdec374c5fc3c3a4a76d90680079dbe8f01d2542cef688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4632c1aecec6ff2038b84679e612387

SHA1
ea0d174b0b45613f11216fdd8dd679f0d064b63d

SHA256
15cb0c3f556b40f5cb23f48ba2532567dac3e22c4cb98968361725e6deb9b7a7

SHA512
5456445ba3a0b8b466c3bb941ee0726c8b79293362465b9e064f42b2aa2edd37764101495cea10b796cb82702a082d3e8d4fb64e55ee108d848fde6831f2c451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1c43da46e05e195f54e0d572a1a9625

SHA1
19fcc6c253af1956eb7f5878069c5cce8ccbcb19

SHA256
7a551f7bbc140f93c92e962eab69877346de64bef1f4342cebac8167ee29fc1c

SHA512
75bc17868da0c22e563e744af68b4046b13eb5c56232d9124d9fd4ff6cd7b92905ab154f9b9d48d2582a91165c0692e98659dabd0d4460eb251034f689b86944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c37c80aea9102ea2e9c729d089759fdf

SHA1
65d32b62cebdc83276839933fc59c3e7a1cec68d

SHA256
a249f655a52aca6f75ead6876f23d8a61a8b5a078ad2ad4a66bbb61f2cd10654

SHA512
c2a2cc1fce6ac806ba2cb2214200185fe56a29b22781c2b0e3e7ffac5a6257a934ef29218d411e46cffd8fc9d94c79db7e7df7030fbe477a5d916a67493bfdad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58cf7c6ae2212bce97e257c6e83a4b95

SHA1
d365d7225001e013a1ebe9d08c556164f5f87778

SHA256
eedc32a25b11f55b24f81dc267d69ae605e07c3400ad5041fe1ccbed6610e232

SHA512
d1b76ed3bc12fdc70c7c24b0f20832e637f391e7094939fe62d32850236619463e0eb992d3f50155446e68cf2e6a934cde0df24aa7795153117d4a3ff5246aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07a4a7c2f24edc599aa925b80507876f

SHA1
e28a8807672d0d19998ce5d8e39b5f944388adf9

SHA256
a2f996762bd82bbc507d77ce9befda7f3501295341f4e7de0cdfffff2b2618ad

SHA512
b5025ab10db53442ffc50154d696d7e1442fdb880d0efdf5830be480871f9e0d2d3f69b724272bdedfa2f6e5c91b73a55e94103abf58bb3f8853ce7f21b9ad50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50ffa8332b656a87652b0ac8d165af2f

SHA1
51088a90874e2471cc5d52508ce75bad8b9fadba

SHA256
d9b0c9f228e9f43ba3ba399a7693414a13f3ac5c8c6167e54f651bbf57dd23da

SHA512
c8cf64663478428b8eea6c60f1d1fd7f5ca5251705a74153648006a915a3357d892c4efc688ba5a82b62d7e4356efac2d544aff2325f1b051f3407bb97f97edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c90f552ad43acef85e5ff78a970dfe

SHA1
5b605f9cdbd3ec1660a8f3b70353d296e00bc12f

SHA256
71c0fd9b5e4c9febceb2cc2d3ca03002abd6a002042db2814919b23922edeeb8

SHA512
22c8dfeefc34171d7f499513d5f5f92f7a61c0449c9e945da6ae6dca6348f083e10e03fc7ff0d72971c3f04386b27398fda43c3a423ff22200c82aedf6b87b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41B3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4315.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit