e0e9ddad15a10f914710272a55ea451b4252c16d3fa6442b0fcfb0c390de3f6d

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0e15467448a57dc509c99d79a3dbeea.html
Size

45KB
MD5

e0e15467448a57dc509c99d79a3dbeea
SHA1

42626f4d555fff1c2dfae38ed98bb14e223ae60b
SHA256

e0e9ddad15a10f914710272a55ea451b4252c16d3fa6442b0fcfb0c390de3f6d
SHA512

3dc42089ec71c816e387c53e2951226c4cf9f98c6abc216158f8e7192a6f4f688c9c89a5ac9bf1d4d3bc34b18836c02746f0969abd8b83c55b870a7d85eaa50c
SSDEEP

768:KnTUFBbjHTyID9o4MF45pbpLD50waEo2a2NNZy4cxwn7WXJSGx7MYMAQlyQm/3Aa:WKDq4dppD50waHkL0Vxy7WQGx7MYMAzf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C40C591-EBFA-11EE-A72B-4E74C317C9D7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0658a720780da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000007b458ec7739561f4865abffdeb0f3b280d3d617979daa3e2d6d61645025c8e75000000000e8000000002000020000000ab695044a99f89102d143b6d4e0be3b2406f4bdb1e6913405de3cf28015c54ff90000000692aa1e46e693215aea4b73d6b57c17907b5b462198182f850c2ab827d2b84f64a8f55d0a158d74e25fab8cb9983a5adf661626fd50f8c15dc6366b4b79bf720db2ffd2be1b66a161a3c296138ef172e587e36b19d40b949c1b36fd4a0b13d2e09f6e971e0e4aba4aa196390ec81a8cd7648806e72e8942b57742db99e18c7f50ec8fcc8cd2c26e57513cae8abed6008400000004ce20de77659b90325705cfccdbff6c38741b6bb66bb61a6c4024655fb39d086bcc25887af9b2562d26aefb0031ea3f3b3b07dbe78b1f9ce0bc2c32f41f5ac9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000372c6cce0d43b1981d1ef57cc2ab79f50ffd65378617601b851caa155783a329000000000e80000000020000200000007da6ef5416d7d51a7ff8875f14700811991ef5ca26211c87dcdd9ddaea1f1f00200000006b7d3b1275bf1cd44aff6dd339403ef398a4b4b6dc46f738986aaad6790c6a8240000000f12273f3f0467575655d4486a03b3dbe40287d2313a695e2051a5171db3067c29268156468932422eea0e2a40f69f2df4a08274aeb19833ca0054a0352a423dd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417679083"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2988	3028	iexplore.exe	28
PID 3028 wrote to memory of 2988	3028	iexplore.exe	28
PID 3028 wrote to memory of 2988	3028	iexplore.exe	28
PID 3028 wrote to memory of 2988	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0e15467448a57dc509c99d79a3dbeea.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0d46b8f9e155d45a88ce7150c99c5efa

SHA1
fb59894b4173f92333d74d7ce033c0b550c30da8

SHA256
6f4dc57d467899bd8ebe42527c7e788b74bc5d701acee896d26520168651a415

SHA512
a042167d7771cedfe3df2c2be5f50ae0c54d007fc82e83f42fd2c6d2c1ce96d92d2107241612edd53209afc45427cd6c2bda6263326dc7412781cea027f1724a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1509285a89bad59dcb2f651b9a1cc0c8

SHA1
1e1bd272568f29f779fb69170bc0669570979739

SHA256
c97c5f4e446322e293528d377af42b344ef2e189610fc6b93eea4ea3115120a3

SHA512
0a9378cff0c46f32883f83d9b9a9e4ad25beeac23a6533ce234bc9696031f489ce12b56597ae8a268888aace420de51c4339f3e431003f874f57973327d72af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7f722df6a4f7ca039ca8fe76bc2b2183

SHA1
3355b56e87cfa8b45b635ff0e60c6daff77a7e3a

SHA256
665c5a481f6e91f53a4fd514f64da5b234ef9f53cd515cda1c3da278e25a6b4c

SHA512
8236ccf8914b07d40e0aa5488027c4d340b990b8ec4f2e81404422f1140a2dd8ea3ec11c9a71f818ab770976378c0280011f56847d3703b472b84fff2a0046cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
088cec1a58898bf5491685421de8219b

SHA1
ea589e7c6e8bf3f6d507d5144d6ffb7d87f945af

SHA256
833166cfce6491f97c968a55666fe4ad9df2694036873bf213d791fdc65a4c18

SHA512
0ca50eae9da1c75dce8d8f11d7a2f75a666cacb3203c1a9256a23bc72679ff0af1031845253858fd08568262c1a0f8571cf1f1adf88cf67c5ace7fdd7c8d3e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8aca20b1253dcb25cd801fb3be1e75a0

SHA1
659652f4fea68a1a822bd8e13065bea3bd7052e0

SHA256
718f99c74df8753b4dcde13a486aba65dbcd2251f1c4460096e2a4c79ea41a89

SHA512
17cc5e14fb8ac1e45ffff16a53bb5f8f88a516ab5a0df195ccc8c7a882fe1a9eae6328987644c78805ccd4650e19f91a250b112e479841618019e755537fe5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0a02e1879bda04d6eae34b825c43cfa1

SHA1
ab6f7cb120bb147449299b7f133a25bb3703cd75

SHA256
71f3dccc520c56b93386ae3b969d7aa9b50c75a8f5773bcf6ccbbf93032cdbde

SHA512
1e6789473448a961b9b9bd2e133974b0a1b604440d0c58ddc35bdc4952fac64b031515cd026ab68b7ecc2660f7c13629f5b3beba69e04f3fcf39841de3f398c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fc41b657000471367a9279817cd81ede

SHA1
a9f74e855e8c1e2e070e804ef1bfddef1bfeb38d

SHA256
d769208d1de1245ecb783c4ed983e16b79ac737d0ca6051229bca89769a3675c

SHA512
d995d52fc91ac8751d35a4f0ee8e8624958ed5c3c3ecf08f3f53046c8abb8c553e39c78e517b88362909f3a9de59c807e54e183bddfb13bea27ba038b8690f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b582f3e4b93571c166bc47c15d2b7f15

SHA1
0ff8e5e435417f751958ac255e0561d9273776a5

SHA256
57474bb2136c1c78449d1a52be930cbc6497b578e0a5c070c94ce9bfe93d47de

SHA512
0735014640e0a055eeaefc2f8acb2f4f54c417f67aed2d20d2898bf4b31a3e60c3fc5ef6d619c73a8c454716cda42d4d355b6e8406362bc45c73250c8b19cb3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC49A.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC701.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit