e53b29b390defad384be90206aa0fe8754a46be398615759f5039793eca9ad55

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e19555f95ab59887482e83bf5442bd06.html
Size

2KB
MD5

e19555f95ab59887482e83bf5442bd06
SHA1

9cbc057997e16db43eefb02cec1e0f508cf62295
SHA256

e53b29b390defad384be90206aa0fe8754a46be398615759f5039793eca9ad55
SHA512

b766129057585c8fac597fbad8a25ea16537f01827c07e62a5fbbdbeb8a081f005490932ee24f5d6f3c851234620f3e5d991a2875c04bd7d7bccc79acbed5449

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417701640"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23FA99A1-EC2F-11EE-8C0A-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000e994e2d047cba47e8c2e479cbe6d5cd1ff6be36a4ad38afe8cfeec981893f429000000000e80000000020000200000004a5fc2875e0394f11883f7eecfa2d7b0cd0f9d8726309ad4907e9c59b8754188900000008fbb3f937476aaaa2bb479e30f6bb8da1ef1ccc92d0d65fad966a082b606bdadf23c4a1ef4751178adb416b830cbc0dacca642937c4d1f92ef37635111569f0ee802d4cc34ea967e2a8c972f2332d31575dd624aab2b8083d893352886eb69f112978e0f014ae1f550d02d7f4335cb55bee2639c001cfe25d461ab52aabf9d6a27bd78176c3f0b5ff11d9ab6b87dffd9400000004c88ccc2865111a5f53be8cbfbec2a1dd42ea1da7d7917ebee3746898fdb8353d8a3b6b243da168fe7e5adece272e88fb32ff8532fffd9566cb9e6f3f1e70f26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000b1b41e429f09812ecc986df5d7d5ec968ae6a25e19ac6a08c4e23d78a192b6ef000000000e8000000002000020000000cd776d98f79729dda052fdadec2bc8bfd6f26bbb9ba44c6120fbe892eff430bc20000000cfd9cadfca694dc5cb2820d7e2e8b6e077becdc75b08424c0fdd59dfe2e36b3b40000000244483d6fa81fd766d33bd9f9ad65b21835b1fa47e8abf3c564a4348dad5cc487fa6b2444375a68dbca94c5755d9a9929c8ce2263855cb727a92a0dc21a86418	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0db9ff93b80da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2144	2100	iexplore.exe	28
PID 2100 wrote to memory of 2144	2100	iexplore.exe	28
PID 2100 wrote to memory of 2144	2100	iexplore.exe	28
PID 2100 wrote to memory of 2144	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e19555f95ab59887482e83bf5442bd06.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd531e03e094a5a3be137b03edccaa3

SHA1
b68778a2b9748b3b04eefd3ccb42db2b2ce361ae

SHA256
98104a11eaff74b1f07f2ab40154a62bee9d7bd84be972301e78ca3d76be89bd

SHA512
c61f2cf29fef4a12e9046f8bf01cc6580cdafed1114e6e4c0b51a0069ca9c168f8e2f33cbd2a00b3f1638e4f2266d26088b30b6f5a3d55080e8e5c3916812489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8d861bff851a9eec51b033d0250d126

SHA1
5701f87fdce7973931f1422e4aafc209bf3c1fb2

SHA256
1ab5d0ae6e70b9488c991b135e869cbe7f33435735fe72459d05f5537e18da64

SHA512
dfe84241762768f72feac4aa1e5832cc737511bb301fd9f089b54e2c31fa29bf2ecf03f1e290ab8656054d2a8ce162b50cd2afe03a72345dc22d5c7d237ba7d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19dd463b75103620a91dba53d3d57184

SHA1
996c9e7252b3efc9ffb89b9295e8cf905f6d3433

SHA256
73ea139481cd354558c533a2c7928f5037627e0d315ff57ccfea26df1a0b728d

SHA512
500c1ad51a0107adfc0768651119da80324e2341eb33a9fa47d10573283098d90c7ea2ec91a97542c755ecb4f4680ba529b570737cfbea020318c7fd14789bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d0f59c3c8d9c1f0b0daf09445ac357

SHA1
6cf1d198bfc41eec22d80409c34575b606c7041c

SHA256
3abc7a4ba92a5f35c28b97c70f911b1c996ea0b5149d0c655c8a8027a4dacbe1

SHA512
ea5dcced7fcd64f70afd71d038d45f4b4ecf1ac892ee39d86fc3f54c6af543f627174ca2ec1b624cadd0f1772d11cba0b142590b3a8144f33a1463aad0bc1bf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039a269c937e86fe9f608346a7da8d1f

SHA1
c9d976b0c7718b074d4b55e99c0288585263f9d4

SHA256
fe63d8d71aa673627d0cd973c2a6e39120285be25f39ddf8c2e5c8a96078985b

SHA512
33926a04851ecd1e7ccb271975762a485d3f7973d1da3f488257b28c18b89a3be08cc5c408b6cde9b56b2297743d3b5bae6766f57467bf6d8f18ad0cc2a365f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9680b2b80060aede2b7f66a8d7b0e80

SHA1
00600ccb6e8bec5611c75983a5d11720ed128454

SHA256
c3fb55431609960498386d75038a2ec57e43fc936401a8c8e477aa101a11cbae

SHA512
94138526a9b2b6afba6be4ef7e87f1288e2d47ec3fce5ad17c04a4eab6c242e06cef9f9f177a12d0a1bbe890294731e98369d2b866f0356588c8a99df4189219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3947c819869e300b74696498617548d7

SHA1
74ffee34adede861414635f693b8d10afe7df8ff

SHA256
30e590c96813b90fad7db6c9c468cad3d159d32df9a9d4a6660939d07bf7a925

SHA512
7ea4e2d23f7650b7e5be7b9e0f2b55e864b385cd665b095efe06ef258a48a775a4471f466caa1cbc9ff64230150ecf9785a50afd917f0890c9eb82b5b8e6ec5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a31bbb4e391e26905df6dff34b2711

SHA1
ad97c00b7150df14df92983e0452ac407ab54f0c

SHA256
3b13177d7d044e0518266a3e2e00639a98b0456161cd7aa385007e19de4805d4

SHA512
73ef6eff47fe3beaf2cd9a3eb3b1b5fbbd080b27d6e0e740c4ae76bbd78cead7a25b51b41dc93ad3122b7b8c3901cc3afd87f8cba586dafa415b57c6123987f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd83a3ce35f83d6585a12e163e7ccee0

SHA1
ff807622024c2ded1f7d113125cc9e9face31b2a

SHA256
96b7b25e729ebddd693954fde6d562867d30b7a25318c3430dcf050bb8e3ea0d

SHA512
51c5b7b9559feca8122cb70673edd9967d3f36d870734ed3331334cda2f4af9629519168845d39c6768674e8d14e41ec3d93ce34fba4c26a9336c4590fc322b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16d1d490a886e1784168759c81dd9f70

SHA1
3577df1e8648ef3d6f881269cdb7c4ca9f9e0740

SHA256
616de256dcb34fca4eefb5d130347d746d381802149bf11872016c5da1c37d39

SHA512
c3330bc313f75ff04fd11642ede5f35c91fe0ec1e10bf0196b953250a22ef3cfea900504da4232c5a4eb818f5142963ebb45512970f933f25c6862eb4d949d9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5168b5a3866e788cab084f1122f65489

SHA1
279f0cf37d30ae50a064131d1b892a24e64672b4

SHA256
b578649d5a62c5a0f8725522d2012e8386b29db14440d7c4abe64ad33c7763cf

SHA512
a703f29214cbf1623418850f7688849670e087a84d1131a793b66b8b17ea19747f9388a42b851ee57c7783e2beeabcadeb34a30291ec10fa3f745bb40ab01ed2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar72E9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit