625d366a49ac751ab81e0b73fbd59596fd514a93d3456097d68b264809b0d883

Analysis

max time kernel
143s
max time network
137s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1f3bef17b6921b5e8b91388f1c9ad4c.html
Size

3KB
MD5

e1f3bef17b6921b5e8b91388f1c9ad4c
SHA1

209a02a6d91d115f62935d2eddd75e2171e65aae
SHA256

625d366a49ac751ab81e0b73fbd59596fd514a93d3456097d68b264809b0d883
SHA512

93ac2389f27d30590eb017c93ceaf40173511c321cbdd112f77a5eedb871624c4cf884d8e15a59a890bf4d58763459232a827ba7f11e8e883f1088209fab5dbe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003ff48e4b9087d4dc84605415af87088caf412fab01f809797a1795604450f93e000000000e8000000002000020000000b96a436e4f322fdca9a8df0185bb5e1d71337582ddcc7a7379d919316ade3f1390000000df10f02f5c7921a5f92d68b411970f6d63ee2cb62356ed45f57e749deb50faa51116b9ec950494526abae3d13bcf1217c2a58ee83c99784dbf95166a3889769e319e12b87dcbfba42b135ab8263b686008d143a5b6c60e0ed4b84312a975ada045a82e96b5daf6ea1ffccee84a217bf57c18fd1e27f35d4b027a1e1f097f41a1b5989c6a8394eef9da9e336ffc1e8461400000008a824b07cb8e788fd833622e67f4c9a30143d7c4d2f6f449ba63d34cbaac232d8f5eda41ad060efedc3ccc68cbd57fa79eafe3733eb43de49fd0365bc3a4854a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417713592"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a172ce5780da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2F537E1-EC4A-11EE-9907-E698D2733004} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000506d3aa6ff6afc71f8629c7b93b33a00efd5247c5292940d9d68be6cdfd51ddb000000000e800000000200002000000069dc18d75f13ff0e7003e177d0445d068f01b1e1beb6e4cbe1b477b994fc92c52000000050403881c5311fb0bd92bc654de3b5f1496c6bd65701d6cc44509c18b383a1174000000047d8a5982775bc9f6daff8a66ac57d7a79bffe93ffe30434d773bdeda6ca26cf4f6597b5d5747a93974fcdce448bbc504ce8b180fef23eac48dcc58c279fc8ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 3012	2016	iexplore.exe	28
PID 2016 wrote to memory of 3012	2016	iexplore.exe	28
PID 2016 wrote to memory of 3012	2016	iexplore.exe	28
PID 2016 wrote to memory of 3012	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e1f3bef17b6921b5e8b91388f1c9ad4c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
50a6c085cb34ceeab2be3f562bef16d8

SHA1
a5d1237e568f947d2642877c9773646e93ab3bb9

SHA256
f85e51e9d2abaea4b9356f60a61d3c4a2550150aaf6cf4f2019343440cae1721

SHA512
f04ac0f13d922010a36896c9492f76a74056f4d47405f726cb7ea8e6f63aad20679146722613900fa8a8e0b74213b3d3d5ffb869af82f7fb3a3f44b237b392bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d05fd0f01237bd758b23012e2910dc3

SHA1
f4f117b79fab542049e3fc0f528fc8a8b2ed0787

SHA256
240068b8dc2bbce26efa4db379e2d67fca1a3380e1c6dbd951a7172c080e7fd1

SHA512
ed3e8ea0a5422c3daa5ed9d88be2ee62c553dc1434db83ff526ee54d1f79a184b6c58a76e0559c8edba80048fee5a8dd2276ab472d0b7ac6c6125f58e1649f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57cb737ea6fee80167ff64e669ddee19

SHA1
2f87ff5c1ce2dcb852e72ea833bb5de7782fc971

SHA256
70293381953d2c698661955a02fad9d9274a0e8c996b0f4ae4918d050207331c

SHA512
4b70dc59be0a88435abbc2cb662ab02da3b4e98146b118be474e4271994bade5b81f6f8948f37c61b136aec2453a03f033685a769412a0510b09326ae05268f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
128f4c516c7e41fb049bd24d733df40d

SHA1
78d72257bc176272292f1665191331c019f7852c

SHA256
b32b3807f395dc07aa4f091a5851fafb0307b8f3b1e5599cbb9744b324726760

SHA512
697338dd611e0660b9ce18911295523217ca34e5409b9e8c65e641328129c4c4275c7e674556afe20eca99a0b0a79df3b724c2547e327a4e8ca5ba9f95e9d223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
538dcc95280a783995df4f2ecc14bddd

SHA1
2fef04c82ab2dbaec681fa96177ec765f38a1c24

SHA256
85ba88e1ef4e20523a5e5658ca3c90c8ce021817aad972d234361c3e09c72ee5

SHA512
8dcf1e3c5db364e100af2c85823154375873a62b7afa06933dc2d4842be41f7799e2df562a6b831aee727663b2f9025cf13870d2d4ab9da9b92b57bf0552a999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50254e2d868ea91e805dd845d49fc68e

SHA1
fe13f5040c339e69387470053269bd78b41d5ebd

SHA256
fb4d81b3846b0ffc53ee687af5e60e3ae63e94addc6cecd27fa204cc55e52d6b

SHA512
2314d8652208ce32110ea2e359b9b2b11e5a7c30920b5e480f486b27d21e62053afb62bf5a531fd1cc89ac609e8595d2e7cf56a2d433aaa8b4c9600cfe675183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbdaa63114d315ad81d36bee1c80b6af

SHA1
3b25deb4529ccd620adeba0bded9240943be188c

SHA256
5b97a2b23f9bf47be193ba9eb93fa7773362591065023e35e58ed8bf4ad00f68

SHA512
29b32dc2c2169320eb5e93aeba851121f0223e1190451d1152014160e47bbed5f33c135cb1ca4f5e86286a34e585893a25d20a36b74b30270645a7bad4cf0676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
196aed56460c50c431ac7f7ef2a60679

SHA1
df73eb5938606969dafd781d9036bbc05f183a9f

SHA256
ebd72830df640b3148bc4c52dfe0594ef00c436a50dc42c15619110f7bd72431

SHA512
0e8ee67fb33d0db38e5c3a5d3e5f9d8b378588563664fe63f1e6e541c4fcf5007b40ad838a45cf462bfdc426fd030356a44d7e6b031c184be37adbdb7d09f4b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eabe9dcadf7fff2c5dac9c50594e1889

SHA1
aed7304d5924797d64fedb2c5d261f7efa0810bd

SHA256
949c2293a0ab32160ff8a0acb38dc35cb06c45ca44fe0604144fedb7947e9e90

SHA512
9d9b0e41c421a41d2f8aa51679bb313b124e90e547025a54a1d50bb20f83f23fc1825ea66a7dea250f235a22affa2bcced2a59609de79fdc7db08d08d9d8a93e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
915431c4439803f4250919178cd87170

SHA1
166d7a811040867a6ebd93f26a8d6faf9bf6c3e8

SHA256
1659c5bc0a1694d07af6cb6ef98d40fcb72d9815fb7de51ad47dc4ec6c2c7d13

SHA512
5bdb5b75ad6107dc161bc6924bf702199d2485500c562fa8cc0b11e8ca30fe8a77eca3b1a5ca415b009bcd4b7e829c48e8df29104576c3354c984ef1ddc9a0c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c229746e81f673917403f841d07dbe44

SHA1
4d3bf246b5a646d0e467b42780f2e378d4d67d8c

SHA256
34fa3a960aee306219b83808bd71c13053dec6c6004ed2f85b218bd50c6517b9

SHA512
e5e04347df14d55404d148ec370b0a1e6f9110f795b5b929e4686b240f994b333876c6b99537a8c8e9415d86f9d68d389c624a44f66db59bcf03ff7462b29ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E09.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E0C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F3A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit