d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-07-2023 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e80120.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397144042"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d000000000200000000001066000000010000200000000bc77df922f571c6967a06a5f757e25daaef02145640a93eb3b566f11c5c556a000000000e800000000200002000000051dad95316523b41b449e80af75353307c4bfdac1e043d64f1a0a1c9492a107020000000c8a6f2682f8b9f71b871bff9caac9a6267f435c54768d66bfb98c99a4893bf23400000003f27a21cd268170fe8aa560bf7264eb7040e2ae4bd2f8277519f57a8f62d8b7a2241a4ceb020937adaae0f2c42d50c5ef991cd8c5521470f9cdf173c0719ffa4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b087335fc7bfd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a91d4b999c9854dbdd04be1b9b2202d000000000200000000001066000000010000200000004950ccd372972c382e71c20745f39ff9b80f3bd95e7a6deb1d99a25706a4cd38000000000e8000000002000020000000b52b0c7fcb2421dd762e4b64fd9317494f994d23bf3b8e5834517f69be1516259000000063fb840aff235236808d7763177e6b1abe2448b2047b176f2289de99c1eac4278d9f651d978f4e620bc9d8d5d4625d46975dacb094b1981d0ec28096c3df163da2cfd12cb6323cdc0f429e21fbc3c9ad4e407a09726710d533d29c4a6f358d4bd944a7cefff172afbdd002f6fbf8a6caf7749c087914214e0609aa44e42f6ab1ac654791bfcac11c54535086f6b29c7540000000e744d00bfab55a8ef510927dd9a5afdf867eb91ec1d76f87684d3d3494bb53ab061d18eece811be8b5717617699407e6a471e88cf91f67640118f401bb97190c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A59E291-2BBA-11EE-AF1B-76E02A742FF7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2572	iexplore.exe
2572	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2800	2572	iexplore.exe	28
PID 2572 wrote to memory of 2800	2572	iexplore.exe	28
PID 2572 wrote to memory of 2800	2572	iexplore.exe	28
PID 2572 wrote to memory of 2800	2572	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e80120.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05cf0aaa707ec91892a743a0f6ab989f

SHA1
78ed02fe0e9c3931c5276eedef1ee4f4fdeffc57

SHA256
c1a128886e314ac47ee52d64e27f58401641393944b289969840454f9443358b

SHA512
df427422616baf806b401beae93584b67da5b03d7d3e4eb5221339181fab784969fb3e3e3c57ce974975437f89a91312f809bea55e7e0730bad1ec940914f8b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c726983b617a9eb202550b3d78c4421

SHA1
cc9d72e13028a805b06d5b02d245228b4a739b1e

SHA256
5e69cd3d7e0c2e2565315c131a17d83c284a8e5a3e947e9c298ea83fe6481c09

SHA512
4e54cf36d9397506ffc0ca5952d93715b4ef97703f36050cb9f5cfd1811766437596bce4d3ec94b4061e30f61bbfc78984cd4bf17b566262ae31951f8f98a3a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2fdb350989d003a5c445cb93b077ad6

SHA1
8614e29cd9ecf5c0e613e8beda062253c35922e1

SHA256
671cd7918b4d8a58c2c88fdf2244bcef277e97499187540bceafaa23bb3d411e

SHA512
7dd8fd8a5d9b61cf44e0937166b103146ba174bf406d6cb23872469a9240a2d479a4ac1a5c4f2809bad2536d8e717fffad2e93a4b9ada6d326317a9d8b8baec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dca6d551d1d24371648cb38f3322996

SHA1
e007042a12b8f1787ff89aae938138279c35d415

SHA256
1d8744b2cc76dbd2fb3c1d2b19a994938db6b5fb9cf6039db0b3f973779fc4c2

SHA512
3d00743dd891cef8e314cb7ff0b01ec7314281e45c488358faf2cd163ffc3867dacd30512464ef8cf7dd6676fc510ff9d2f4211f068b53e12afc876904e12d8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d525d37365a8f0e45e397975d991a2f

SHA1
e54e1881145cd04a6c23bcb615705c81930f6f3b

SHA256
e3a3a7400e18272ed608802d2b5f0b7053b5f53e7206af5ce55aefd8d0773ce3

SHA512
f71a163df2efa00f8a3588638b2e0816c529f0046f929bdfd19e3eba2d4e3afc1a231181f46013b265f70c08e0b5dd2c214f9c997b7be0dc64b6e496d9b19828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68747c9e7450436b00df35bd86045fc0

SHA1
601298ff59ce31602d5e8ca53381acdc9da617b5

SHA256
bf20ca80bc1aca6065f4794b9fb7dc565929dc33daf490e5b2de781b39171558

SHA512
953701b63e170c612a7f2ea15128b5c1ddc848283bf7562eb0bd934c58292725ac1efc7defdd3da1df3c43ec44707531dc85f8f862624b0e9cda55638d07591e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
115ff98d2e160198bfc4e1752830c8ca

SHA1
b4ef9bb6aa726d99d472b987a6e9fce7d3ba764f

SHA256
aa300fb204f5c0fb5a0ca1baf2d9bfb3ee9d26fb35f5bc284fc227609073ddd6

SHA512
effe63a30f6a4b742da4946042b367f1200df87bd9590b28c64aefb42e55de426d7ffdebb9c8bcbdaaae60467f33fc6e86c71d49d7a00cd7b0876ae28f1e732c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f0363d4de8319013693b3dc3224ea81

SHA1
17c05e9f9acf16708f6129af9298930946f33fd1

SHA256
1272b791d633011412f7e2003ea07b5deee5d662cf3d74b6a4d766321883fdb2

SHA512
03f41a19ad33fe024c6d0a80cc010bca86335342629735eb4a25d94247c6f771ad0798a3a980f9a74427d215cb7719a2966a3c9735534f40429855773abd86a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa8d44b222f5efd162ad5c0cbcd63189

SHA1
233d6e19bbfe4d034913b43b3a36220c5553b911

SHA256
aa8f73dd15f7e2c842dcf86937f648080d720d3f101de4ad7150afceab5bc770

SHA512
4b1002a90aff9c680d2110f04c39ce37a1b1f12d12c1e760ae50417fda876eb0797dd5416f9a9068ab42ff2a0bf58621191576513b47aabe516c7de9304d8f89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64WRFCMO\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0F4.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1E1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8FW4Q22V.txt

Filesize
601B

MD5
8104717e0e6db01419bb3895f79da28c

SHA1
6c65ce32b8545ad6a1c4f0649640448d15dbf5ae

SHA256
e30628994b624fc6f8b8fe1f2b29a53596d0ca442c64288396682fa4cedea9f7

SHA512
9167b80abe6e3a510ef3b462e234bb4d560dfee239cd0628b99afbd496b1fd1d700e6aa73f0c9bdbe5132d3e3328d8bf91958459d525477ea19d17308ec708af

Download Submit