hxxp://banqueatlantique[.]net

Analysis

max time kernel
63s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://banqueatlantique.net

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\banqueatlantique.net	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3447826007"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F7B74A85-FA40-11ED-8FFF-6A765FEA1DF2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000601415a38a4ed947a781ff866bdce20800000000020000000000106600000001000020000000246603d76d73b137dd35d494d6f9397275cb7811c8098eb85e9da7b68745d1f8000000000e8000000002000020000000dc29544dd8330ebcf69c4830d4dae8f259ed67507ce9d69fe01ec332a1290d1e200000009ba93c800b37c254eb1a13bfdf5d10e0e995a71ceccd9a59eba1af3f9367179a4000000076b4f6a4db49b21748d851fe0dbfd60aec53a283afa7d37e247026c2ae445533554f9ad64a1e272a5ffb22ce10abec6e42b5e54616c3f0d2a67f5e3723174122	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31034957"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b6b0d34d8ed901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31034957"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31034957"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\banqueatlantique.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3433450247"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000601415a38a4ed947a781ff866bdce208000000000200000000001066000000010000200000003e98384ba6d4c2ddd309b18c6bf5870f89ae50accefa80f44ab219f104a53e4d000000000e8000000002000020000000c9e60040a7984659a0e9b3f9228c5b45bd4a3f58c6cfee948db31c4f6db50fbc20000000417a6fc68e95252bfeea9a4a20ff1488ddd2a545f598088b6bba1973d5705dd140000000f62b91f09a05568ecc85f93c40f494ebf226afd4c0ec50255ab7bbda2d929fe38fb1557f93014619a769b7b3e84e5fa34b6691e88a35c63cbbfb279523f900bb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a013c6d34d8ed901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\banqueatlantique.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3433450247"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4988	iexplore.exe
4988	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3008	4988	iexplore.exe	84
PID 4988 wrote to memory of 3008	4988	iexplore.exe	84
PID 4988 wrote to memory of 3008	4988	iexplore.exe	84

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://banqueatlantique.net
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4988 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
3fbb8ee33354096d9f116c557a402d14

SHA1
f75756c42d45d1047eb04fa54bd7702f5560df4b

SHA256
13e2696561dd0955e1d61f7e18166c8bd7a02faf1dbfe04e738b5d68cc2ca57e

SHA512
cc21e56f9278282b3c15964b5618d42bdfda83b245d7bf01d12550aabd69a9747d1deaa5a9a9830e6d6a47465f580e21e0a7621cf992b56244ad4bee8779c338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
3b557757df75f5e9278925405c8335ec

SHA1
460b91acf877b5a5035acc9715f921c56c239d6c

SHA256
6075244896cd4a9f2a9980d68f7fa5b2d3bb36b0e442374f5f01bb73e6a6f4d7

SHA512
0685fa7243798f3b2eab06ac510a5be4f865dac281e5e31b85f6a1d7812f4f866fd2d601ec09db9b6d54732e3957b370cb088bc630e29e6385afb3e0072816df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\phzg4yt\imagestore.dat

Filesize
1KB

MD5
a334d8ea85e7a9a793a071cf3655b870

SHA1
c1602cdc1c7f255d0525f19adbc9ce5fd706c669

SHA256
b82e1b8299f330458ac8308b45068a18a7980145a4bc3afe50670d6a43276c10

SHA512
ac6400d4831784234a03b79f30c3286f62ce177e53de8f2b0025c8af16060ab02750cf010c84da3615d42c6d6498ccbdd99d3121f4cf73d461e6d296f6050c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\analytics[1].js

Filesize
50KB

MD5
4507839525a19180914799b08fb5fa5b

SHA1
738d7e47e47a102e67d09efa63408d21aaf02245

SHA256
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

SHA512
124bb24b26ede426ac7ef14db40ff894ddea6eb9c7a5bf408fd83b116bd55ec86b51b6839d5eec7ec0f481aab940795006005b4534dff6cc0f3a6560f7cf9bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\cropped-Favicon-BA-1-32x32[1].png

Filesize
1KB

MD5
a8f859bd7bbad15a4cbd27908f19996d

SHA1
9ffb54a6940ee7022490d43190f65315f93f7b25

SHA256
ec71fa8cce1db0b1138da8abde7a62b74bd1531631a32389c6fbeef227a56c6c

SHA512
13dd91e544e4d174e7f1d5466039cd39ae282800dd0f8735ce1babdf75418c5c4d9f9e8d1a1fdc843b3a9eee7abac0b88ca3ee1bb440de99b50999d8fd88aa4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\img-1[2].png

Filesize
967B

MD5
37fbedd82a2bf8af0ff18d28b3ec411f

SHA1
b32441f807af022f1b926f240ff6905b9598ce18

SHA256
18ae4286f20df4a9f82faf272d2a01f032093c79bfff20f10f13472f3e798f42

SHA512
fe88e474799e590003d04383aca9a0d73f5a15c3bfa69a2a4cf9d4ccc34da901c5aa3968c514282d4af2d8088f98fda4da27257b0148d5d53bc05ada3dc6844c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\img-2[2].png

Filesize
665B

MD5
7ac8aeba3c16e30219e9972e8e06d49e

SHA1
59392de511be9a34924465a219576890473bee7d

SHA256
ebb9d2f17d1aaafddc347720a1b76ae255ce3972cdeb98d54207c31985425498

SHA512
54b4dda1bf12b985c7a414bb188356afd824a5227b4bdcf1724313173e2838d51ca5e189aadeab951a66a67667c4afbe034f582fca63a3256eab6ff0b6bb57ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
19KB

MD5
d3907d0ccd03b1134c24d3bcaf05b698

SHA1
d9cfe6b477b49d47b6241b4281f4858d98eaca65

SHA256
f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f

SHA512
4c5df954bd79ed77ee12a49f0f3194e7dbf2720212b0989dad1bc12e2e3701c3ef045b10d4cd53dc5534f00e83a6a6891297c681a5cb3b33a42640ae4e01bbfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA8F90E6B41F64C70.TMP

Filesize
16KB

MD5
6c4e4726fc296d7eab7783acae72dc03

SHA1
445cf9667760021dd44c62b410bffd2ecc9598f4

SHA256
79557b2bbebcb4f8607920e46cfe2a0514cb292ed31434926bcd13e4dd1d9d4f

SHA512
641c513ccf911c74aeef733e45704a23a73685cd198c0069a6f45ae751b19520d81232216b041bdb4ff6835b8858f2e0556eb7314ff143c633b028f520ed60bb

Download Submit