67d73927c15f5b2d1a21018d0ecfaac68540777db1381fca0b090d5ade09d78d

Analysis

max time kernel
100s
max time network
132s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Paiement doc.html
Size

348B
MD5

a725c5ad338136750079df22326e5acd
SHA1

25762aff9e6b4392228f4992b03c006bfa6ecb7c
SHA256

67d73927c15f5b2d1a21018d0ecfaac68540777db1381fca0b090d5ade09d78d
SHA512

60a3e00b3639640c0281b2796810240720a51e6c8d8d5aec18af1a86a50091d908246105b72033025139a7979e8e97bd547d77e0c6a03a1108ad0214ea8f6929

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394778156"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07F5D321-1636-11EE-84E4-F677B60E9451} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eba41dbc9f109c4eba713b962a4d0a48000000000200000000001066000000010000200000000f2d492102335b43ee34ee30cba5d7df85f7d04d83cb047cd4989371ecef036d000000000e8000000002000020000000f77291b340f80898a94032a93874d0b973fec8d28e8cf3f073c9f59eb18cf9e0900000009ef4b150f20e3bc78cceb5463a134dc61723b79d24e8a9777fea9def744ba9db5cb16aef52ab4318d92d010c85d25939289aa4fb39a85d75a84e21b9d91bb004d4f3ef972bb93856759f91dc208465e78b6f208828c0b2a1df319be9441683e1899fed8a23eed01c1d58dee626eb4592e7533a21b5abcdfc5d50208dd583a92a191ba4a6f4b3474eebc7d101533282b5400000003be66106541ce1c42165d0c3764eb14a6117fcecdc159e6c21e0aec762cb649ecb84b57169b42dc27ffc3b536d793faf77ed9ce2c6bd58bb1a36d3ff2611e30d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eba41dbc9f109c4eba713b962a4d0a4800000000020000000000106600000001000020000000dda324a97ab371824ac447b66a036192459533444cdd479dfb899b3cfcbd1db5000000000e80000000020000200000001d13e9ee9b6e060e94bd9eebf10ab76622e032f96fba95771e527a21682d10fc20000000da6fc00b6b87f2903da740dc7b1de0af10e0a86d945c98990937b94404ce537440000000b599d14a3e65c297ca7467ba953d697d966b5234772ca260567db3f4accf1a8adf86a03121589cecf8491823f42f9ef54301fb880743d126b16606485bc519fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101102e242aad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1668	iexplore.exe
1668	iexplore.exe
432	IEXPLORE.EXE
432	IEXPLORE.EXE
432	IEXPLORE.EXE
432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 432	1668	iexplore.exe	28
PID 1668 wrote to memory of 432	1668	iexplore.exe	28
PID 1668 wrote to memory of 432	1668	iexplore.exe	28
PID 1668 wrote to memory of 432	1668	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Paiement doc.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2855c71abad3b2a09aef052445183b96

SHA1
94506a854e2a6e6971505c6a7a9a6dab557f32a5

SHA256
984b8954f95fe5ed44cbd0e42b46d799dbb5397be64841c7268f32fcc82f4248

SHA512
a386dc62e21fb3e943377ff403bd2938b21b6e7ad78fc8635c21bb12d722a450cd60ff56eb90571a8cf08c0b18541a67b7247082011b8ede44437504e79eedd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de79a7c1ed252947e984b68550d2f39b

SHA1
bd2264565ff1751c8f6cdb60797f52b853fb718d

SHA256
34bdc95b2c4baa9f1b5a23d56aec85d33a291fbca031f2172cb8559fbf1f7fb6

SHA512
5373d901f884852f740c3c99d5345697fd15ad9f7cff72c5eb4b2856d9bdf6cea4fb1dcf2bc7ad1f4beab9ec1460cc9f773d5974fc8a1b987a15d6f6935a1294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
055cf9afe5ee9039cdd62c6cadc4d5ba

SHA1
1285fa3a7fb44344f408c48e9669ea2a908ce911

SHA256
8db6036dee6c610dd8cf2b37b0ec48e1c905942c29902ae7e5208f45caf3bb29

SHA512
e4e563efb958b32041b44cf2e2a6ebf7e1151c73b93aee76f3f364681bae8382a01e50baf9f19efc20001fe374299140ac889cc94d33f8e0d73023561945e559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85b2135a0a1cbd027dc236a7dcb8e69e

SHA1
f765e646c111b9385ab4bee0c3d50caeec0b2072

SHA256
e5892342be4f46df3a6eeb3169f3737d337bf729391a4e14ae0b150a5e15c54a

SHA512
1f096357f7f74a378e3e1b02256ad1d7b4123d407649b98adff5611ac2deddc36118d4cc2181c873ef1e7ef40ceec47351bccadc9e5ea22de07476a93b69d437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a34917b755377968a0dbab30bfe8ff1a

SHA1
f5e30ba611776e21ca10af088c5e959c0dab21c3

SHA256
0067735bfa2698069b84f132915bde8459935ecdf8f3ac176ef25f6e1b584439

SHA512
8cc5d7e5f516e3abacbbb8493b9fad1bd38bd40d9d069a426e9504f4c8847f72dfc9ce82f97ae903715e40c4a7a909f94ea22427b084b6425c0a451703f98a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b95d9f5e98ce1d9316c48761a0e347

SHA1
986b40f0d27194d462d64c9287d9df97b7a9eaee

SHA256
34453951738ca9d3b872e2d1c8a6a869c796388ed04bef5277bdee5417adac3f

SHA512
d14a497374dfeb6e15f2d9267e129397b351f5b57bc63bf5f6c5cd87842f71ca90f10d4ba713f8dc48a2bcb1f0c5fc27e08f5b029e9484c0388b6c5fd3d25a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9829ef88e534d0f9e076932559569e

SHA1
736d34d65abe4997977f7b73ec99b32cc66cbb2d

SHA256
1075816d8de3040f2f942328d9805619e66e59a8e646bcd833c12ec0ae041c02

SHA512
89658874a5fc294211cb1122daa78f157d16cf86e60dc7912399bd9cbb64c1f5c8349721d3071fba0881f2275e0d3a936f21985f32c26ac5b4be8cd351e42849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
677f5e5905907dcbeb53a905ab943129

SHA1
629fc6a6f33f10ccc21030af15971882e949c2ba

SHA256
5990603e422c0ee11e84c21c64ce8ba28032491748b8d0655397c8966eea27df

SHA512
101dd38a83a43d383e6c70db5b38954b47ac8d08f42f66e4ab151af93db187154e830a7960ad2bf0f2625696af113134eeb7586919e37ef9bfa86bc3ff068200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a28b1ed7ab74e1664180dd0ddffd62e

SHA1
b475e812f93cf45e761eb9e8b9e8812422716254

SHA256
8d6103cebe986867619e8b9c80ecdca4b0ac613c9e84285025d1a8ecd38f1882

SHA512
23d3e1af17b270c94d7a7233d07573c4a2ef30a27577086866710b01c93b0021e2bd96a00fd790328fb23f3d8bd2acd11a2573d95cb291367d20ac289dd14958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4e1f5be7c0da9f4ef8f23cc9e78d4ad

SHA1
a62733ac2263f67ea41c34531bf6d80f2e583296

SHA256
0fff84f29a550a6923a196619c27ba38a2802611406498de42db0da573a7edf9

SHA512
04c2c19650f9d3a9f6969666b1367c875d1f304a44fc4d73d07ec2c1bc91307cfb87cf9b097813d1da99c4676ca82b421d5c65664b4d3acc590d2d830c90ed07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fce4dc54504fefd65e93f91f96b36e9

SHA1
a158b253e84aca60f277f21f91e3a10797b2ea77

SHA256
c0db0f9d10c440dc73ba73b50d75fdca43b379d715818bf9e53fcf674c66509e

SHA512
461fc14fa050f3cbcd662c2b0bf004c46372c9b835aecf9f658fb58881bda0e2db1bf7070685ab0fd2b19b9ed13e7725ba8bb7c5aa2c59d0ad7436ff1c9163f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7f4951654b0c7b206e2b501a6e6e701

SHA1
4abea850d6f7c65c6d9b50393e25885199a0f442

SHA256
e3bfc81d436a842603ce43630f85dd46e752d272e9616c5e09b644529256bd5b

SHA512
92773306e0768261709fe107363c810086c8c481f2426aff8920677a8e54318eab96a72c5e974b35a7cdfaf722b45d616d288b9f5c72cef1662ab3e8e4068c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQLKSAYN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab600E.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar606F.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YBIDXYWN.txt

Filesize
608B

MD5
c37d9b0698e139c516d4ec11ea5a0f87

SHA1
8fb2bb451ff7a72a54d69dce76d1fb66d6955beb

SHA256
f7b5e8c9d5171e5cdd3abb8e327f1e02cfe4821cf7a757c6ccb4857e25dbc2bb

SHA512
d4804db16dce72722bb41151a7e80294aaf059db8650d5e898a470fab7aa65f9cbc99363a00ce055a208dc3b08b7045dc59562e6bb239348764020ecc33f1a9c

Download Submit