55b4f63f40cfca975d614b88959c3c220df2bea5d9dd9de36a8bb7380be7195c

Analysis

max time kernel
135s
max time network
159s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ambank.html
Size

4KB
MD5

f31dc5927824b27b973b4e67ed3bdbe7
SHA1

56d87c59722d31498d35e9ec7d6624d789e02fcf
SHA256

225f2950373ed6b9e73c075f931f4ee9223d165a83c25d3cf73270988d26ec55
SHA512

dbab62e5fc2e96125e653fdbbc810b420c42de4cd0db8d4ddcb3417440148ba508bac36f3224055eaccc27813a769563df1dba0e58f5be4622e644828c513d23
SSDEEP

96:pox0VOs+U5kiVaTg7VqcfFeg7Z8Toh4m1RtFDjoh4m1RF79FF/No9JH:KA5kiQg7Q9g7ZUi4mZZji4mN9LNo9JH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000046586666e028170bfcb74df6da2b7001591ad9f76649d62aa4b32bb26467f00000000000e800000000200002000000041971509355eba1a2844041bf02540a59efb9a37d5de6722703caea12aefdef72000000030a86f17ff2d60d58ac6af299065b6900d87f79563626ef83998a1d5914a00be40000000efb246c74a88ba2dcad06c919416d9387c9cf452637bff904cfeddc50d051a15973231054ad8ea4f6ebfdedbfa09bab0e4a58c6a86d0cb5ae003804ed7ae59dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ef9824b40cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000bcd37c40e96d067a9f9d8f32e6be0c97a46401ac1b98dc490e8fb3c1cc446708000000000e8000000002000020000000b622ec9317b161279a73c2685339d4e6727b4f319373e89eb359f6562050dfda900000005d76c14f5fcbefd3b09e216be925d9d02e529f08f38ca9282efd8dc6d389831e707576bcc7e80d8bce0572f766daa924c4b159eb16eeb15d4c823ba5c26ec9eff17e7bd6765e27e6d1ef6cf0b706f99d25b92ece6f2f28cf35a3ab72f02eadc1e5b0e14208d8e85d175b50bd3ce56e90b8a16d6563a56e0d4d9abaa951e5c0ad8b58c03f2b4436164fdb10cc847c29974000000093ca15c349ce791dc86ef13d4f5eecbe1c350ec7bd4aebd42b8db3bf775b08ccb6aaa0517c5ed04c46b032f8ad1a61663733cf85d916a656a9244c2705df5653	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F0A03C1-78A7-11EE-9E89-5E9DF4B4F3C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404998917"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2804	2376	iexplore.exe	28
PID 2376 wrote to memory of 2804	2376	iexplore.exe	28
PID 2376 wrote to memory of 2804	2376	iexplore.exe	28
PID 2376 wrote to memory of 2804	2376	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ambank.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d82283485356321e43c970f253ec6a5

SHA1
dc79e71e05ff3d942209feb417495ff6cb832a6b

SHA256
4cb275f2196c18511c42234ae9189fda9ffecf933a04521d1d6aaa57d71e895b

SHA512
deaf0d8b704656e5c3bf144dde25f19cf62426461fccdf45f736d3d870df9d8e1784c96c5ece09c9de681dc09b49b882b89177ba8f9d0154140ffeadc87d3c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f83ed85bc8e15703330fa339bfab7f6

SHA1
afb5b5c85a7551807914192b7f9d4e7cd89844ea

SHA256
c3a784c06089571a8389cff0dc13117ad50209f5d7416034936499165b5f997d

SHA512
70dfd9a62bf4f25ab4ff4f505cab49caf2169266772167bc6f4deba13519343a8cbfafbe127fa31146c26c6a7990b96b2600398fc17c65625c542380aeb3efa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a90c38cd725fcc80c02f462d207ed46

SHA1
46795d7aefe02989c9ae5b72085e8f598e50a4b8

SHA256
3dc1b1656112e1553c3014b7fc950eef0dbc22bfa7e2672c8e140c1b730e4629

SHA512
01f16cb39fba9e56dbef636a7d67c7377f3bfbd334e47e22ba0f04fbed8f308d95b3b006c5fa14d9940aa5b8b88c69c708ce33e51ee419f9bead597fcc5c6f53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
076e4a1332c8b1991e5d5ea3b7bd1c14

SHA1
4f57aab1fbfd7a9eadffee60a5743045ac002843

SHA256
c110e239b18f96271f1779220f4a2f0c42158501976b6b8a86a0ad3fead8a158

SHA512
d5550c2790b32196607951dff7be6f5fb687f1b2ba0cc169a66ffd27dc3b9af538077cd8036ce596bdf1880b1c91ca5f01f2935b66b87c0a36a4009ef6553fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23b8cf745e2290ab9b0e41ba7f95ce6c

SHA1
2c25fb1cc5bf586718d9ccca37eb80f62cf50d72

SHA256
b16fcc7a379522f31972ed36ddaa572a2403c9e95fd3e71ddf08d5df1ab23ddd

SHA512
85405be3469c343416383936a72de52f70415dcb648af60a3d45b3c991c71d89605c7de603ad9182ee4a4a8a339d3a3d2c4e988c1282e536ace053c29a06a189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d38c2f2f285bf0a74b06ac04ae2be8b

SHA1
295063ab492a9e2b6600f6ad61b893922dd30c80

SHA256
dc6ea1f855b733be7d1b2966085be298b73c547207351a2cf7f95f474f14c194

SHA512
3bba122d1b0de76c385b8b96f16856744618e7aaae625637eef82de45724821267a43cd426119e85f9e424c0687bfbddceba8097fd8539de1c9c6df8530cfaed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c43e6caf6c468d16697e7b65164f0165

SHA1
54dc39c55caa1794bf919b1172e2083d6e26002e

SHA256
290571699d6d3e1b9a400c58d0b9ddb28c81bf0c001f381c997f5c258a673a73

SHA512
eb8ccacd96a18bc638b3fc9428180431b797a2317c6108e9bef11c3e04825b1b457794874c540b6a45c29e41047d23eefa5e07acc027d5ce86db772770709fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFB24.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB75.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit