55b4f63f40cfca975d614b88959c3c220df2bea5d9dd9de36a8bb7380be7195c

Analysis

max time kernel
153s
max time network
232s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

au_bankwest.html
Size

4KB
MD5

13cfd87f734b4e193cbd3a72fa7fa7bb
SHA1

45db498efab130bfb0b36db6accc9329c47f2e35
SHA256

380640b2a54bddb46474a556ad4de5d49704ada9b49b64a1610859937172510a
SHA512

14dc220824956009c7694b5bbdbc31fedfbb0d3284780e48466c2b9e28b470396cd5cbe65df0fe888c7276646fc1470e297645ea3223835a364a618153af0b98
SSDEEP

96:BqBmc6pIytgPgWNXNApFpJ8PRtFiTRF79FF689JH:BG6S2gXXiBJsG9T9JH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AFE7C90-78A7-11EE-82D2-FA85F66A7F24} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd669200000000020000000000106600000001000020000000a499f787a516d58ebe0f57584265daf131753c327118aa19f948256cd3c3c14f000000000e8000000002000020000000ea45b120115f463740768aac58cae71d3f41cd63e9f060cb698e86064a2c33b9900000002e873b6809db5abbd79808a3660aeeb9671fc2b7bc5f4dd9a69b5eeba6ee9ae6616b07b2afab2bae5417260de3e6cd8f69c721dc2e1353bc300604d9b976b0711d459cb5b57fa1052b217114b9d0188604f89d865c486f48912d900b55cbaf5940c85b20b1a8f51c348683a3dce89cf08137e267462269c7693ead2c0a62b5aa2b6cd45e0c58a1efa43ea0ba010d20bf400000008ccbe35333f0cb346f98c0517815d89f2970fd92551ca948498fc4bf4f292e1fa7751b14456beb6a6cbe91c6341cbd9b76bd1377f20078b042b8166749c63c3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404998994"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606a815db40cda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd6692000000000200000000001066000000010000200000009c873a182477aba4190e29d3aba3b5941e916e853963961b202aa91cc61e46dc000000000e8000000002000020000000376cd3175fd698694432aa54b2940ea8b002323a27fe45bfe2d634c3b466fabd200000001c23696c1cbc11f75d93c2477b9df3874acc5236a986e8811149b696defd93a3400000003eb70ce3b42e5af09d8ea49bde2b543dd636050c96f2724f80d0b4f7364603021b45849dbbe00a08afeaa56c8379f3855981adb5526d97adeb19d8ae0948e371	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2524	2128	iexplore.exe	30
PID 2128 wrote to memory of 2524	2128	iexplore.exe	30
PID 2128 wrote to memory of 2524	2128	iexplore.exe	30
PID 2128 wrote to memory of 2524	2128	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\au_bankwest.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968c290c9aadf960f7698669d2d541f1

SHA1
e0c4cfb6a94d40b96ed69cb9049d29825b2ceac8

SHA256
2a09d7a4101aea013ea62982feaf61012983ea2d85fd71180eaef308cb40523b

SHA512
539c2b5d7e1a75350543288c73eded2dbde399be73954ab743af4ff3f5c09c4f24f9cec3cfa71e7e6200428498a8ea4c6bf446973df0e85692b2001c65fe591f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bddb4d251dbaf8aed5c3ad3a0e5eef86

SHA1
0d4e87644b3786b31572ac9c5f83d94a331949ab

SHA256
d39ba94fd1ecaa09975f56e1484d99c7583ff87b508071c6882702049bffae30

SHA512
0ac8985b07bfd2af07f1f3ad24721e610b2eb036b1a1798b6a2ba42b429d9f6d44e6a2d1b744d5bff4b947f3918674830da3eeba3ac44d3e4252acb2fe1d8c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
860fcdf7c488f06a77f49ba955212a07

SHA1
7c4877634d60d6cf7d8fe58d57d9fc2330b05d57

SHA256
0d3ebd235c561d88b35da967fe9fa7264f1ceaaa07922aab0d28ea1f2f0bdb4e

SHA512
94872493bc8fcf4262df1465f52bf1368a72d078d252791546c2c29e74c4beb126c2ca4fc7388899bf1c7124b753f9ca4ba22d96f46405fa83a4317570c38dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
392c4d89f4ac491e8ee6ed6de593c5f0

SHA1
7d9d2210c6655d717065bd3e2dce4fc88666e662

SHA256
ca648279e0d71f8062d48afc20f92abb69edf0cf95e9cd903f0db7670feab225

SHA512
45021b9c428f4c6aca9ee3180945b570a8dc6334fbcd51157da82cb9dc86c994c71efaaa7f0b296785de774268cf1ad14cec6cbdc1bba798fca0eb7a9d43de75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70eac4699b5cc2241f1f38cbabaa7c00

SHA1
a9602c1cab0870f66339c9fba076a59fccff18fd

SHA256
696c25dff0f17c37aefeeb80731e60ad1d2fde3a81742124deadc802bf5fd8e3

SHA512
04b5114453597b88825e24015dba3e07cfc4562d9b1e2c3a1ed4cef252c49cc66d36d1882d48d461de61c58ed14986192e565f7e9e171d7d26db6f9c6d59b531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
254c62783b9f6428fe2dd6dd4c8733ca

SHA1
2710ed80a810f95c6e915ee5f86ea0e985d4fe9f

SHA256
218cc7b91ebc8f07fe661275c7b22c44d181e0c051703b6673f24525465394e9

SHA512
6322d87d7f9ee533be65af1507b9d6ce12f996795ba7b7d1dc67158c37f028a857208a1075932e74b79fa46282da71632a6d8b2fe30c6bfbb57aa135a1df0396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eb2e1fa8e9cf895d02ccc4f2bab35d8

SHA1
efea2b062016138dd08a4e721033520c9beae1a3

SHA256
5797e67b57f9c352cf96258f09143ad217ae15aa9c525bd880eb4de837e74424

SHA512
33453c7985ac57f97f27b0a8ced7aa9e99af0ec17c6744c4a161498400f060a684c4565f4942fe4d171df4a3ad60b65e3269483e00c2d5d2e5f2b4ef0074428e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ce4c0ea4f9fea796440a40fc0663749

SHA1
136c3790ca5cffdc1d536cc92375451bf28d0626

SHA256
0cce052acd73797cb067fa179824f9ba92791cc92b3e1bbf5fc60d4e893027a4

SHA512
6eee70f83901649fa6dc20cf5628c41221b7dd3200e93fc76679b9caeb8aa483b3d2da19bb7b558306f74449c7b43489c7bc152e61504820acb3092d4a07f083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019431834e5a930c6ca8b75be794f459

SHA1
37226626f6ace838273a8ce53b6070acc70c731b

SHA256
f8e406604407f486742a3e5deac8c9ff2fb605cb9db042b3045ffbe70001e82c

SHA512
bcb45ebb226047e3a74d6155bf5b3662c5346a15da90ecd27d7557f4a16a93e6c8344e5d7980a0a5bde0df9d19eae3e9b505a20222567f91b9e7bb83bcf4c783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cecf2b3355a22823f7c8b833a17b881c

SHA1
c8190f395fb6af1ae572698ac8076215dfcb85e6

SHA256
e3afd0871847f150c07cef40a40ebe2ad6d31175928a15c6a9980c07df18dbec

SHA512
f1922da94a124d424715c3d3e05370325f4e87abdf691e501f824130793bd33d7969aa62ecd779f300d5fc5f62098ab51bc2db3d267a827f32602dd4329f8da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4730.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar47A1.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit