55b4f63f40cfca975d614b88959c3c220df2bea5d9dd9de36a8bb7380be7195c

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

au_beyondau.html
Size

4KB
MD5

922968c99e48122191b67f028d6197e0
SHA1

08ba6a2bb8c09aa3b472f88b5aee503579b2fb5d
SHA256

657fe8e34283f8791bb1994438f6ceb1a527e0359c5cf723d085c61b6428e83e
SHA512

880695a4a14e35ea104a091b2a8dff074389f0d4ade3b6e115fc88d4a0fcf67decc29ae99091223ebc7aaf9e0907db4aadce4d8e7b128d25d6097c4091bbe476
SSDEEP

96:qfB1TtEtv9UqWVVEtjUF+W38uRtFOjeRF79FFajhEofWD99JH:qFEFFW/EDW3/WG9oa1D99JH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000630ff317baa61c28d76c7ee1c310ef61ab9980477cf3e45105187dfe7403dde4000000000e8000000002000020000000be6a11e0fe6dd839721653985bc16b7ca37001b84a02c68dde997a863eadf9a990000000594c724a6df674d9672df0a364d19265d692a01a6939e3ffd2c95c82e413e18eed40a44892062f3a8a104415289400c037f343acf7a37e725df4225565babdc82a5213e130177a20e2f3d2526e8f4ce0344596c07943d729e9c78c01f2e94ae74626bccc42b85ede14d5e87ce0dc791719cf37027adbbbf6ba0632c5bdffb90bd256bbd56470c17aeff301485d2009e84000000025fd0b69fe2b7bd3cb83c190ba0466f717900033222ccfc85bf083fda84e59e2619dc3e1cc64019848df55c8366e3b8dabc8aa7e043c902effdb1967dc0976dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40dd7917b40cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42C26621-78A7-11EE-BB9D-CE951E2947DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000c5d06580bcf7f5214cd81fb5fd279605033292c8fb8423f9f55532928781ff6b000000000e80000000020000200000002448c6ab99cff06dbfedf385ed1b709c4ffa5fd7d7e269c9a7eae2e18fb774652000000079fd137435886a183e5f2e67d9e368384d7981a1d30515db647991d65068bc434000000079198778bd8f7f1ed5ac3f3f8304ecb2d5e0ca1fc06f7e7ec32e8f97263141f8afc998b4cc801f286b370253b00a2eded7be5044d3e526971181ddc1782d5e76	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404998895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2120	2160	iexplore.exe	28
PID 2160 wrote to memory of 2120	2160	iexplore.exe	28
PID 2160 wrote to memory of 2120	2160	iexplore.exe	28
PID 2160 wrote to memory of 2120	2160	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\au_beyondau.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a500ec068179838751e4c75d0510dc3c

SHA1
d4f1a1c0fe6b080669b314ac19b9006d51808c34

SHA256
797f45ecf4f5e85e34ac4e33687dc328dc139aaf4cedf8ff814270171a360425

SHA512
c6bf45994a162800033a7c1211551a79c984c0cbfe205bb3b8247afb3b0c5e2b20e96531a7e57816284dc992838ab7bfc6f3f8f9ac8f45604383b8676793ba2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
100256ab360add4beab9728cbcece9d6

SHA1
3bb2a62a196f3f1173438ff2e03b47d3d653d0a9

SHA256
52d46900415050344da29913ebac1015d56b6da9b67801a58120a2cc4ab89ae1

SHA512
f3fb3f61f79c9aff706f0a6d737d41772ae243d31cfbb8bd1336c09279518ba1bfce529e389b97b5c812a1a51c41a09aab1074d41fd25fc5a5e7f4101d2e97fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7396c9dcc14be1a1626d5fa4f7c102b

SHA1
94cefc0465914699190a50287cd35f4e39423579

SHA256
058c4ba49b79e4a330b58d1f576c290ffe0ea0afcd4cf0180dc84ded29ab42e9

SHA512
70f1d0b4380be9b702aa8d63f05b5b74eced7e48dbf2c85cd1298e453e9fc149c0f23b1396b884fb5d01b95cc04efbd2405e12aa387a9ff47d537ede3b9eb187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe3358b5e2eabdfd61ea566474b467a

SHA1
fc199527757256788b4ff99fc9b57da818bb9671

SHA256
6abf744349c09590d14584c30e17f708ef6e53360c34310ae5ec26960dd5f377

SHA512
c2411a75ccff424e131c517652f84807c9bb9fa1c03e1326d88486fc781a3ed1c40831a6f08faa83e537604e119723b348da1f654ed8f0ca25c5a78c6aef1721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31fa12ee1151bd47f2eb860dcb23c68d

SHA1
48dd151a741e914856d2b1bad27ffe1e9217af04

SHA256
10ac7f2f426bc6a141ef969906a56627d7f8c835a4fb1d036d7c96864671a569

SHA512
0936871b3b90e63c443bd3cb8891c37c9a85648246d49eb96eedd071d4b9bad9000d692c1791cc3260414a564766d2f3bad8eef999daf5dfaa75305cca94b479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d890e26840d5f6fd44f0a53f9ed047c6

SHA1
af60f61c1c701f9d612c7e345f81358872f8cc91

SHA256
2560b52eb77ccfdf95d4a361c29e375f2b229bdd3f113014c8bf9ae0923f15b3

SHA512
c81542b2add5d34d1db2fe40f5f72188beeacb3a7bb155d0c2d050175866d0e4978d52b8c33694cdf0077c2351991024fff1dedb664fba7efb2f8544956531d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd3ff5a7a60b49c683a13c4f769b3e45

SHA1
d4d771cc8040b65e7e7f1eb7ad1895d0a31733a7

SHA256
38c247fac33277dc17a7712018598f35f326acc0baae7b54252a965f658637f1

SHA512
1c5b2173b06c1814441b3339c6bdffd6404f107fe2bb7e9d89ce1198dc610e19405c3ed2178af51902efb43b4a420564afa154a961d1d06f8b18bd8d30ad9edd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab7e24f6146ea67e5a7ac377405889c3

SHA1
b3c9537cec2aa418941406c88d63f4f09756afb6

SHA256
8498901dac896be4f8d930cc0abf9002733fb2d0376ee723eeef772d768027ed

SHA512
c400a717501481f6b9e1f5a4da33609d8dd876270fbf8b5d26ce9294ebb49c58de27c5041c7f82bf6b48edb8709d256a4196911eb64530aa6935f0a80e850ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bff7c6e351bd4ab12837fd4d02dfd801

SHA1
96ad4cae571c3602a595ca245d17217a53f5956a

SHA256
fd57314e1efe117876a2a9776b673126bf2286b82453b948228354d844d96b8b

SHA512
d7990b7c59b411057e254de51afdda3ce7c313dac823f182e3bb23bcd3303dde8e36a30ee3ff591a7999d02e09d836be26d6322ba33273c59813536e2874c335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f53eabb3b0c9fc584c00d6d1033755

SHA1
02ffd28a2aaa94226151a73938853ff0fc0bd725

SHA256
15bfabc9d13e4ef0fb7ed05a4205a3a12e2c6e811bc442e0e041d74ab95608a2

SHA512
6583da34ba9652542062eb7e3d997d5906b60b9026a16bacdbf2bab50f12811733f9c13bd3be9315e98027fbe58580913da47e0638daad7b39f103db2dfeb2b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e89431213a61428e7b433c553ffd14fe

SHA1
06fa3b4ec11ebc4afa301df0fbaf6540c1bbb173

SHA256
0fa21206d9e5cccc3c045162f2dcd48de730a2c5dea799b7da72c5028760fffe

SHA512
591e8af8eb98cb526e985ceae00052f293cc67aef19517bf105462f8794654e11af0531baed74df68f8d211a65658312aa840396ae11c636a7b3b0abc84c8104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f76c47c9c70b9efc1ff6feb333019eb

SHA1
ab5b5b8401df564b5e698b4ac9503bd3266735f2

SHA256
9bf1c82b6516eb216c4264a68dc07c9f56b88aa6a71ff5d900618611c4194572

SHA512
b4fe622be0a6ec681a341bb1657ab3b78e29cac5a69caa873ee7a6733067cc716bae9aee3d3ff30ca4b9e85c6c61684822399d6319a5a6c3f776e654a88f6741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f7f10f3b02d2498142521c926d8a1b8

SHA1
9db3bf405734b3945d9e66caa3f3a72733b4d2c1

SHA256
a247bfa8b848e8286a971d37071e9a259e393ee65d239069d376fd7f282602a7

SHA512
829ab9909d974162de863141d58c4b80d2f1ae706fb9ca631ed59e0d9b50f9e2c0ee6306f9f39f62846bef06e67ae45c90e6a0c87c350bda631af0e8266cd64a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f0d513dc2274158e319ef9d61fc6a15

SHA1
817c69b68b83c056963a853de4bedce136957d42

SHA256
778ee2d755f62fdcca9f510c6687c6b2eae6a79e6569e7f7cd17f2eca35850cb

SHA512
f6ca021b826d5a90c448560e26be27079b949223ec73ba82d2433ff544f143ce62b1a028d7701db7adbef633ef286d9d002693c2b5af62b29c7a799995b02ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22017dde1f046b24f3d953cf96acaa7e

SHA1
a171f9ca12563cc462ed060548e147f109667e10

SHA256
3893218ec332591def7b3c5182ba8b9ae5a35e3a8b8889ea7473b3b733f6b2d0

SHA512
f6afbdb1df50261706f04d35a09eec2bbc4d110294aa1018532674f66dfc8347fda1ca06edb81a198f1c9458c05acacb87233680736de8c09e3bea9ac4636c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d046045b7bfc44f43a504e0b8b8f754

SHA1
0322fe5c7273dbd8597fbfeadc2b4398d5ad77a3

SHA256
75d27829db50f30ce64a2cad2f781e1ce59cfa14198212fbd5cff6941c008590

SHA512
f9a3f609aea227657bcc644f1975560419e12a46562dfe7eaf450aade4c653a26aa94292db41583f006bf46143b93c8eaf171498c9ff54ea9d6e755aa79af331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0347a28a278c4a3e86f9d80240711bfb

SHA1
230c75f4a25003bcdcf0dccb82b51e3c3bc0c600

SHA256
914be71205056dfb3bf1e1f8946be97b1e5fb1283e767faa4391b2e1c5dc7b30

SHA512
582b65546a33ccb0aeccbebc0f37f90d3250622b0e6520129bf1dd9b15cdc7feac8afb9fc76c94d13592fc41a55380f0c69ccb3479b773429ae0727f3e0423aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AD5.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B74.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit