55b4f63f40cfca975d614b88959c3c220df2bea5d9dd9de36a8bb7380be7195c

Analysis

max time kernel
141s
max time network
160s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

au_boq.html
Size

4KB
MD5

b0cecd9a6cf5782df92c6fa9a22497a2
SHA1

1ddd9c6ee4dd24a0ec36a0879ce098534d0cf050
SHA256

630e0010e577473b9dd3e3cf4f14cd1b7cab7a668c637b4d7bfb8bba4aca6b17
SHA512

0e6c553b7af3ad9e2a18535c292c6220dd4ce5a0ef9f3a85a8523a3ad32d78921b212f733754a53e44be132b7878d75977dd619b277c293964c44ea0ad65aba9
SSDEEP

96:+2DMz4BcjNAC4lANXCVKpFpCB8aRtFrPMRF79FFvdb9JH:+HjX4l4XCQBCBZa9l9JH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac0000000002000000000010660000000100002000000081a2d85e245c52d54e642b32c65da392a6f6e19fc14d0c5d8096f210a1c04026000000000e80000000020000200000009c5b6dd56b4a2663690adddbd1204ae5f3e3171fb3b5a3490b18b177c73c43fd90000000fad0a19e9c6888493ddec70666acd3cfdbf6e1fd3158a16b45feea69fabb08aa0ae2354b02cd5840ed3b14f48dfc43e52c0f8917f91dab12501d4c08275be6bbe2cab7049fd439c3026172cf036c2a1f095e2f3d7f30a98ab4f8e7305c59d14c05449bb6d12c727b1f6930d6d4bf64696b197a49c828328a854a4fcae52e6005fe5c50b4d2f8555cc2042e0c7d7ceba64000000042f3a0516b6681e5175a6b987124ef70ad2180e390f5527908c16479181cc20f06cd9a193f5ab1630ecf76ebb9437603a4e478e5a6e37e126919eb59837b29e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404998917"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac000000000200000000001066000000010000200000002443c3096286a43acad42b5cfff7373be56d8d151a9124e59b0625f4b2338a5d000000000e8000000002000020000000ddb69343ddadebdf16d7efb583e2e3b18ffb5227ef36b095b6fb8ae8109cf43420000000fe3fd46051c2543bdcd295c3b0c929fa78884fad7e09ce1756095a89b1d0a6f540000000c857493f14467c1ecb7cb83417c6805b279b1bc0c2f94e075141a3a42adfa056941d35f6c6a3b79fff3716cd141b0fbe95ed0d9c1e14d0ef3078bbbef488877f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d9d124b40cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4EE71A41-78A7-11EE-81D0-46EFE16C03F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2196	2652	iexplore.exe	28
PID 2652 wrote to memory of 2196	2652	iexplore.exe	28
PID 2652 wrote to memory of 2196	2652	iexplore.exe	28
PID 2652 wrote to memory of 2196	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\au_boq.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbf920fc83932f79828579669e4d9d58

SHA1
7d1480d59bb28c2ca122c55072bab4799bb3f4d8

SHA256
ad2a5a745eb4f2d44789a410b413db903f570ec1e6aa177c34789af822884eab

SHA512
3549a4956063eaf3ba032fc0d1a02ea3d949a63398a8bd5fc621f22347e68cd42707e6df586db5aad421b9051b6c75bc7bde2b2b23ef255ce12f159c802b1461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586d9d191fd21ae8b8f67384e3112236

SHA1
011dbf09b57b8724c7b0519778578a2c281d6e08

SHA256
10aa06be60f76e08abc2e912d9c8273d438ad7d7f8164e41ae930d3568c63df2

SHA512
c7c98b8e3f1b4c3df856d1f656590be8411794822caf4ce0becd3d2f3818a73918869459dad449d9f6e458f2eab854bf1d4bb289401e9e19141025bcd13c0286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e244f06b44f3cda70b28c8537e8ddc93

SHA1
1d6cf01c09aafc7c5ef2ecee74a052fcb79bc784

SHA256
0512919cc705f45ffed44b077df5c1f777b9cfc39ca3d4c4911de18f7403cb41

SHA512
d43b0e4c73561696db952aa1433dd7a14e3b8fd96d031eb9b5b54fc477802f41e502b585e799ea8dcda6670e1177ff95ceb0f815e477e9b50d3ee0cb81f43cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66462abc08dcafe35316c14b252d5b7e

SHA1
28e1dc0217544e2c6a7751cb3caf24347eb3a6e9

SHA256
b445501dce91915e9ee73959d3a9cd6d8a7ce482e2645b1df9e4da4a471d073a

SHA512
821b1c93dfed1009a084032fe9a7a306216953d86751ff0f04a014fc67c80fe93ac5743a01f533f56e9b9fbc64ea41192dfebc00176a427b2616890affef6054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94cf2b9f8bc5fa339ba8c108351d807c

SHA1
f86c0730bded95334f7e9c8e85fdc0542c869a5e

SHA256
5f37035093e1cbb9ccae8c15d57a345a824af63778f31707f259c67ef2ef48f6

SHA512
fc9b7a5b13eeb1bdbb30c565e67c6a0838eeeeb34c03c3196aaaa3d8db5dff28ae535cb5cd3d84c5d379c898c95523bd4903d0ff8923d525d39d8b671ce309e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13bdfa6aea05aaa064230977506e5018

SHA1
98fa2134cd740dff5b31e6ac95dd6f1d1925e750

SHA256
b2fce7995520bbe054513612be192c04d2289597bde601a1740d00310d089878

SHA512
ee4857db0218160bc53597e59ca2b017141f72e7eb92069069617048681716153f5a3a54506cd5f1db318945c74de41694553773fa563d474471b98d71e5c7de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
918752546a21bb0fed4b702c0f44b408

SHA1
5d85c706118aa81fb4cb637e9cb9dab7eec01ffe

SHA256
77c5b75f44af55bbcf425be11ed48c65fd2d7e060848b1bbd5bbaf9e43112729

SHA512
f8e3bd6ba3c4bf16b347c59634e51ec71cb6815f04fbb99e8b5da25d83ccd941c7d4f05dc535b69d776d6d49e3b99e06e7b935f93cde82fdc2983b7c6112e650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c899fb0faf3918c1dd8b771a2ffef744

SHA1
f2d1f034bbdc1343a146238e161f3dd75c15af4c

SHA256
a83ade42ae6c8209bec6cb4fc6195a958eba5e976d5148b70e80f78a69571c09

SHA512
b776e1c987d42ea8a17c5d3376a8857ebfc98fd644305af2461ffc078e3c5c915bb43341230ca46d25b4870d4a6b4331821e91dcb97abed486c420107f790b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eb0d374bbf19ca8f8bf0717dea42360

SHA1
0ead13b531ce6d7af04cbcdce0d48963ae2bab4b

SHA256
2a5554187b68ff9ecfd3db678df3ceed3453d9532343e2122c99df810fddc4c2

SHA512
fa3cb6f390b9e4a861283a1b98ee00eb4fffc46ada19a8b836fccf2bb269b51ba989ff8598de03ebc3d0004df7dbbd1a7ada3824af84c55b8b5452a726c5c4c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f0953b66da25059a109c9238c37f23

SHA1
6eb763d2143f9955a9b12fe545aa4b444adf398a

SHA256
2fb9c1f6dd8640f0c1124f7af6c85e2aedcb11c02feff7681f62a11cae1d6aed

SHA512
65125a6cb39a452400e58e0e09479fdf95e5b23e27c62a6a71caa5cdb7d0fb8e7c702c1e3436b92237b8f3db6121db7f666165f17d8c56de3365694b6908963e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32E.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3ED.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit