6071912d0d3211bcb9f67356cff4e6f272e0ab507f0d5c03ce416cfa428b8d47

Analysis

max time kernel
135s
max time network
137s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12-11-2023 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Angle.html
Size

1KB
MD5

0c4681302ac8ea2a596c5d87cfc7aaef
SHA1

8f32e0ab824da190d853fe74754ae4c056cbac55
SHA256

59f024761497d0eaaaa59ae69ddb07c1fbefa150c8743ef73334cb91c84265f3
SHA512

b71157b7ab4ee33304865d62a64d35fb5db56c02bfe34e6947c0e2388cc60464b884c037417b0d90a19e4bd6ae9cb25b7062d62bd8cc9ccd810211fbdb03eb84

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000005d8ca03f35ffe83bd12556811d00e7bd52faee3f5fa1793d430e70b53518b997000000000e8000000002000020000000cce1c32a330ca135c1dab06d9648e101e8c96fcf15ddf194083f0ad7a9af8b8b20000000a228ac29bbe508698d9c5708521ce325941f67a21b74acdc4ccf464f17b1056e40000000731e0f7484b9d7ab418bcc1f6247099ebe4c1889fb4ba23ce57d4d410109c451663904121dd7a98e1d9d1c54e81c085664cf4c52c1e4bbb9195f05dd15f97150	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405926866"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000008e09cfd8fee1d9d5e2c1b9c95b5a37cc3eed218181f5b75fd3d9a7aaf3f8f4e1000000000e80000000020000200000002bcbbe0cf18cb074d89544fd5a7a90ff98007d49fb2eb0638627870f7a2d9cc3900000005f06df274b1326b03aff257cd8dbb3ad7a21266ccf3fb42b997ecc76944eb718b6b5ecbc16214c11d8dd36771895b6ae126a193031ec7e4b163e4fc7e2905e710e41a2c17001a1f6702be82166b8818a1b58a7daaa9c9adc2a3f89f41b7fc83b292a1767b73512c049811a21d73b8bbfa96ad36fc12a89be98b8f28599c1ecfb854c55001ee50973c5c3d92525b36997400000005f2e67ce90b8ef24467757bb89a0011326152abe91330c6f7f64b36468daf8eef246cfe091626421995a641f9c86542f7adf92c401f4a9ed47a0222c97a2e66f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806be2b22415da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC6FF621-8117-11EE-835C-7E30C635381D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2652	2632	iexplore.exe	28
PID 2632 wrote to memory of 2652	2632	iexplore.exe	28
PID 2632 wrote to memory of 2652	2632	iexplore.exe	28
PID 2632 wrote to memory of 2652	2632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Angle.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a59ea4954c17d76a946e238c29d32f1

SHA1
0850a6f285f0e37ef31af027211277a5ecb8f6e1

SHA256
4efb3779e77d3e31df807d9fd9151eb1d1faf889bc2464b855323e916ba8cb99

SHA512
2d258e879c8f1179f95e895e3d51af6329110454ce598e783dc7d4db62cdd2ee21e5768b59f87478360e223b0ca97117d9e7c364eed71b79ecdc4e2735f2ca0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c321aa525129529a283afc2cb4c700

SHA1
8f352b654f28c69ba897581f06009cf0d62f1965

SHA256
8e70a0bb457a7349db49c271c42bd1082cb199ea31b300498c09631d7cc9e348

SHA512
40605f00ebdb267a761200b36ce5987fbb5c629966d38980f2a6385f3bfee3425539f2d2584d1b6d633765a99d4c98ecc5faaaebcb54a61e3ac4f98471b3368b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a076a10389d8955d1c28f081281c3b4

SHA1
6f9dbd4ff7acdfe22a8d898961304e08c9096826

SHA256
abbdf805980d3a6c00ddf01baacf84b94a26ad73662cd0fa6d935a36278f5802

SHA512
79db463ffad828a044a8b39a57a9302fd8d6e1f0e0132243196b7cb8775242bd2d119f6ac736c925f6888ba6cf77366036f4221e9849ac7282c080405c1706b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc2d2ffb7b773f2db9a68d61f248ccee

SHA1
5f3a9255976b41911d8b0b2a5f8a6f69790803cf

SHA256
ae2c25eaafa006d70736c2fedbba427b8d959c0de7d4cbedea69aee752566d23

SHA512
f6d59c8978082a1be288e06fa35dce6a870e13360d2fad32f44ffa87b3e23619d91d1af917a93ffe8edd6287d46a1823c06adea90b2782b4c90f96f4bd8306be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb7afb33884da8037d1c9254c625f24f

SHA1
4159b7cc57830ba09750902d0435eac12effc33f

SHA256
743d4d3f92d70279c3644441926a5aada22558fa85ebb75f07e7884c38717e66

SHA512
e593615db851bb4f54b24c52dc833a0976fdf5ba8ea1c839fbf57ebfcb6686d32f6af107a1fee77e0583676a9451de8785a30e8c52d9e5e25f4c870b81491b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a297bea0d99d205fa45c7f9cf7186ae9

SHA1
9e09c53bd3b1a3e94df740a5a50de7649663d985

SHA256
f354ad435f5d03b3fec522812d09be166cf9b2060f0a279828d16757877ca1eb

SHA512
cb65614ec60ce3ac5a39acaa570bfd6c6e786f6c31b27ad1bd92dba617ad93ecd5393092d07459e409c569c12b233da6c3f3fcae81cd5c6c55cdc86560843502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db81ea9a170849a1c11f14889df1232

SHA1
9fc451deb79a23c92b33b6b8f8baa08220ca5379

SHA256
540af52f06dcc14ce5752daf6f08987f09ea9d91c906b6e7b4bc748e1211b367

SHA512
09e4233ffcf94924a3c0097ba2d4ceaf90b20716eb94ecfeaa8130f4ddc6061d2d2792356bc23944af7109e990e96765e028f20cd780b1117bf1b41b2b991b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db81ea9a170849a1c11f14889df1232

SHA1
9fc451deb79a23c92b33b6b8f8baa08220ca5379

SHA256
540af52f06dcc14ce5752daf6f08987f09ea9d91c906b6e7b4bc748e1211b367

SHA512
09e4233ffcf94924a3c0097ba2d4ceaf90b20716eb94ecfeaa8130f4ddc6061d2d2792356bc23944af7109e990e96765e028f20cd780b1117bf1b41b2b991b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4c52766ed1872545e0dc75234e1215

SHA1
4261331dfa8587a9222ac942a34a9cd9b55f2752

SHA256
6cdef4e73c2083e3cf029017d8ee7cdb28ff82bff247b458b2026fd8072efec8

SHA512
820f4da237ebe1775ac032be4f79a581ca3bff3f683f75d0f6fbe619de07e5fc347bc8cd63bc298381c3d36c6650604e50ea82002294cd9175da585e83fea0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9af8557efd5973a4aad76ad9e10d3e6

SHA1
e7f356a1e545672a8e85d42c5b79d53c8a44e73c

SHA256
ddfaf14f26b930b2001f7fe4dc3dddec3056dfec3e2db6af38109463acc079f2

SHA512
d49e188acc5b2b647f17047d645bac92258fd39e12d8f5a7c719d8aee0f86f8cad1cddb1ff8b4f977208db54c103ae275628dac9ec9f5a95d5f369d9df41df26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a1cc5f4a316b07ac806f46be8fbaf2

SHA1
440341f31e02f651d5feaa3b9ec6952873478ac3

SHA256
485927179d9d9bc16d6fd37644be0aeb2aea2136c168869912f5cfb9c8531fa8

SHA512
8fac2131cb739620dd234da70944b8a38d87d08d5f3a1c6a10d1a56019049729c6787ff4cff3087b75da13621205060daac8baea8e3b6c2f5459ab4dc1c2315b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC999.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA38.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit