749e09607d1201e1acbd75681479da6a12335ab8687d901d76582c5e96c383e2

Analysis

max time kernel
135s
max time network
142s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

affinbank.html
Size

3KB
MD5

8e47c83c273fec1e0a2cad543934e18f
SHA1

a2308ffa3deb818dbed7071fdb4981207bf2ecf9
SHA256

1a66379f97f262269b70827cde9e3531fef9f432f7099e033eb8c4aba48ea0dc
SHA512

c53d21f425803c2b531e7d4a02f0df2be1d833db956c4f381cbf839d9a9eaea49e0eae647667c4bc6df6d9209f2945138eccd0b649fdd5eb7d5e48c37b25e1a5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDD56CF1-8CFC-11EE-9FA4-5E642E0D412E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac0000000002000000000010660000000100002000000026b38e396d55bb42a6acb93ec2a2dac2d0a8d2d206ac76b3d768ef977a1cbacd000000000e8000000002000020000000c8d55efa9fc5e201480e855e32d72b57e3eba8d4d7f422ff68466f7e33faf71d900000009fb944b98cd25d50201ccc507694bcb3e9d0dc4a4d5f99942106d4ef06396895cf38d3edab4d4e1b21864ea96cccdb5c71cd334d1a12b5351e3c7eff2c8429b319e48bbfc5c266f7ec49a9c4d0408cecbdd3cf05c8acbb269c067ee247775c5da6fff98d1abeaf56edeaacbb58e3d42a72b18790bfc72073df7b467fcfeeaf1f545457100dcb1cfbc2351a0664980df1400000006efc9a17f8ad33df07a0c12d0f20f2794ef09739bcd997d07b8f6f50fc0ec96743e8f93d702aa741f98e2c76e72c849b46d7788c812e5221333a127ec63eb6fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000810c4d20dc84ef789d21f35fe5dab16a704da3657c65c012fea650b28b3d1f7f000000000e8000000002000020000000533e0aaa79ada068203090120f1ae4e7e3bbf045d3eb92f8bf38ecb7d6ac1e2220000000e1bbc8b3e374ab192325971e609f3589e146c6d115678130189be1d15463fe6440000000e27e3be1c4b0e5c3c8bae6f6f8efdf71969a5da1e5e218fb75de485845751a561e42154a6432a871ce7d7ab33780ed6ee59568810170a5b5649b63d028acc409	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407234739"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909c49d30921da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2744	2940	iexplore.exe	28
PID 2940 wrote to memory of 2744	2940	iexplore.exe	28
PID 2940 wrote to memory of 2744	2940	iexplore.exe	28
PID 2940 wrote to memory of 2744	2940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\affinbank.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96bf1ba21aa9b9465c6a9369c02d5083

SHA1
2b13cd80510c7d212f6eb3d86aba3a4cdfc519a2

SHA256
74a6d20818ad1cd8d8827e6c2b0e9f17c21420b44ba1a7bac6ee61b200de8d27

SHA512
889d293f5d0c62ec7551e46d6afbe2c95d3b133d7bc03807c73e6b41d380f44935264ac70eeae1df8c97b5926f254a5dd462a8617c2091971cd0273870615ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b4609104a03048b96b081b770dca2e9

SHA1
db26bbf921625925feba6a8532ef532fe8fa8cef

SHA256
6a8029011341718fa464dad7a2e1af9b81c59c199afd3d5df6c386ff94e3108c

SHA512
7c3c9b77a9399ad2a51086edd1c647c7d4b2386ada0196edfa55e17a3242d91b465e829348f69c2c4ba3a8c17b4d057c22b06bc36e29fd647f13714e4dd2e83d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab27ae91a9ab0fadc6a541a29529958

SHA1
4fbbd616fd029450aade6b2a4ae790f7bb5684b3

SHA256
5b3c2d201c84ab45f6718b504c116d37c89c6306eed535b611901cae704dc33f

SHA512
63bf9b7aa8c0e690e0b1bfa292938d15ae3b1896c6594e94a50b6ee829d940ad39b5ae5f8ec5ffd36106054b6aeacdd9ac18f71d1ccc0fbfae802290918dfe31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6d51220883b43436cf9f02248bba976

SHA1
834e2b3c332742c8d0fe0652b0055e718d6166e9

SHA256
b4a5790e899f4e762625454524ef032357302474828f116335c31ccfae73e5c0

SHA512
4715a11c93ad788e51b5fa1052857421a3b47ae76e68aeeeae4eb5f7b9d5634ffa7faefa0eed43274d93d26b6563862ef506d937897bf4ca48358dc1da9ae49e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d74d2c5cb2bd9d48acebf27304be240a

SHA1
ae232814b3c9a89b0b0cc7c648abd657b4249774

SHA256
7d82bf292b99a305e3ca067e39c65d2b0897d1a8683b0a7a4c962861063a18a9

SHA512
ae4ace7a652ad5e31a29cfe37d4d90423692357ec38f415f37e641a516934445ac18f0bc8182e76147365503530088af895edc21ddf865101d5072bc2535126e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb15c5e73ff67b6c666658b4f5ba9b6

SHA1
6ef1f8161116197796e390d9e471c33dfd5b6dd6

SHA256
d43c90aa4f1fec840eac7be8eb6673b285f58226e62ea1409623ab24acf4b887

SHA512
2aa528c9a77803fecc52f5e439465c1bd6d476f045d56453866b16ca896814e92f648ccd8630c73a6db4c6c456ef6a7c2bbb22a4b0f3f08976646cf88e0af376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8163a2a32efb497e2384b4ea311bbf9c

SHA1
8452c738fad2f8a17b9a1e9771dcdc1c00edd5d7

SHA256
1d3455b349017e4bca83ffb73cd69906c16325f603af6efe6b0fb9cbbe8328dc

SHA512
1bb58418dadc27254a1b115ad268926bda4fdf20f5ba8521d30bceb040c3655b7c27215eac2b44ba9c1b88f16e829efdf4c42b7b02c0c6c26715a2dbbbe400f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4f8de73b7049f7422a0119e5924216a

SHA1
2e479ecda3959169600356a4b8e158a34b90855f

SHA256
57c2ba80d48e8023c7d7c5ee421160deb2ef9d5fe0cddc70c9f67d934a5fcc1b

SHA512
be49ffd3f3d2dcee52d7fedc8f9c4d88d40a49a0d351a62a93c28c2a1e08f22084662a8dcba5eea2a1006946d2f30af348737b0ded4cbbd417ce2efb0c942086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0af1271d00d3fe66ba6a4c2bb7a40972

SHA1
ed77072386a84492cfe0239262960d2724698ad7

SHA256
ba0c5e0aaac7e5a62d79763856cb1c049ddfaeff2ee0fdc79de292b117399137

SHA512
4b98eddc81eb9f0de9f9872e5fdc9c2fa28cb2e9bb46fa6cb1f71978734a60866445d606ed3d950fdc3cbc6c86737693cfd884aa03d275861bfcfd2547e5bd85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531b88e42a681a1d3c86678a0019ce0f

SHA1
1cea76a6b815763236261ce81e3f4be319d0a5f5

SHA256
9040addbdf2fc6f86b178db5c923cbea46d1ab4eaea933a23d27c6d470812fc4

SHA512
06d93a6ce675f1c87633275a75aae027d19011597cf5621214d1c36ebc2bbe81d336d5e77e90d377867e6f3722d07639dd7147498ba1f888c51df4cf7b1865b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5055b52344170f4bd53d102773260ce0

SHA1
335b9e12825c2eb72be438bed33c051b2534bbe8

SHA256
7bcad969233fb27616b50dd68367d34f8ae13be696123568e0479441a0f50779

SHA512
d10aa6379ef49fca7ae32953c774ad93200126831fcee412d7a4c23de160152de1abb4b58e13331f44e4a218352ca6699ca2d49519d8ec6d8b1126376e5ea40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab9e28ff0696a2b073b28390afc9900c

SHA1
d29d0cdaf1db0b7908087de331d9568ae4b78b22

SHA256
dc0e787f8df35c1c4ed91728e5e28fd74b915ba5673acf0eddee930eeae350de

SHA512
36b0164d9051340183744b719a1d16bf5d809a3e90c04cebd99fb7310b9b591d6feb08bfe2b04e80507d3abc1893826b9125363422205bd3165843d1945a7016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e0ba1e45d6f9600b12d9432a01a3f4c

SHA1
ad9ff5c5b7d780bd681e9fbb4940c48fcacf0cd0

SHA256
f458417a6270d679d14d0abd4466ba071879a864ee947310182470e505ea47fa

SHA512
44ae86eb1ecaff6faddece83c29685575428070d185f766f9f650e143ac78012960eefebf1768a0109746fcbe9cee66732d64baf07e8bad04fd87be200844c8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F20.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9FDE.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit