749e09607d1201e1acbd75681479da6a12335ab8687d901d76582c5e96c383e2

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-11-2023 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

au_boq.html
Size

4KB
MD5

b0cecd9a6cf5782df92c6fa9a22497a2
SHA1

1ddd9c6ee4dd24a0ec36a0879ce098534d0cf050
SHA256

630e0010e577473b9dd3e3cf4f14cd1b7cab7a668c637b4d7bfb8bba4aca6b17
SHA512

0e6c553b7af3ad9e2a18535c292c6220dd4ce5a0ef9f3a85a8523a3ad32d78921b212f733754a53e44be132b7878d75977dd619b277c293964c44ea0ad65aba9
SSDEEP

96:+2DMz4BcjNAC4lANXCVKpFpCB8aRtFrPMRF79FFvdb9JH:+HjX4l4XCQBCBZa9l9JH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407234739"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000ec07ad776e082c7f0f82118765ca2ad64766c52b68187205cc69caf5c563b601000000000e8000000002000020000000c0d82436f1e6582cd4381486b70c0323281ded67f6c833f2a9686e578f034d3420000000c34e2d35bd3e4acb320c7babd19ca5e6ea7575b3e1aa7943875714027a332f044000000096f112b2e36d21bcb91c49576fc32ef6390432292281ca5f92e33133d9cb1a889945d41feaf3e2f5d87825ab8ddd0b98d932b42210bb1f796016d1588ceb4b8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD9AADE1-8CFC-11EE-AFEF-5E0D397D2A60} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a118d30921da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000f25cc731591bf2a63a9924bbd403c9886d69a1faf94b6f10f1041f7743c458e3000000000e8000000002000020000000f11170ceb9f5c00820948711c44f140af4aa231844103219ce70b4d3c15a237a900000005db528cabe6442fdcc99a01c67b4e086040fb0ab7925c5feb890d0aefa7d588f0c4ac293962ad5a272c8280c10b0f2dff2e867794e8426322bb65258ecba3487b3618422dfaa65184e161e8589f8c02f52561b80b8236464c697648bc0ce700b1eca83874cfa595ec133617ce3df557fd1b6c3ad8740376f1da9a7e5e050ee0905140bf00b2fdd5df08564082c590a0840000000ee1798895c590c1e050a497b64bd7befbf458ee642431b35b6b8c3c5cacfe4043d996f4a7885ec4747747c61e4a17f33291f33ab4dca353e11911fb820746fef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2708	2980	iexplore.exe	28
PID 2980 wrote to memory of 2708	2980	iexplore.exe	28
PID 2980 wrote to memory of 2708	2980	iexplore.exe	28
PID 2980 wrote to memory of 2708	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\au_boq.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d997ab8d4133fb99865d0ccdbaecbc7

SHA1
50ad1c0b97c6864cbec16cc18386fd96a8b0df0e

SHA256
ba9a42967b4db6da2a20d03925153fabd413eac32953e88404484692aa707588

SHA512
a2d934ebcdb453f527cd37f35d37373c4038dc909c97106adedacf77466e303219facd0e7d06a3d393094e04700e06e470cd02dede40dad6e055112c9a17fc59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fae96d66d79f575e290d1627f6e1649f

SHA1
1313eded624bac218cac16d29fa958e9b67ac4c5

SHA256
f07cd8d2dc41559bb838e0f2f30342569c9c781ea55434bcaafc057fcd79bd19

SHA512
180cfa0d45912f915510ff5715e819fa77459efb799de76a55d64d77e2ee8048bfe45d687f9d5b6422f2f7df9abb684c6e3ba36bce367f5aca28df9ab66a5631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
542f2d48aea5b185dde0e8aa5326794a

SHA1
0fefb5bb37459f5e087ae291a5fc2d05181df7bd

SHA256
c8a77a2d45ceacc2d09e8f37a6cfa52df8f37b755467950bf3b8dc7a735f3537

SHA512
ced7bae85e252627a7b7de2c5a75de0789c7b966120728471104bacf77a974c602cc1c58483ed892c687c1654deb10149f5df8655904e0401fcd1ce844b1b783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
435612c776d9e5a1f72758bff56e6263

SHA1
90c6b04fa70ff7d232a4e99ddaab33b7f5dbcde3

SHA256
aeb2c027de260ed7848250a33745e6ec1343a2b1ab539fe2390733a3917f24c1

SHA512
a1a97073ce9fa76fa84836994f54e43ba6cad54c0503bd8ad4658a65231810e9548d7f15094dc3f587812a992e788927390d436707b9b62598938580afda6132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6535bbc8e26085c317b4c7b8687344f1

SHA1
2d5be8600b61bbef2678b3b7363a913f9e062f0a

SHA256
52635e0d548248558aa45655087000ecba83469bad96a36741d253cedbf71d1e

SHA512
303a58e9913f797075aa455bef1073300d85e2b3081eec22a8fd77989f7e789295f65d2f89aafedab1df1344269118932b700a228345f7a6e651a5cd20fc3eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6064b6d828d34ab5e33f478fb459c498

SHA1
d04cc1c0164bb38b7c6bfe11e698da9864f67de2

SHA256
5e0f8f4d515a8bc1ac2d58c3e766820f0d542702cf6486d8a54ebd9c494ae787

SHA512
074feba367399e2e217a46c7da38ec9821e9d66bb8f45871c1bc1d992b3c1c3b83d9a754ba342933f41ab5ae1557c2f231b4543751c5e13c5c2f937ce561fff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cbbaefc47acd2752b1ba519e4133801

SHA1
34edc5964b535376f2cd3480f6017338ee110ac4

SHA256
51fa7c351157936bffa865c57dbce30371c289251a05b16a07c53d1b99d1c641

SHA512
e007c0de577dc36e71f52453f274c7c10a96d5b407029ac3aaf461493e981fe84d1eb3f8fae777c9233f7a105e70af5d1950dae92a183f6ed2fe9fd9cc6e18d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0db2ed2380778263a2172ca5e89e594

SHA1
94d23bba8ec8b55c0e61e0522d014131a3379c27

SHA256
e012094d2b9868c05e7c81c92d37f3e57864c650cc79c56b7578fd756aaad2d2

SHA512
7b71cd7e739492777a705b7edf8cb382c4971f2084769d636891bf0730d0507def89f6aafcbf0ed4e39143a596d252fa0c5aebcc80adc059b282d4988eab0dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
059eade3354ec323ed939a93328e0429

SHA1
8ddd4d0220723f4f7119cdc934a55f2e0fc7b598

SHA256
ccadb73187e8f509cab4b0d9982e655aa3fe20a55fe9277bb13b905ffe239d36

SHA512
95f3eea2b2e97cfc8394bda3ea91a1b32f16a1e00771aa68ab9462e6dded9fe847570e1c1ba211ed39cb5e6cc7889b87dae3ed883945e29ccbeab8a184c107b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c18a0e86d4bfe765a5467745eb2d913

SHA1
3630adf2e2ff4faf58b8ca3e6993c9d6871cf545

SHA256
6c66762cff2514b364d519ed8762d2ebc01e09bfeb4361e97401afbd19620075

SHA512
887837ab05cdc74e038d10e2716e542c2f99861c0885e71d41d34f5a291284a78d07b98a6f3c5e2ddf8892371bf2577d82a3198f25fbf4492e9d933ae932ad79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d7d668eedb4dc11e44093d719bf09c5

SHA1
bf5488021e08e5888841e61141592a416514abdc

SHA256
2a8d76b55963088cdb9219f3702b9ecbb783c4f8f433facd0b6cadc6438811ec

SHA512
4f7d4b375c16f6646eda74153c06c86686192199401c12924efd0dc90bb4c4ab907880f03398a61fd535405340892403b04667dbd0091d773d7a251205cf9ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A53.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AC3.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit