14fc9916c6a785865786c282c96d1329ab2cd7890414464761004781836705df

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Project Storgma/Monaco/Monaco.html
Size

6KB
MD5

8106aed6f957f5c0bd220f3e8cac3823
SHA1

247406732ca8dbc9e3bcb737524ebb5eca2bdb76
SHA256

5420295b7c300462259a415d36a95bd0c08dfd6e4e9fbbc79d5eb1c9a2f07a6c
SHA512

b62bfd16433ff5434f74e953a3fd142f999a7c23907c6a409cdf7649f4c0d8d8fc0b5b368a1cdf252ae2f265392aa88d22e0fc9689468ba4dec0007bbf9ed006
SSDEEP

192:wEod3Porvl40Qp5keghKcCI2MCTJ3+NLSaPh/WCY/jt:ud3PoRxw5keghHwjt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a047279c454da8ee3ba9273cf2f34df0f88a53d755a0230caa183f7f5fc4c6ba000000000e80000000020000200000002436476d76f33ab08e58255106b607b724a56174bd2d935f9c4420d690abfa0920000000c31045f3f31bcb4bfe452767ffe7698802c4a7afc5a5a3d6ec1c91c90437b90e4000000031fcde66bfcdb20911a4f59552d18f8877c0d40ddd5ae9332c41b9a687438a9626f07d50445322b4837ed77ea7e5b34e2174bbee0c636d4946f10ea4dc1a0bf4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410151555"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b342fc903bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26564631-A784-11EE-8A38-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000acb02d598bc4108d89a7e7339f122a20122d53b58eadae9db6fbfa5e93c269d8000000000e8000000002000020000000b6bc64eb7a8b73e0a8d1291492263efca6abfae29d8fe26ee34adeee2327c30290000000136ba6a0df04a5087607261263e00d47a6cd41045e241606ac9446c57e4acbfdfa63b0f6dbe39a799807373b9e4538bf5af24207cb8e25c07a634f6ca96fd7271cc7cad1d44485cbd1c283453fca0a001130345c4af84da8b72eae17e58059819ae5ae1cb225ef1212c9c2c0580e9c56e21842b4b795f83a71cf471c3087ce9263d79c7198ffdec8450f7cd2f848d4c2400000003a5104d9d3061725ddbc47fe655afa9294d07adcf53ab19fcb3e51fe6d5a7ad2501cf09d3a37b0e53f6702801f900902e2e5db32a5da3f4c265a7c4f62ba14eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
928	iexplore.exe
928	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 3056	928	iexplore.exe	28
PID 928 wrote to memory of 3056	928	iexplore.exe	28
PID 928 wrote to memory of 3056	928	iexplore.exe	28
PID 928 wrote to memory of 3056	928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Project Storgma\Monaco\Monaco.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb426c722be0fa073dbf41f34a770dc2

SHA1
7f12544cee640e1441e52727f18aa1324e35bbdc

SHA256
df3cdc7a43e73ebc85a77bc0360b638f5521682b46347473dd2d6ca230a32022

SHA512
0a8ae713fbaf8061767e7af0c0293c3d008d370c298fbf9e1e255ea570d0eeb82ed3a7c4194a773d216c183c93da75e3ff47cc5e71b5b676f6fdedb1535a0aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa9a27ea82e975faef10fbe425dd4371

SHA1
12948335de06da656a660d468172a2c43646df06

SHA256
9568db5cd784594c3cf166435af30d2db6b81dac6d3a9fe3e029bb65babfba5b

SHA512
b009eb702f8df3aff09eb7c59439fb53ef594950aeca6d8770eeda3761ed6d1e80688393fab6f921c20dd8026332356df945c564d45b3d130e16af43607009bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3c2c95a06949c0a2f33d64733e2b7c0

SHA1
f0f13757f1a9d8b83190a3dc3afdddb19c48e708

SHA256
3856aa548a4051fecde836966873ca657b958403fb8c9bed7bbd170f0bb7a376

SHA512
5da9bca470f36b95e1cf3b1143d73751ca1c380f3dc9fbfbc6b60c32432cde882f6ba4ee2bd147a58420a0eb7e3aa186a3fc1ceb3cd60e552e02bd27c2fede5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bb8091d7c97e3664faa8f1990a1c67e

SHA1
5b482617b57519998ba6157f8431c41699fbcf43

SHA256
2596afd41a82d041430362753c318daa8d61a7c919ed512a104755e9c7f80341

SHA512
d46be965d0f7118750f2b00b0b221273151d4d2cb88f453e4b0d20a4b761c189e136684c271de18332825847f6ed3160f49d5318c44fccdc3ae86169e2887428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec9089006569afee6025860d41ddc16c

SHA1
c25ac80f43d937b0178f2d3ba8d808efd1108dae

SHA256
9dd261cc4222e8d32f1d731214277a11bd952e51c9e5404bb9eec19e9765ed8b

SHA512
4cb2a5dc951a3ae5bf9dcb09c75c153319aeb3682231c73988f9349e622f6a1ff5d247a1266522ead02c5df2da73f206be623906382d5f0a56ff08d49e699ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
510973a8e90477be8705a46ae12e7e31

SHA1
ef4b135b7e2cbffe2da7e06a82a55289a80d3eb6

SHA256
2ab18f9b3b6c588ea9c158b83029f6306d9378ef395dba1c3c27ef9de05d0c4a

SHA512
394375f488257432aef3e99ef83d73c12c18522a9d08a6bde00260276495cce5e0966eeb0ee34a58131e6b0048241fcccad97eba3a06bee2dd035255a7bad040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
878bfed6c4cdd70f79af2be38443b744

SHA1
05b9383ac63189bdeb9b297a1f4d8c62ed598efe

SHA256
a05109cb939b0c66072db74c4562e704819f289996163a33288816b89e20a057

SHA512
b00946f7ca9b57b445a9bcb55820019b92cd309e696113ca7ed1bf8fff8dcf7f2e5ce2707fce8659870cd3918640019d9a901eb10ac214bd23921240fdce3b86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe5b3a128e5186c5f82929c1932bfd9a

SHA1
ac0a4cabf4d7c1269149bdad5ce98986b3bf19e3

SHA256
7b43ca45abd0881252161b22300bb4ce6e0d6df36a91c8212af2f0b82a889ae8

SHA512
2671141b41545b525015fd510a7a5efebf631108473358d8d977b45b19478e027270ba2cd6c93f11b220ebec79418da362ebc398c730b8c808e964049432131a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d778ade5bc3515cacc214bf711868762

SHA1
9ccb1eb595489ef019f575c0cad22b710b07b65c

SHA256
3c467330dceed9ef2c9dee7e53b0fc4ea31971a2a7645e42d528e35d90a708b3

SHA512
83f6c33e3da85bebe1c2fde2fcd0e79c8f668fd4179e04d80d26d4de2ca6ca0c8b9d7396889f7f7412a64507ee399841ca27c2a33a3d8eec2d0a5e9343bb9c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
884fbe435380d7c7afbcfbf6d645a853

SHA1
081350bf4c3af6db946fd58996511ea7380a9235

SHA256
948b88ee20d2e17797d9dad89e8de277ade22cf601cb47b1f73f8ef9fda948ce

SHA512
496d49dd320a1d30bb776916084acd33c0d724bfb6d62a3003108c99a240a8a696550adec70054c1803923bd07d3bd1a68626437234c135a7fa4cde4c7af32d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f5b7b9e1a6d1739d2ba138e0e4456b1

SHA1
eaa50a505d24528626294c340c780b9dc530592e

SHA256
f617a7149458dddb1a775f34d3d9c5e5b3c6965ed4aee5667ff6bfa4b4450865

SHA512
a5d7cfd1968628c346b5cf9b48b5810e4cd7cbe221b9cb2660d87995e246fa4d8af19581ae9a62c68af4d0d256f5513019d982c37185b6c57fc504a1fe3dc738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cabe7879fcf640c36e9c01815a37d48e

SHA1
8ef743c98a9f8683a19cc44666541117216e130a

SHA256
53dfeb51599e78c16a0d0feccb32bee5b9bf837223144a2b29d8951a34e917b6

SHA512
fa91a090ec7ba3ed378dda0a1489ae5d1306012372b724e7d5f56198cebd3318eb11ab3062ed051e07d0992353cd53a20c34230ea85dd17e6003728296de4152

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4F5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE518.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit