c72bbebf41a9ea3211dbb79f96469c8da2228aa53c4407f0def58b558617e09f

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

money/index.html
Size

2KB
MD5

cca123bcf1a71322f2f68164903364ed
SHA1

096563db3d9f5dc506f4575a1e374f1b210a24d4
SHA256

0ecd5efb0db4ad43a7a5b4cf5952e526d108c9f7894e4fd3ba85cdf2d55ad2e4
SHA512

da98640fb7e8079d07d48240164608fe25a43c67176c03f0d4af713b1342f405deb733b636b245812bd71f58e07bf37010a21857a7df7e0aade3dd33715e74a2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410509944"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b4b47cd33eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005f56e5ce04f776b08c7553c59230a3ff02b225891221e88c844980872e20317a000000000e8000000002000020000000c5b1d5aab4073be667b1755f440a1573dca8baba2f0ecff650305efeff28446590000000d90acb911843dadb9c981e5af80f7b38e748e808d37290a3178751004ed6332c588fd950f503c60be6c80692f3b5f6ecf278092b42c1553b947ff26f87d7edb44036817eac1995af42baa9a4a64ef884cd25e3b7d00044d939d9e221288d939f3274f5b8a24ccfe4811019e8664b1d71e53c4f94ed1071148e7cf621bdf7c3307a0b24995ded791fdf46d23fba7192454000000048c72cdb218897eeec8a5c491cf210dc174d1cbde2dfc3074e0d1fafd2456b1f7452d21e660226f2f4bbbf50a3676e1537ccf7c0082b259a34811e19b82d7b1b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000377656060ba18f06363618cccab85eeda85c38e3e5fd2202528748ba7eaf987a000000000e8000000002000020000000f8ada0f2d2df0acc76d568b080192d959383eed467f14a14c184ef2e672250ff200000005ee3af8f85bffebb312fc509bac224abbb69aec23c6893173998ce655534ce07400000003a31e32ffae790104ac4e43d3530232774b460f1ba3f901074b754e59c0f09174a38d3901aeb1d3d494e7008177a1fc3bb68100b61b33593c74c92496b47aed5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6B29CD1-AAC6-11EE-9840-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2732	2720	iexplore.exe	28
PID 2720 wrote to memory of 2732	2720	iexplore.exe	28
PID 2720 wrote to memory of 2732	2720	iexplore.exe	28
PID 2720 wrote to memory of 2732	2720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\money\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32080e04db94d73775d1f07ca9f10f5c

SHA1
ed4bdbb20c197ebbadd991d6e94fed7b2f212cf5

SHA256
761accb661b7811f15d4f7d0f2f493a2bc48e2991d540779917c703e95e1e7f6

SHA512
bb13081845e866d7e7342aa25f85b48ccb8b827826c55c015e51a7343c76a12fe5691f613542c2d918cfcec6c3599e5d4cb1a718fccdc0a12a9f9cfd573e51ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cdcc8558b59a2318c163556fb09b1a1

SHA1
1b643e0c0ea68f4ece617640460667213b2617d9

SHA256
bd9d80062203afb4da6723b04685a464a3ccf7f3495a44f75dbc0f4a52616917

SHA512
dd7667866a0793f94287fa341c498cec5cef272277911597c2d6ab76f4275743d3786888b11fc50679681d94a91a57610a557b4606b749d22949bde0635f839d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540417dd8d77a646fe66fda2372d4118

SHA1
a43bf4e5b98a161255450a8776f4b732e7e942b1

SHA256
bf0f2bdb45a70449cca4953e2c1f70dd41a0dacc2f92cb25f15932d672a12a8b

SHA512
086eb96a431fcfd8e6a504212588fdaeb063a4f5b2425d13a9752ae4c98f621a6d2d2c33b9b812522c7bb784d7b3d2ad40af5e8438e6a5c4e8f26a8769cc7b4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1ba056c5fa7dc7420453199739f4a04

SHA1
f8a7cd68093245b7008e302c0a7222a99ef9ce38

SHA256
04630a0114a180fee6ceb5bf90d7913f860a3b27e74a5f91990cf956973b9844

SHA512
281e0161008f94876feaf172890d55c1a97413533e11bff9cf186ffa29d744eec6cc84231f8a834bd210bc3b71773a58a240e5ba20c86712d3e9c6fc573b6ef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7e72379662b0dce8690ad4a86e606c0

SHA1
21a8d99fb2b44d60195cad63230624e843a754a9

SHA256
92cca2c21ee4a8d2b475bfd1ad9987ca33dee999ca2b9754a63e8af71afd01aa

SHA512
334cfd716a7af9157644edccebfbf939282e757f546d3310bd6419c2c2cf1b115675c357eb7e46fb318ac88b10e2fafa7a2ad7963ea99f1e736ae73795358204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03e8eaf30928c2781d86ba338991b4b2

SHA1
343b7079f40049123fac99868d0d590afbd0c201

SHA256
94ac821e3b742b78c0e318161d57577b90d100a12a558919edc73dba6fcdafb8

SHA512
6e540c65fd327d9d419568cbce88179bb59a37f273a3c606363eccd6ec09577031270cb112bff4479857be871557c3c3648fc88dea9fedfe6956f4956fa82700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a0f616a6235a110174b0637fa31a2f1

SHA1
3a6ead2a70ded38ffb54b2b5fdbc00b572cc70ea

SHA256
e42864cdc30f58317455a0def610c0777fc70355a10eabc130b4c4096f4706a8

SHA512
597c5e8f4d65aa286359a3b6df6a841722f57219b92e89242b3aa89f7ae1cb9311e7e5e5cb9c1ed692dc424facb1faac03ae50245628751ef6b861fc2df842eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1482c45868672c219de6c5a2dd32f520

SHA1
a06045680deb08f12709ee7785c19aeb8c2d6ff1

SHA256
cd49a9303bcbf170450f7cf88aa16f78d45cbeffcdf56160d90bdf02dd416ec2

SHA512
898c36580dbf4678765eeb9a42f222bdcb1451318be13e853de2945a6e35dff8ba4dfa5a3de21d67aa8283bb93443d7816aeaa59498efde6fba391dd3f8b7741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
001870a50088c8bba5128e6ae3fbe87b

SHA1
c33bb9cb22b7bb3bc8c61d1d732821a1c1ea3b42

SHA256
9a6db32bdef2d19f35cf75a97d77927c335ea6d8920ea14b0a9db905e0fc3e0b

SHA512
ebb5a4f56136f0d4786b2abfafe593490a22949fdee9c808e17f9b3343bb65be487bf8b020afcb9354c403cb2f449ac6016fb6a053597bd0dd957a280b7adfe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d767366ea702d940db4175295aea398

SHA1
4c1fcded86ebc8648a392d03435c0a0d96f6876c

SHA256
86b353b590a72879cdbe290f5b849069decc9517846f7c632f3c8acb250ce5e0

SHA512
a9e27b4c35b5ca3f309ee57dc277add79ad87001bc680b6cc6f0fda650047d7ad9f01c585ccceb7db369203cfd113aefabd75f13ebcdf4a167faddd9c1deee1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA4BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB14D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit