hxxp://wanesptsa[.]com

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://wanesptsa.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106822666950da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412443454"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000055e348bbfdf620cb53ed69716c0c9fa3149fcd2a52987a3e01ab3dd527076302000000000e80000000020000200000000ef13afc964f7cc869d05aa6ac5c71ac567f414d6b4fc178720b16cafd6cf7f220000000fcb565f227b15d6dffae33a4883a04fe5f4ab4ccc12eca78633b22735919273640000000954828560195e0eed40583e5529f283fbacae30413d701a387e3998b0a0663a8105a8ea0764deecf931b62fe5dec3bfcea19482be84a0e3100471a1ce7534784	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7945C221-BC5C-11EE-9F2E-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005a9e7982b351c6f4764e8e493a4cb3ca41315552f85b862ee7f700dc26249c47000000000e80000000020000200000009ad40cd02c7e26ee55d2aaa4d032a21e24919a6a39126b7c4664277f0829b6189000000085843f5b166b79f9a5c00130ebaad0d095096208a521c077d3d3c7e63cb8b307c51449b1ae9507738773d89d74d93d29882988bf4a0e21cb820f0a6e68fb05a68fa881b8b2720b29ebfe194499d6bca036a60a7e9eb60bf785874538b61608f290efe5199b442b48cf4c04abf50fbe05052b7efba81c1aac9bf1bebc04273239752bda886e1da542471249de8ce324094000000073e35d384a582e8104cca55793a28b2aa6ea61e82b0acd5e8c8ca7e4549ee535fc6c0b971c574826184c4ce1ea31ba78973811d90d5d8c1af963aa15fb7ee28d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
2232	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1724	2232	iexplore.exe	28
PID 2232 wrote to memory of 1724	2232	iexplore.exe	28
PID 2232 wrote to memory of 1724	2232	iexplore.exe	28
PID 2232 wrote to memory of 1724	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://wanesptsa.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7e79d3138b43804b85196e57da9f76c7

SHA1
9ffc15eab046847b300f613fa8cc920af95a7243

SHA256
4af1bca6c29435b9e6a9046552926a4269dec428e1b2d36b2a610a8eebd6e90e

SHA512
4194494fa2d233fb28c10e0c14bc3a130be70fbd4e4086edc826f0dd9cfa3775164dd2512bee6db94184ea5f1df85615cccfde9d302f746f6937fadd3eacb92e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a889350773b78c1ac0e6f64e2d341b1a

SHA1
228313a6e7213d4a26438b6c2631f2ec3ff821b6

SHA256
af40c91770388699f754e8a187f7aa26643c24112ffaf8999b2df331881e72a7

SHA512
aa4ac8e07fa556d64c097bd3dda6a22dd906b0d9ff0b9b830456c08366e958e90c24c36d91d4fd2bdc72248ca4eed74dbe1b8aec22cb310a07d47fe13c3d183e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201859da3398e84c318007560026a30e

SHA1
6b15492e1078d965db5d4bd2ea94201533c670e8

SHA256
687c965e6c77b753ce6b26161322249c8d51ff0d28d19e08210b1df637ccd18e

SHA512
ae4ef3e4aaec9fc386e0d99a17c1b49312d8f25c9e653c347560e6cacc85162a31a7925cfd5c80f54a774572862fb05e23d5144d08d752315470c00e934ce980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d52352e072553e864f2640ecbcfa8bab

SHA1
bba7233cbaa2e0748bd8d8ce424402d45f5ed765

SHA256
cd7ec9b92d661406d1b7fb8dfb3b8c0ea4ba5b84092642561b356654fdd93945

SHA512
3040493d94bfbb4e64d47253011271a9eb1f631c727c713f51f7b5ba8334d3ef3e4dfbae6205e9c7ad4ec6e89a49b3cb2ce9d1a9e6f9f5ef6029a25a31f23b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d99466eb3f3c2e5d235569f39c52c0

SHA1
51401628e99b966612eb7f1d7b8318a5560a7a09

SHA256
2b4e0e5eb917e2e33fc05cceb76fa49689090e995d8b679bbeac30708925b0f8

SHA512
a8ec7a858b3f5fd33f81e54b205e97675ae0f420cb835513279e7fc928bf2b693bade2246bc0c6911e794008f613861d2f4241c19ef3c16edeb5340a11138378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6483d0ea8dd8461d45c1c48089c9d396

SHA1
0fd26886e9b9d679a38baa700dbf2bd308454d08

SHA256
22196f81ec822a642c6b050d26b2ded7088d6d734dd1b28fd6f218d72bb7e05b

SHA512
b3db59545761447deead107e9dfcbfbdc9ad5173c06cc1c99a63b0f6aa94012499d6491bf3e2a93fbf6dd696c72d280f99d3d13950602835a1793ff702c089dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27d3ac7327901f179214abd7d2712db9

SHA1
dec8282fc8de874aa4a3598c6016042a354b5195

SHA256
b446f815fcea2c5e33818175a81a701b984feba0a1459caa64626668335d15f6

SHA512
103d53ff38fc129dcfaae8d0fbf140000fa2a337bec2a671a6317cdf7b37677d02b0a072d48b951cad0d140f9416f33e7b2681478f636d1b6a9268e08aa20dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c41cdf5f8274dc3ff81c581837313d97

SHA1
d163523d13fc8ad24c485c00e6498dbc8a8ff5e7

SHA256
124327cbe239573394992d9213cb162f5d4e07fea5da3c538cb44a230a99bc36

SHA512
6cd86f394b03668fa3e4f1b1ae8c64c09b19bf8b2be8cd301d14d291cf677d305f306c8dafe0499dcb58ee7e02c217443f5edf86e9b5e5d77456118a457d1524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a257b5be60719d1fd1532538fa7fd133

SHA1
ac9676047fd826df546e7158ff36f3c715515bc0

SHA256
b3ecb4907e5b38b6a2097c91140219e40a66ecae6068d1093e6607a0588fa6a8

SHA512
8041870d5cc66e375956474113b09a67933fd79bae481a9f71041d7898e7f77c9690148624f5ecabfc0061cacf93cb0377cf9de7f0f1c37abaa0cd3b0620063d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ee8e289dccb5bbd44a6216e4c00a70

SHA1
3778997213df1172abe4b856cadcac3459950721

SHA256
0a2a7332f915df0c281347b7d40892de2e1e0c3068ae8113b33a756636d41d8f

SHA512
4a1d8526b82cc512e8ba841da3767dee91e99ceec7204bca8fb96c1d63c928bef57afd8466b67d841bfce72c78a6b604a6fb1628695121dea9977c38045aac78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c07e71ebbe49f92363c2178cb66882e

SHA1
cdb22a68d7a1ee4193a9098a0c133122548628ab

SHA256
93c9eacddcbf8048e6147b2c147286ad58c366a4e1b9b591d39385e1ffdb7e21

SHA512
d96d87a675edfc5bbacf965411e5738c4536641d53b9c4a957d63858e5461e9fdbb23d224c42135ad5989a05cdc121ad73b69dbb76bfd092a36f0ebced0d7d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531fc466e0a052b80a8eaa11bf701d00

SHA1
cb2be5a79c997dee0888838a8c305d4d0d673f4e

SHA256
ecb62605e422c147cea54a3b4bbaad358990f4d6c3770647d932cabb48eb0bef

SHA512
5b9fe6d208d725d5ceb782ecf05ee65e92ac6605366ff044433aedc4cef81a923bdd80a7e1e89f1b4ef3b3be5cf05b85a9ebe72abc3fd113b5fcd6620ebc7e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2fe6936d23654bf40f8a7337f3afeef

SHA1
1e5be179de528964c76bb4ff74c1bae934e36525

SHA256
29578a4ef59938c7f2a2a730294c83dcf5ef73fe4c5b2819c8989fc56a7150a9

SHA512
acda1a40fc059be463002b2538ecf92b4be3271ae794ac2d275c62e07cbd31ec917f05cd90d601006c0bbde05f3fffa49370d6aecb3828e9bc11d949f2268c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d7b4f191b52a7db49c3763e0d870e23f

SHA1
01dbc7e62ff3c7dfba1e5360d093bc78b956c952

SHA256
839b2e231120384a66fbbb2f3c73fcfcbcb5874b502113f2f9a2ebaf3beae0ba

SHA512
78c302ee725af31ad3416dfb8ddb88a821a29e2be6ccd7d0393099bd4c5401e6b15a6fa304a7f5ba2b83e929dbffd534b012149df67e779d322bad55844db816

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC350.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC382.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit