80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aqua.html
Size

196B
MD5

62962daa1b19bbcc2db10b7bfd531ea6
SHA1

d64bae91091eda6a7532ebec06aa70893b79e1f8
SHA256

80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
SHA512

9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000328c55de3ba0cadfcc81e2f3e88627b92f644a5cb21f6ee8b4817458e2dd7a33000000000e800000000200002000000049440f3bed1b6f6a2cd080d6f2df3c3a0ab12c5bcc3351bcafd95fa5ad3fd15220000000ffe8969b87877d7dc5b1fc49b238a6d3089fc1707e5ba6d2d2f12eee2b6bbb6040000000011b5bdb06fbf0545485e6a8a2b08c92ef51ab2402652db0515caf9fdcd28374eaa3410d23aeaf8236e2f28b1c9a2a495d7a8a812bc7535abf37297bd790babf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009e9c6e6c34cecdd6f702afcc6c1fdd4aaad597dc59e252605b8c800f9283ff8d000000000e80000000020000200000005eaf45672e3c98f8e4ab47a8d9964fcb57cb49b95c36bd37e9409a60054fba3f9000000091181f0159b1e984d1c89860b02cb27ed93a30ec3be7e64032431237594b65a061cd86e2ea430f6efff7e32ce31c44e982b811964ace4264f22cd128cf69b317cbc70f2225cfb241dfa0d334972b83ceb8dfedbe3792b89719387cdd3736c48b92856833f38e51745b3fefc7c8c980527c0124e10c5aa0c5b11265cfb7e8cc75d3dabf3e0402d341f0af2b624d332c43400000008eff4adcfeeb5889f31751a672301a5612ada5e2c65d16e47fba528fecf7e614714e67d2dae837a6315846720982542429e9b9030aea135baa0bf8c7cd017f7d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02262c8205eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413951622"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3784941-CA13-11EE-9F1C-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2456	2072	iexplore.exe	28
PID 2072 wrote to memory of 2456	2072	iexplore.exe	28
PID 2072 wrote to memory of 2456	2072	iexplore.exe	28
PID 2072 wrote to memory of 2456	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aqua.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
062ea6d7d08d9200724f76e102477579

SHA1
8045801744c9b0d0cd4ed90d1db83d911f1aae9a

SHA256
72442df80c9f4fc573eaee2e828a13abe9947c9f121ee8ca47db0e5cc77eedf3

SHA512
637959350f2e2854e3ea3b914d1655d9af02a992754fc3f9b67076796866e99cbb3e9f6331e23fed6796d821b1e3b66eff928d05e62f0812031fb7de6cc2bf50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d212d7ab461c30fc613b6438a914b53c

SHA1
70c61e0b0e031743cf90de73ee48e129cfb8eff5

SHA256
25bdbdf62e338f07aa92336c72e6d17000c938535c1a7f03d8e40daddb3d318e

SHA512
906af667ad2c5ef39c1a34543d8e835f9cb04e00ac3fada0fd19273bf43397fd2ebe8696105a6c69c8e8286cb4f9531dd9849b9923c2f942812a8f9e5c9b7dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c318b2c3762fb8083b2375c2c8adc6

SHA1
962a7b9c34e975789105cc55e435fbc380fd3b61

SHA256
5a724e52e18b42a855016ed94f22c5be5a99ecac013eff4ac49e254ce21ab35a

SHA512
98e271690eb4c70cf7022516a410a62763f821c1806ede3cdda4b975ee52047ded97a11b8988c22a1e5901917e103e32f91910f0028ef475649d3ceca0b8d167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbfbae627f837e484f0e53759c735f06

SHA1
cff2239affef9a93576028bafd92dd6cc85b29a4

SHA256
998a6672285fded43fe8f49c616be92df39b93e84f992689403c14ee8b6098aa

SHA512
c1129bc14c379edabcf73c47802b6018e984660ff0be3b90447ff32f0aa33c108c4282002b4ee69785acff0594e919574eeaf4a3357c8db1ba38ba94858ade4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62abe1e0b80c12c198185e413e649208

SHA1
736ff36762750a791166427e2e98be162845ab5e

SHA256
f6b99764d14175b5c061302bad4ed61ac7c0fb9580d6726e85fae33935026bdb

SHA512
9ef94bdd3b4ce4440e0d3db8012aac1ae2444c49aa167c794121bf944015aa0cb90b65395a5afadf9c7eaa8f70622fb71a4d53b4943e07789485e3be138d4711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5299e8e7287ae7e36dfc8986f86557de

SHA1
6f10feea8118a29163736dd883f335d33443e0f6

SHA256
9ba152c801f49a03ab083215beb40bad8879ab9a110602280dc52839f3102a07

SHA512
f4c4fd593495fb326660a09420f517bf723f07beaf1fffa4dd3bfe68f8f0cb9b94d841868818530cd0ec2918159f22dd4d0d74c3021cf242dbdb9ca8c6e438a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f66d3b0f42e01830a69b272e2c61cfc5

SHA1
80724d455d1f2211e1f16aaf86052b21652d2a41

SHA256
99b25e39581557a6ac03cd4ed6421121a368057b4c27602d072695abf62103bd

SHA512
032e861ef9ee63b4aa53ce2fcbe02200fc8b24b760923cda628350b27343922608b6076192cb863ee7b93ec2e7dda994aa49b02ef83c9f399251b2b24d24b435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8386eb2d632b6ce2ad352c753f455c75

SHA1
c85bafa47c377b548c13cdc9c9c7f95f722602c5

SHA256
ee6559c4b51cb0510fd120f5dbb237d996b06ff769ab044da68adc4b094c9848

SHA512
e2472cad72a2aa5013e8c7a0a04bdce93d914a518c3885493cf5464fc8b1d395eee1af4e1d17f3fd41b9c1aa2c4a60977fd3fca6613100b37ac894420083bfbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb1717a493e3d38475c710d121ab3e1

SHA1
90e9dad432420957973aa4d73c7a8bd816d20796

SHA256
8ec9401bedc4d26ad6a5fd1785f0332c894ead8c79d85babcf72d1f3419c87b5

SHA512
4f881396a750cccc2d30107401f00cf09492c12b04ba3db548177504e4d73eb206ffd0c7113e4b22d117445b2900b73c47dfd47f5668320036b352598c4659bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
781081bce34fde9b6bf7a212973dcd93

SHA1
55d4a00d8849103bf8a7066f723d4407876a25ff

SHA256
eeb77d8544b934ebc6e46cff764a637d471845b80e37d862744e5a9a695deea7

SHA512
463d7bb6766918784a0922fc13ce4df8cbe0ab004b999aec1d53f98789c95ff81fd1f42593657d48f49572dca8c8db2e84fd6e70cd8636aa2968e37990053099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0574f5f76db1b3f1e19a39177fca0365

SHA1
e0d6c8db8d427fda831e382b4ef230949c9f2e99

SHA256
6ccafdb0e2bf813ee5d5f67e5b4223a12e75b061a68621c8d125322477cc10d2

SHA512
b416a90bac70ad3a6948da5a942d1790505d74e15ff26a0692b6c4c541a81f920ab840261b70dbfb5191eb8fa41a6011a3bd9247191d2f1a96f1cfc1ca11d646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ae983ce3ecc4d7c898f8ce79a2c62e

SHA1
0e5e8801430088ebbb899584c7797ab7866f5a4a

SHA256
26504029537a69bfc034fb56c6272aac2e08cb8eca105953fd352bb8e0e0def7

SHA512
4d5c18bc037be14e493681b92b97b153afd24adcd66b490d3fd94fdead1262b35dc4414dc18bde28f327fc20d7fb3d5666dbfc8d374de0f0a7ba8de650f3c1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f86a602c184cca1ec97a78f56a8dbad

SHA1
b458f39a0b1710b1df716e9cf3921652c6bc1170

SHA256
a7bd4e3b9a5eeb0cf3d9eb5439f7b96cc1ffe82d5593a2eca53cb16b007b4e30

SHA512
e0787378e724d7c41d49daf900d7f8c1301f3d507a2dac374a4908e2a28458153e0968660bdaa6047a0199f1a2c34cb0dff37cde4e416e0cd6cacca4c49f2d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e89230a740487805a219b40946983aa

SHA1
e80945229a97d32e26e7fbbcfae5a71bb7b2982b

SHA256
719960c560749d29c63004712208c9d954c9dfaa260e51b1da8ce93e4a879f49

SHA512
97d6bd2d8d9a24821195845879a7f5e35236da78638fa2d9b76cd191d2ffe839d1f4aa1ebf13a029fa05502f8430149603dc5a9e5c6ba9ebb54e9ca721110916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
179c221f79cdd8b90f150635bd712444

SHA1
9ad3d0fd3b09a854f51425e1aeabfc67b277d1c1

SHA256
7e61c4e3993796ee9a03c8ef9c32d8eb0f44830324390e8a02da3e7cb438f450

SHA512
7aaf308682b36e1898607fcaa5606ef716967d38bc4ce5329c740a1c65e5a8c0bab6ecd893adcc4ed5c42a42f834eed169f2d0f9a8b08793a681cae2124281b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b49e7dda552aebcb39375fbddca8153

SHA1
8cb8e215073398733d3bdbd99d1dbabc64224320

SHA256
903e99ec7986da7961115718be96e0a896fa160c3bdbf97b092cfbdf070b2b86

SHA512
1d9690fedf819f9a90acc560be31932645e99608468ef07f90cb4b78fc5136340235e67a2acc7a5962b669ac26c4dbb0b70238dfba1817c3e64737317d50b0b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75fb30535db31baa21b4b91463d30fe2

SHA1
61602172e123227ffbcc65f088dcfeb28be51d41

SHA256
075408126a6d974a5d902b32b5de0effd2899bfcf7aae2c79a951bed95df8bdc

SHA512
58b1ff6b0ce38196d6b5f5e6c93760e91c9bf8512e1009fc79c4db37ab9038f3fea18cf524b8c95b95566d854a059433d155cccfedfe82d0f58fd080c6f33475

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5ED5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F94.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit