25de4f1654db6bc238ef9274601f52b4c7f1817fc503c9e3d8a893e7e889cdfb

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Taxassurances Financial-Report.html
Size

1KB
MD5

b7449f4d558141fdce4e0fb955874ffd
SHA1

d7185b77640d4c19c4c9a3a0089fa74d0036eec9
SHA256

25de4f1654db6bc238ef9274601f52b4c7f1817fc503c9e3d8a893e7e889cdfb
SHA512

31f3617d286e17e77e739954fcb7f52f02eef1c1231c0d2b13ce0cc83338a40c4ff9d60664189f267c93b19e0833d615421e2a09284bacea43521d1f15e5bd32

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E7B8511-D1B4-11EE-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3002aff3c065da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000339c2216b6b6d400043a960a74d319febb57ad555fd9810bf84956b0f01a09ec000000000e8000000002000020000000ee79a65174b9614aef69b24f0364d1c73532c0346962230eef3ac3d7bd9b1a6820000000b29cd32477eadb44a5a00b7f0fd3b3c58944b681bc60e6f76811070553006ace400000000ae775f4c44e716ce6d4aec7c3fd5d2e006648dcc699489e939a7b9b53d2252bef8034c4b490b451979712438bbc52c5af315755a380456b9ccf46edcee8056a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000560a2912b167ba75dd1887fb42bdc664b0f4ea289a5f78e4991d535de261878c000000000e8000000002000020000000782c964f56c5b02ca604849ddfab69a5cca199860651483c6a3c50326a9feb2590000000bc4b2818d6f2d81eb2952e7fabfedbc89e7a0ea3cd969e86169a4d03c45db21e7d14bd6c48c689eb6f2b72baf8adb3c9bf633fa3df41770b1d18210d9598c010f3aa81d2d823c8962e2433c9aa56d21a2d77ea32086f5d24198ec6b0e623c8bf872b71eca5f0b0cea7988c0ebc3821e32baee3a7290a5c2c3c01670e51b9e7cfb04e23cf265cdfb7c4dcb509e1395498400000008015f0502caf7c70d090a1bd11758ffb927b308ea39ab7336ddfa637c03195637bb18a719a39c5da1f7012f87bbefa86a8b326914ba9ec9ada323a701adc9871	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414790073"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28
PID 1760 wrote to memory of 2916	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Taxassurances Financial-Report.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928a058ab062d2112e84dbb7d8699e03

SHA1
8e5ba89a053712c5562ee25c0dd0d47782b630d3

SHA256
317e2ac8d87f63d0d7e052821c726ec27e460d16a17baeee340e14e0ac9f518f

SHA512
7b182ed23330ecd89a870dbbe21f6b86503a68ddb78c7b382ad32dd7a037d1883f120a570ceade3302100c91d58a2c0da409bb01e42a88342b0b100333fe0208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec0dc263277b62d36589c5f3fc392c45

SHA1
b8e43e16a8ffc625e6049daab9489118eab29bc7

SHA256
66fdbd6ab2f066c3812127a729a7b867a8ca663bfbcf539fb8e341cd677ecc61

SHA512
b83f0c4dd0a46a0b68228765837458f35547427e06e86920b278d832e6cecacb18a3240e812ce8b4ce568afe6bafb4970652805e10dc6e529aad0a560582fa59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
286ff8b721b2b0ecdf6970f0d05c423b

SHA1
395c8ec14c5253ffa1577091caa297337cf898a2

SHA256
a383bf7d37c74d1efb5ad8e616b91d97422e2eec83dc7889199963b6bcd59cc1

SHA512
92f1c47cff40eb3b85b5e257afb530265a17384defbfd12f9da4e18d12775965c4eae8e98bdfb9e58c8c293ef5d6568ac2dea8e54691920504ebd300f1f69b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47087398c984cba64e7d68c91bd1e937

SHA1
ffc8dcd589da73859bb5c9400cba9df5856323ce

SHA256
c8deecbcc1045515b8bb4b6c7dd1f67754fd98dd9235ab0e5e6363432574e842

SHA512
15fb7efa8cca9dae26d9a31785e486e7ed484f51e0abd3133239cb2bca8a49aee2a6d1558c52e116d7039377df12a264d38136b292226daf7b24a6335773b8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ad428ef6621b81f1bef89782cb09818

SHA1
ee13bb67c2ecf664ada303f0a5f12cda1aa18aaf

SHA256
76e45c9f8758a55d0f6995567ec60a9efd74d58f8df35862cb0e8052dc4a7e71

SHA512
b16881630e3629c2cb128760f953bfe2bdd85f09900b4e00e67e9eb49e035d840a2039aff65a540511215bd0adbe179c0d194e12864861d5007cbd2d53b8bcf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13dcd84d4329e35e01148585b5aca8c6

SHA1
afe65bd9cd412b84cbfefac1a9d07261362c94c4

SHA256
87862b355c176b7f8e6fbc0917a290e1694cac24c083ea8a0afacf8ccc16e0dc

SHA512
08e1c87f324a0861ea359bc33c5a4842a60159e74f435e390dc592d553bd71f36f632096d22164475de969444640504c35951b18292cb83eddb5bdc083b1af53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6484e8187af6abab2bd24a3e08849205

SHA1
3e49d466687c87c1973e33c4674d689bed866e33

SHA256
6b410c39e29de4df5b20252270680cc2b37c9c29c773c0605cb178d2a336c4d6

SHA512
9135c0423ca38506a83356891d113afb77e335f373cf1cdd81611d673f2c3a632883ec4725a74e383d0dff39e7b868419fbf898bf376a10fee4a3b58559d9066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdfaf7210093430e0e80e30554e48970

SHA1
a602639c7d1ae756a94c6e8fd98dcaa060229727

SHA256
5c28b66a59770e3f809f212dfba75bb689576ae039dd1e8507df7313d998b925

SHA512
353062841bfed070a20eec343a12f236d4b1908d4ed87d023e525057ccdc5fb8aa781cab4278414e5670be2516833aade6dffd217f594c518e089b483494c84b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22b6daf47adb99f459b77fb8e4817380

SHA1
3c7b181a4f3e8074186ce93d008c65b7dff770b6

SHA256
48f20755bd76229fcecf9d1596f71d9db0a30df31fc4806d86474bb86a2798d5

SHA512
1c58afe5714bdba60b0be68465fe0969cc945435a53b68ab21a2b83342a1d09232bcb89eb4dcd7eaf1b8e1c29a91d2f87a455fca050f672827c5b288d4c52cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c978232c1d326d68d04204895276489a

SHA1
f53ec2b9eaa87dfa2c16e07ad78535224ffeefb6

SHA256
139cfb4f5fda06ac010827b0320244b721900a5699658950f7607eb870451180

SHA512
2c8a9011bb5facb9050c1a49962e531c13f3e2ea7e27ca6a8ad7fc4b696df96dbd0e38809d08497e61578c6030b5e52b76816d40611e9d5a512a28cef0b926fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6763ae3cb0ce23e9dbd6205c659f975b

SHA1
0eb7d9b053de2b9ec543d9b54f23fbeb32ea93e3

SHA256
a71c9b68bea3432ead2656beca799876de63d0fb21e24e0013ee9ba6f172b38b

SHA512
2c79611ad32c7d70086732c637db722c36fc6a62093460599ee3cd63f3ccc1f527009de87ae6d3a39b70426f6fd5df1908035380a938fdfe0ae72ee43eec7860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d56b0498a9fb279aa1023e7f305a24f0

SHA1
b7ee1117e4ebe0c347016b92c15adcf5c03b0ee1

SHA256
805204f7a4039d29ddf3afa9e3ee20f2b7271be677bfb39e1e754484ee27198b

SHA512
e599f3c355bd977dffa938c8eb00fb047e153f67d17ad25502c5a2996a1566781ec7b3769f17334757a95c8fcd93ab1bc700a38f065d5dd2d27c1d7b76bbb461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
867429f2f2fd5fea3dc9349c0277e732

SHA1
43d4e942ee63dc58d3a8f94e392a381eed5b9a24

SHA256
37ca5ce63b57c7db16c57f69302fc93352545ca8729f004582ee5ce7b354297e

SHA512
5737fab9f1c2ca7a1fcbbbf491772d5c2bfdaf309454d1bbeee518d97264b5aaf0a981ab0e74fb68bcd59b37a995059698e1eb4548e497272e5b70979b892f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
164839366b058df348d210e490646db2

SHA1
f6bc79cd6b7854790825eb26575c7fe3b90a9759

SHA256
84783ccd94620cdbec694fca7d7c9b4a7b8389e3eb803c5265ad550ef693b2b4

SHA512
b59eee86e2af032fdb5d7f189fd7498a5777323a27afbb5f05af97b79b291f0ae1ed0393b2223de8a03c3d0d58bbd6deb263372ae705fff4b8abf6cde9fed9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abaa0ec24a41fc432ed410cb45692d2f

SHA1
6251434ea69922ca5d10f83936454ed3fe0200e3

SHA256
ec940ef1a58f7277b7d5c1f542e82f3957e282a12d2bdb084e2833c8e2d1b9b8

SHA512
1effd652fb77936c8f1d532acd6f7d7d113ab7c99afd6880894ce2c76b30cd6933fe8a0aac4cabdd66b55e77ca9daa2306c7e957620c3c63e7b6545ccbe20d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80da985225ab9f4932902806ec43a2d6

SHA1
3e226089418bf03c758754d5e34982d323423abd

SHA256
9b32f120cd10e1086af955bfe14ee114724920238a2e9244925c579a050217ef

SHA512
f700aa40aa247654d722a13350ac17e39f5f6d8551ce902d7fcb1622672d7c8aec1e56bc10516d325703a9ac94e914b5e8580515ccda5711bc7637cefd0afb02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
240cec6a1069c3776f85fee84b404b61

SHA1
901d6fc8fbfccb0dfbf21833019f491c9937ebac

SHA256
0b8c616925a9cf8ecddd60b0d7d004dbc29da3e79d9c2d468a5168c82a287335

SHA512
71f270702a3887effdbf22e7c24e5de7bfd85d3e5874fc89aa1e2490c4e6f54a901401e35d4090544b20303f9236c13b83ae1f237f5169a8d4d453d0393b10e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0998926a67f4edde1d4b25520babe408

SHA1
7918278ec783454256ed88794a02a273c7517d74

SHA256
b466a63b52acc987a380b67a8d075de5e8538448d8d78cd72fdd83337b7c6f5e

SHA512
1c5a48bc398c316964e3ceb6ab52a02cfdd55c7570a66b885c42364901cc67da1ab7ac33a180280820404a7583e6c803021240f3a3e59dcff5d068b6aab58fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA902.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit