e286cc4e0f7e2a01eeb47af5193af7b0d7b5937befe4db9af17df507af0b25af

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$COMMONFILES/Angels/IEHelp.htm.html
Size

932B
MD5

4e72a0d4ecf37f91b9fc9fd2e27a6661
SHA1

c3e9117731947e1a3e2f9aaea9356cedf5fe53da
SHA256

609471ce7403a914ef23d91082242c876e1b2ffcfcc6a70ab1309f45b387d1d4
SHA512

ffc517b819c9e995f0aadef0583b099b16bff262315a9f27ba1c6306d0e0fde30c32ecaac19fdaf9584f182b64677699b42d40606f4038637485b2b5601d79bb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b48813a8c283b40c91b6b6b8ff500c12946595e5080123dee6afadb4265a2e1f000000000e800000000200002000000094ae33eb977f2a6340b7d0d84b7b54ed67c2b9caee5d6ceaa0c600caeecf46582000000069d19292f3b29747a0750e60cc1734a33fee923591d2053187bf1262352882eb40000000e0ce5028281e90bd6fdc668997ba427321932061d4c5aa7c398e083962390b61fa0932bb180e4613ddc06897d7e9b2d3b78013b665328eed331a5da3575499b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b9c0cfa07fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000196d7b8d777db9b73deecfe106387881ab7b235be5713e602c389964fa1f207b000000000e8000000002000020000000f6766279ad4aee7acef4be3fbf7d053b466eaf4fc37ca53a6a7a16a3e3a09239900000009872fbaf9b82d30c493ea1f18b537ef1d11d8fa70bc0cd327390b882675aa76a5c6eb4afd6142c61adb04f02f1ef5b50428e958750df7854b95feb1a7d1eacdedb6f057f107bbb40cb78f9030573a348f4a318769333ef16f43daa61dec9e90992ad37861615ce16ed2a812ffd179c5c421ef4579337ad81080388553cd5e67fae0b7d2e82a37b6e7dda81fca717416840000000b2a82f10e853e4a0403ba6919708cd6f75c8be129cb63001544d7681627452ee19a56bb1a2a53663d6a2fa42ebd8798094dbbf7df177edc8f7ec2c9419573c1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB50A3F1-EB93-11EE-9BF8-4A0EF18FE26D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417635002"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28
PID 2276 wrote to memory of 3012	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\IEHelp.htm.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40239dab20494e7a5432b9f843e866f9

SHA1
186f8b392306a590bde2b76d9922165fad723999

SHA256
48099224c5bba33c6ef1bdc3f5bac0b5b0e81afe2b00cd2576f188e983d30c3d

SHA512
707113eb9801b58ccf85f3f1b3834c5f127a536e143fc01340d9250f8a40f6b8c39022e05e2857b488d344058eb6b8375a05624c6c587c8f3b512ce712406097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1fdb83eb49ee28ddfd86242a034be2

SHA1
c98e5323021a48f78a301ca61548de1a5d6a6ae1

SHA256
3077ff00ff1e165f16a7675915a4cc04d6202fbe761cc7a803500513278a91f4

SHA512
e7298b912e56f5a853f2678da9f4c074e6b21994ed22acac77c5e6bbf915ca9536918c0242b1d3844dcdccaef6d7efb35fa7e7ca20d0b7cbe94b5283b8a22c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f69a9c1224cc43d54993e499828c3705

SHA1
069153689be4620e674eb28cf895aa43fe3d2031

SHA256
6a2452ce7e8aa32c14273751efbdbdae71b221c17bfce1101c513904ddf8d5b6

SHA512
e1fbfa0aada6d9bfd9d7d4725238d4d210e2496365aa34c05798336242b53ef262f9bfa9f4103ccf508681dabd39cff233c4daf5c13a621b1a62fbf46260726b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c411b5e5fed96ef36945f5237de6fe

SHA1
251fcad8881908d57ec61a3c2d83e1db1fc26a34

SHA256
e29618cff54b8b0b7c5c4fad8c3d7fdc9827ab19639870e65e241bed2e7152e1

SHA512
a0122a6a61df47d8c61f0eee3ef1efd791c3ab8075d77e9827ea713cbd658a295187f60863eb7c55441b1707d4c9cc39a8b7e4f43dfe62d4a5762933c9467b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e7fe200fd365a8d43ace718608d0cf8

SHA1
a0fb01f587aca7818ab891d104a7875ef30d4aa3

SHA256
e5e10d6a2ec176fbc9624e631d73eebd4ccda6e6ff9fcc9ae22762d2f2a3dee5

SHA512
21aa4905fcbc098228d6cc725521cb10655826195c73661de11dbafe6f2d837d7844ef962ada67de69e127333015f9d60743383c6dbb438ff24a3061aa089595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daf9a8f2d3b79fec3170583585812308

SHA1
d57a150c018ea93ce53bd3f6134191792854b000

SHA256
433bedc6cbe498f49616ce8c9d3a36b2448a44d3d33cde5847646d27f245de2f

SHA512
57aeb1557cfd587642990a8b2310b4205326cb31ea8e7615daad4c4d2016fa289cb9340c074ddccf5a66d7539cfac7f5855edf50563963afad354519c95ac687

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21F5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24E9.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit