e5985a9c882fb00282e748c03dbf32ca9d59cd8b519d81cbc014850eddee2491

Analysis

max time kernel
35s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Backupjobsummary-BankofGuam-DailyJobSummaryReport_2024-05-03-08-00-08.html
Size

4.8MB
MD5

6d391f179dd7bb5b9dd05c3dc6438e61
SHA1

2cd0b05ae7b9c7da228ae0013316b43749874d64
SHA256

e5985a9c882fb00282e748c03dbf32ca9d59cd8b519d81cbc014850eddee2491
SHA512

74897874dcb772f78b8aa445970c6b408a506f1eaa2c7b06dde95ba509b6ee45bc6dd40516cc836acb93fa822ec9b08292692cd8adb0400a5f5a132801a46a28
SSDEEP

24576:yGH8p3jHtPDfrX5PqAD7INW61dfKejwbwu:Dg3jHxDtdq1dxwbwu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008a822c0d6f2537c863fb5ea143eb1dadde138ef9fd56ab52d2c549e7835ce174000000000e80000000020000200000008a3526059b8b80f64e16e0c553ba96f61da1aa8b0456fb1bf94d617ce4ae905590000000ef9b6de4cfe529e9443e6cf37d8ee3c8d9c7e25be8be3a7017b9d8121907c6ebba611e7ce38040feffa5bcdc941e900a37b2193cea345891679b81d26cba3f13643f4bfdf26f081dfbd8c2060d6bb192a06a4aa567aa2dc248d2942c6c2d05279f56e0c360da7e76606589d73d8f02374710f6aafaab417f920a1b844b9b6bbd9d2e77a531c1fd1b7d06f2a6da2af643400000009adcadd8b0036a3401747929a6d2b389ed525ffd0cdbeb5634ea8cff6f10f494fef5b64b2cba6aa50cf7046ffc038917d8721de99d52017934815de5c840ddf3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709c97f4429dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b1a7290a2a988e7e31332c4564e687f826a6038f6001c8358a38df1850a863bd000000000e800000000200002000000026d1832e67fb6efe0e98bf78a7ca9f7d1f390a470e754a4657d0c36fca1549b820000000ccfb838e5419fd9b50f8fcf720fead1c114bd48e0da380cfb2627830da77fb2a400000003855b74609486dcb56d95c161a133bc647ddd0870e9c21e26d4bc4332224f2610d4f0cb4c876fd215355bd1e6e5c57124ff0a9083e569cb05634b179730c17e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D14C0B1-0936-11EF-A499-62A279F6AF31} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2496	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2496	2000	iexplore.exe	28
PID 2000 wrote to memory of 2496	2000	iexplore.exe	28
PID 2000 wrote to memory of 2496	2000	iexplore.exe	28
PID 2000 wrote to memory of 2496	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Backupjobsummary-BankofGuam-DailyJobSummaryReport_2024-05-03-08-00-08.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cb4d21d35fdd0e0a3df6cb7b11208b4

SHA1
4cb22d06ff1027dacbab925fe6a4c9b919363cb6

SHA256
678fb0c97a43d95e3a77b430020b4736d365dd04e4ff881683df0f1c22ed9745

SHA512
b75934d39338f3c004420e5e0734f16bdcf62b9ef0557164c1a723ce9b3dc9ca366c0abb4cf60a214b18b82e00b947a36127e96b2ab572445bc72dc85ef2e0b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2595d8126353bf01ea55c53d562c93df

SHA1
b733e34874ab7e19cf2361de3352d0bc9454fb7d

SHA256
b2f5aaacbb77c972f7aa4f08b59404c7e088cea2d2ab6d051fa4d0b552c0becc

SHA512
f624f943ee89cf41c4949e6ef838889e44b1551a06f8d223aa04c64c7137ae4050cba38eb5aa0db7f7c367d8503523ac06c094da07fb1f454d2e06c1f6d5d5ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98e0fe72064ad16c206382f821a67119

SHA1
a73985aed212dc3f71b634bdcd7c05bb42f9052b

SHA256
432ccbc1e8f6083e5397f3a3647faa4d60e5caf0783ca0c7542d735b9e2975a2

SHA512
f97f609d8e1b793f718e5fc9ee52df7e39fab5e1246ed75b5db0691f8449feacf80a9408ffd454670c11b9ddb660f5582101888bb36e533638f19e8872d6b072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f71b4d1caa5e6d50e6dcdb33cc0c81f7

SHA1
435670383d970a5464b9e1d14ee94b4b85466dfe

SHA256
ccc5def39ca500c8822bbe69bba9eb8db09dce451f08ad3eabf9275a514b467c

SHA512
b7109d0656139881062470df824e4b0cd94f15349b6f8f7824a79321e30bb59e510458a0b981276d018e189193323010cfeeb6ba8f50a668f449d575ae396cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f766ac6bd658d621701eb23cf86a0c9

SHA1
51620ac8c9b1028e84177fa5cbe795d6883dcdff

SHA256
ddad3ef24d7f20c896c6901d73b29c6495e28a22d4c44866bd69653e3addbcd2

SHA512
187a97ac91416bb39db3a46689bdee9a6e6615d900586147ce4e6bbff90242aa92e27e7ddd8decd4e745954001fb5755973b411f87bdf8f96ea33271bfa4aeaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afbed02b32b780659a601422a87b10ca

SHA1
8bffa39d5d212bc0dab4f1f69aab0610a177a9c6

SHA256
a4f8d7da967eeb391fd37686d4bf799a146823c846ef96d1ee45089ed62bd26d

SHA512
e0e78baa61c3dbf4e50c2be14ead74cb6dad930aa061b92a3283c0df328c98ddcc5d3950ccf037becf9e4da139209ff7c451d717321d60b001e5ffff6c8eda58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3c211893a07e85108e304f5897cace

SHA1
0c1b23e3d7b9eaa83ddf552821bfc2db5ed02f74

SHA256
ac9a79dc1d40028fdf0ef6a834108f685ab2beacee875a80221ce34175753e15

SHA512
01390de14aa3e8d7d68ee3d4ae7d43f29499d10d0be0224a84d0304cf893a342a51252bb0be58fa38804d0f412286ba3e2a27ba79d567d63058ad4bd5d45f758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e396b5526718da62de712a9bd73eea0a

SHA1
5fb0aeca86a7abbb7a832124b7fbf48082baf4d4

SHA256
ea325f84794efc20c1d5753c56fec44a5df3c45fa8b120c1cf7fe03f196dc0d2

SHA512
7ba18099d07a06d10a1021817432a78df74e583a7895656e9f4dc14f573eecfde96d1ab7cb0f3b2ed62d16c5a4d2228a3b476fcf691a8505aa03c38654e8f790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08e7028ab7da66779a9efaab54839d45

SHA1
085a411ff13bc500cfbc886630172d9c0c6cb249

SHA256
f76be26f5a5cde2457ebf1abfca50911ad7b96748a2cef5af3b6ffe4509b43ef

SHA512
5d854da77705a8562e708146dbacf42876c746bc6f7f0efb4a0669b055291177b59c2aad18580b847e1ac0acf5cfb7f7055a5db78b973617b18080e7754c0fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BAA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C7E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit