8aba45c9d744c4ad0000281a3c1e6cc309a5ab2b1aa1634e6daecb7d23427996

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoneyOrderSvc.html
Size

5KB
MD5

2b5822e79bc920855456df78f08c054b
SHA1

a1e6fcb985f1b251042f62845e32684b334e5761
SHA256

8aba45c9d744c4ad0000281a3c1e6cc309a5ab2b1aa1634e6daecb7d23427996
SHA512

befd99a94cf35bce2cbc4f392ab163ac9f0d997e4fb1159f9ba9e5f8a801660864d3c17fa4921ab553d38de9a3c41a010ad99f86ea7936f31c0c3f4582bcc87b
SSDEEP

96:oSTJBHBJDJgJLJpcJhCJz+aCJzkvJd1JzUJcJzLJgLZPlXQqxZ/54Rr7a6aOFKwS:oSFNVM9OAOUdDs4JAZd7vupjn4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED7977C1-1A96-11EF-92E0-EA483E0BCDAF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422803968"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071f74f7678286640a46cceaa337dbc4d00000000020000000000106600000001000020000000ec202ec5143663b39f62815ef917afd6b9ffd2a00188d251e9d0564447c37d20000000000e800000000200002000000013714fe253091550dff1cdf1c1da6e9e1fb920fea02b85c0910200a803fb64dd20000000b7d14767868d32bf8c5cfaf54d21179aa897ea23216d4c3290245180ec407a374000000028d72ab362765bc31cf23ecd4fcf4b0579ad6d7303ed5c1bab67fb7bb49b516ce9157feb22a62151717f140f641f86d2e5dea939ed3aaaafc07708e59a30131b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071f74f7678286640a46cceaa337dbc4d000000000200000000001066000000010000200000006395c1c19ae78a5ff75379aa91510df8348886e1af15529b0eab5eacdf79261a000000000e8000000002000020000000fae35eccc02ee23e5ddd7328cffc3adebc1a95ae6ab5955e6bfcd0eb19ccb142900000003af1798bcf02ae99c64f5cd9b4e9ffa5e4bf67423d1f9c65241fa858466fb75396e16fb556cee5088a70180429b2d99bfb2d041732f095a089d4ef014108a81559bee67d5e438f7bedbb2f991bf3c5a079215b8e9ddfca4a2b2a7eeaa28c1f1f7ef183c183fc3d04664b7a128adf499312b393f9682ceee977a04d4e7f834aa5aacad9dda4b91b2252944afd32cde04e400000004d6d6b4cc567200fb5a0e91b1a24a097b06b61999f93c82f45cbceecdb3468660844696972bf98e8c99cfd1375f89f9d9953aa316dd69e178dd5011faa5da03b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e1ecc1a3aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2916	1712	iexplore.exe	28
PID 1712 wrote to memory of 2916	1712	iexplore.exe	28
PID 1712 wrote to memory of 2916	1712	iexplore.exe	28
PID 1712 wrote to memory of 2916	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\MoneyOrderSvc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
217b969eefcbfaa92fac13074fe0a62e

SHA1
46a9a1442625bccf95bfc7f84775f035f58427e2

SHA256
5e063ae3d2698eb2f1417642b6dab7a164aab47690c5df19f5126da8f1a45ab4

SHA512
cd74885b402441cdd2a9a7967604f1e29502032a4239a4af9898a5198c3c7d63bf2373fecb14f0adfa66412ff6893d73fa8c7cc3228b726eafd931075d5c169d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88b05f929eb83a69bf332f0d6c7923d7

SHA1
280f46764d2daf6dc53ce048b4011b83f98cb846

SHA256
b9f635a496a2ec5b89f0bb9af234d82870dfc3c8bb43bdbbc82b1be78c4bf0d5

SHA512
5483340552772132073ac5ceaf32b44ebef87f9bf229725d367e2b29c2afdf0c0711ee3aef59b66c0334be53d5055d465f7cd4426c333f2d65964d4330861979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21e3c0d517da55f64e42c7a6562d0bc1

SHA1
f1dfb200a16d2af1ab0d3d1f15962e23c0583979

SHA256
46528caae7d3920bb6eebfcfbbbde7185892eb769ffe8fc804836823939b0645

SHA512
a9f57d485489ab2a45aa4969a1c11f0207d13b221bba5d8799d5fd7a00a709c7afdf4f67540df20b587a9fdd59633ff2efae33805867308df4b91d57286052ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10ac2e4b3865c9f66c877114c12fa229

SHA1
53b6685d0375f76473eaf4b0f8463cacc4dd4b95

SHA256
efe243f67bed795e2f63bc93576509bb46ae6b164d42da8024320bb6da558af4

SHA512
9e44da827ec9fcb08d578d07697090170b2bb7ef3b2c51bc886b3806a0a475d452a98b6f8d04bf3e3835d6dc1095b9ef83be2e7417183eaa1070892a46e27fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
623fa6fc13de6c78d6515ba83e8127b3

SHA1
1b98706975945e47ccaddf7b428dd969743bdc61

SHA256
4182b348f58088013f3a4e68a2222b116fffa5e2bbd69154f19973c24eb5c1a1

SHA512
d10e705a5b646bd2c1b77a5cc567c2f37dab02108fb91308428fe3e20b111c69e1dab17989e65d2f81bf0f4797b53fdca1fe0ff02e6d872b281eb27efc71eaa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc7209a6f337fcbc96d58ed47056610

SHA1
b4a21876b4647c4d7c6d67817959929991212ae4

SHA256
84df0dd35d97a36ee38b7c9d5cb81f7b6be002b1e10ac4c387e67b93aa554316

SHA512
617d2bdbc3e8aa51d9c81e4b99b9699bc3c108018fd028a687dc99e865e7a8bb9b2e26c7cc90f526f974f28e4c2603c33cf6a615ce1988cf1191ff5d095e8579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8012bdc6ae15f45b6e24818c6bea8d39

SHA1
4b087be06a9a411b1637e01d9ccd9cf5780f7144

SHA256
21e7b33a6ac117b959b2d426bde85f5c74b077e795b7c4dc89c8bbd7a1f47ea3

SHA512
287329ea2f0f033edf2e606f6c89ef5fb2a91aeaa500b5dd30ff3b8a4583e08f62e2cf4db6a4810aa11c00ef2ba95a756bc9cef654a0b47ec82713ef1263b6d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9ced1726944f569f815a0c025f5a766

SHA1
1d508d62eb53b795b9d3fdb63ecc07c6345f71cb

SHA256
ab622443d604178193d8f007644b07825d8306b698e3f8fbdc068ef425df7033

SHA512
cd192c691fde3f3def4708e4372c29c43167291907f676bdf7be374db7c74787b64c9ea64eb1d78d3fba57f59547d650099d258501c47e985e9eb8f92cdf684e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43debaba83e3b87f14b6e47c75f80393

SHA1
7d1d348f38aa62b05efa5a131f3c54899f5a3efd

SHA256
466726d724750459d7818d77492b14aad2c871ca10f6b877b1fc27a2610ac715

SHA512
544f64e3cee084fe10d547c7fcd70834d1113113d46ec850b99bd3771b9ed5827dcd18c22dbc98115855e8e1d63780928ce1986ab603d7f09e71a77768f10823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3dd2fccfe53d1dcc69ba05e74135206

SHA1
af3eeb60ea4b3d76cbb7e1161f657ed54b537a3e

SHA256
7f2bdb60535f6cc6d9674765424999c085380f0308e3b57b3499c5a9e8a5211e

SHA512
44426c2005c853a53a4d41f82a2b484c633565818add27345bdaeee3d908fd4398cc23ccb4f532e99dbfcf35b1744c46b44210242d1b7685e42aacf4d5f6dd4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb3c5506f6233bfe03619b5c4e1bd93

SHA1
c1de89ddcd9750e3cab7587370becf4bb4b11244

SHA256
b3c0e01f65ff04548e4a6054a78197e5c89c36d8ae98f2bed3686bccf2dcf189

SHA512
f71956ddd5fcf1cfb346148e64f0e1b399e74d3d18d742b9c1f451e36822118751754476729338b69192137ab08d90b3caa5ec35027d233fde92f262a7e97b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f389646677e218ab54850004b2cefa7a

SHA1
d4acbdf61fb0bbb762aaa24a406c953ed9d99519

SHA256
8ef54b4b3caba52e5bb02883bb32d74b41e0af78974fdba42e014be0527c8797

SHA512
2b786ea6945cfe2fa6190094c5a44ed1f49521aaf619219c99ddcebff3d54c580ffe59ee7787cb33fafd5ba96171c801cc341697045f3fc29f24c2e0d3d37f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3565.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A1E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit