c963cb5adb198fbdaebb940f816d135596264d03de0be61de00d0bd1cb204c93

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Mono/Monaco/Monaco.html
Size

6KB
MD5

999896134bd43cefa865f37e514ba62f
SHA1

97077125bb36ba072e30f2ec68f80ae213f76b84
SHA256

1ecdd9529ef5487f92736894d94ff680f6c32ee821615d29c0fc814f3a310b4a
SHA512

6af01d1c9d4212e25fc35e9ae0730538f01b3d62cd904fec90077030ede5b07af952388e57927f3518895580b95263c70372f791a247572da657e70bf8c3ab47
SSDEEP

192:wEod3PorvFhAmQp5keghKcCI2MCTJ3+NLSaPh/WCY/jt:ud3PonBw5keghHwjt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BE4F931-4060-11EF-B707-6AA0EDE5A32F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000044587fb9b635be840b6fcd95f1e929f2013461048dd2086e93bf90d8268b24e5000000000e80000000020000200000006ff8ac0f045a98b4f52a2fa59f7ebf278c92eb49f63598dab36789dab8f8f6912000000076768e217642ad7cbb5ba1bfe55facf94db9a6f6280a0e56753cb1ba4475648b400000000314075aea6c9c626027089e956ffd559b005d74f977d87cf1ec1ed4635e0b09aabb4c6a178d937c62cba105dfa5f82e3d9d0e051202b55a95d9f9624e4967b9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00fecc206dd4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000d910c51342edc99ec193d89bd09337d087a3f4b20f8f076bb2b7f9e655aa51b7000000000e8000000002000020000000e9299246fdd02c02e3c201c2a16d64c8341706daca170e02a97acd9554893f68900000000b2618300f393f8965463e08b6406b70e0dcb8cc05cc3de24a8658a099d96958459a53616c0e945252b0aa79a536c776a343cd90657d468d7fb45ab547720c566a7ee6e5cc9271ee4e32395aaf9727bba38c771bd813941e9ed0b0e535e8d3b809b9ec967eb7eef15b399559d13cb4a9bc8c01390fbb3640f4bda3779bc245161f0b0a8f785e20c129304b3a5ced4b8840000000ba1db1a23c91694ae45b3aba9b1d262397c6d93ca52a2b0b790b3e254ce5259299b1594f9d82de1289505cace9dc8149211c5934b6578425d892f024bc1ab86e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426958647"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2532	2428	iexplore.exe	31
PID 2428 wrote to memory of 2532	2428	iexplore.exe	31
PID 2428 wrote to memory of 2532	2428	iexplore.exe	31
PID 2428 wrote to memory of 2532	2428	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Mono\Monaco\Monaco.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcabf581fb4d648e54d81e665aec3b92

SHA1
80cd2a9ad891a6bc56a75399733153493a5af6fa

SHA256
bf9f4b0b8e5897be00bdf4d8fdfcbe17b99b409f2fce1121d8bb73ce43a53d52

SHA512
fbfa94f00779a0a0ebaeee2a799003e2ce7c15e360b66e5e492dd216976b5700685fc5ac53761e352f161918fc953c6d62c31274bc72d3d6ad9094c67a2af703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef2fc4f3ef64c7f1f8550f876331d5bf

SHA1
e69419f5303b19981c6a795e97c104fffd0b7e60

SHA256
2afbc6d8a46adf97b7ee03ca2df1ccb654f9400efbf588c656def51eed35486a

SHA512
20e2abab7ec9c006f3561433fd38d28d0d2a21ec7ae03719b3fe22aa010531ac099d7acc6a338592e23097d91a295a429dc7d55363b2ad28dbd6f01ed3e2754e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280d8766af5c03b26457cc35d706afcd

SHA1
7d1f68300a58e2fc6e7e4a1682f8d88808f94d59

SHA256
d9a657f24d645ef32dee1e04c4f3afe9e738b7e9c2744d6e54747e29f900fb23

SHA512
a8e338d4aa865e3aebd6c8090d4105552d76d194e8ec3b700b8205ccc16b7b2cb8fa0a31deb12607cda54632fc5231e06c9dcf697c3954e9ca1ee3e088255331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
475a7db793db87a8dd56cc11655503a1

SHA1
60d55e3f212b2968312d2d0f7578bfb0205f58b2

SHA256
4e287fda978a65a314ae200a4f06fde380a6cd9480f3b0ed919396cfc6a58df6

SHA512
d1e93a4fa3950078e46c773af22a24199a3fa350a5a41cd864ab0ad6517dde0d2053758e8a1993df1bd232d50d2169498647c878528cb54a58dacb243975a607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
736ef4f370bbb7acbf2ef16297dc03a4

SHA1
8d7c2251eebb288f67a9d9ba6fac1aa4185b6252

SHA256
68da83687c068e084a9e41e31959069fdd16ae0bf1d6d69ac1961f71aead88f0

SHA512
f966aca61bfadff9a11fd0b21a55466033e21ea41b6a56b11286a1eb4625b2400a06b1a23a49bf26b08e7e9fb48c8ac9934ba7067e6498ac165914d6582e0de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38bb417514c88e17f81d7232791dff8b

SHA1
cdcd56159433542c4f82528598c2dfd68bc52b39

SHA256
972f7e5d87f7829607845131e11bfb54c089ca6fafa113db166766a24973e046

SHA512
9325148d5844bd4a29e14d7c93c20ab16d2442af4273d89d1f6349be4eeb36f0fc9a5a333135358f6a832320c2f8e78e353aedec3fa36eb26ae4782a3e5a4644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ed7a11397150f34def27317d9f78c5a

SHA1
867ba815191b2390b6447f273368f0a74f1d7d7e

SHA256
b38e2ef265ec637a75933e32f56550d66efdd5c535e38cb5ab058868257bc33c

SHA512
7845a3dcab39498abb00c5f2b01dbd9c0ca3e655d54868c6feea55d4d9c829a8124268a585713e1abd7ebbabb844eb3c427b77b777f62533eeef1a3ded287742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f62fbaf173387efa485a8cbbbefc1501

SHA1
c84c53f60ec9ea11d7a4d50ad24b800de3a6ee40

SHA256
940f57c7e35b884afb88e35c834256271d1b7170b308e2bf7a1623836b3287d4

SHA512
185287e1474ef67ef541ccc3a87d1abe3a1269f2bf6d0922d844a2df7336e7f978ce8afdc56a0dd020fe57f111d42d53fcb4961bc74153b0ea4a87f28634cd25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d64278e127db5fe030b4eaff239279

SHA1
9065bd36fc273121d12c6db5457da3732d21cc5b

SHA256
2c4175aac05cee8848659f36c36fbbba49fc23697d30a6085e6acbfdca229b25

SHA512
e03ae2da1fc8e09db2509d3e2df34e8dd1d8a66594dfca08171aaef88870999a6960c4acb9e335690acf44ca64b89f11a9cabd22f12783144146381e09f89fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7f0c49a799fa02bee366eda028b9a01

SHA1
38984b84b2d5c23cde19083d95ffa068f01eb419

SHA256
6548b418d587724d3b451e559c60b934ecb466f55189aea557828ffb8d7f365a

SHA512
d9e01938d53ec56067b19279f7696c1ca2343e514646ea7c73157495f3a5033a9af19ffa759a2951044551d9a99d0b4e2c1ab6a7dd6599bf1e69c048b3a0c41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97ad7b64bbee3d35cd8dbfce2057b9c3

SHA1
99de138da3c8d0eced8393832c4728cd1797586c

SHA256
0555359dbc44cd5600ef0e01cf7f47db5bff811a754a207cea67dab03676f1bf

SHA512
dd0b7b35db4a03fa63c00d59910c75e49d43dc417f92cf7de78a76209b3ecf9d46eb1b61a43044d2745b4745ca6a0c45f6c0133a8cfd75a19cd97c962ddd415d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
001e843217e0f40081286eb44389e2f1

SHA1
5e135a27fa7c5909868f9a42f0dab579a3f5f06e

SHA256
5f2e23efbb5f01fbced8ed3eb38be0e5d5e320ce1e3a09f9744d467fa7cb45eb

SHA512
fd7d38725489ae2d49d0c163bc421b96ff03f8b83ea4926d3f0e42e20e067bfc4fe4c90400934c1c34d45f07c99a172e94c01ee590245be01976e98b086aabe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0a5ddf8d0af2a7e5775be0b3bbb2890

SHA1
dce18265bbf46c2989a72037ea903c0e8cd1a3be

SHA256
bd717a58b2554550ae471ca805d49d9acc282043112e45cdd87aa33806781026

SHA512
29af44c2f3a7ef50bd70136b6e6891d5ea56879f7a4da36d5c96d892afa674007a48853ed959b360b477b90047bc8dc871a6eb5377e608199f82b86d5d9031f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0ab1e5201bcebcd1933754246ef1824

SHA1
43c13ac559b0e93a1693a3cfe2387c054423f4b8

SHA256
9df52ebdbd0c333a04d58b08f8af6dab1dad51835d94196509a1c44a24b497bc

SHA512
c27ee6076fa4629a792efdd282a3ed0916334a8df5f5d499969b9552c657463b6bb1aef50fae6eaebabb2c2048bb5ced92a9624dbc0aec1ab7864957522c040f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
504047843ba5e5932b12a632ccd3b078

SHA1
24a37c14d6a9f9052143ecbd77ecde38bdbbbdde

SHA256
1f4234a4e0e0159068ee87f6003fbe80bc9014cd287e79df8231c612655cffa5

SHA512
f4419ad31179ebcdc88c0b8b554053fabee42aac26c17eaeb3c535bed389f96b8d1aa93a3dc50c71ea973513fc9fb57691596287ffca52cee61aa5f205838658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7f565111fc4be40652a76e55f66891b

SHA1
baade407f905b05f9022f379a444380908d283bf

SHA256
ba58a26d2340cb5e19b9cc6678b5e30861e8b06f6b1a45c5dbcd7752c56b6cee

SHA512
bf5a9b70457d7f5d88f2839b449468098bd6b826fdde455c37bd3cf86efda5b163cb84c83d1a6a8fca112dd99c129e8737bccc942263eb0ff8cbd7397106f87f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFA87.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFAE8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit