5b0b785a327765c2e9da85c7c9ceb28ee4a4abb881b43a1b277d24c35fff67d9

Resubmissions

15-07-2024 09:22

240715-lbyvtasbrg 1

15-07-2024 08:51

240715-kr61pa1cpb 1

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FAX-MT104-INV37738T839Sterlingcheck.htm
Size

1KB
MD5

88ace5fabbf97aeda0ce9f3edffff23d
SHA1

576bb900d8c82a995de2b6fe0c0fbaca04c74a0b
SHA256

5b0b785a327765c2e9da85c7c9ceb28ee4a4abb881b43a1b277d24c35fff67d9
SHA512

b6ee4aad9bc5d4e2b2aa52a2a8cec6afb5af329b25f37ad5bc1e674cae22fb4684116461e8186f01ea72793e7cd9fd911a1fa49ca5463cb7f6eb01e997a345be

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BECC5BF1-428B-11EF-A533-F296DB73ED53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c3f39398d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c37f1f96936351ac15e173ca33e44a853ea5743c26533b71fbcb2a21662af420000000000e80000000020000200000005b41e7c7fcac36ef40babd9a170f7f9b9c1fd61790826f7dab14a77ac0dbfa2420000000e8f5fb3298cc9ac5913f09adc2edae87734eb09af03b6e50807a899ecf8302e940000000379d94df550679a2cc90b6500b6b18d90affc09a31b41b53b556d1e909a13b9097e216780581fc470dd633d43cfe249540498b0c1e7193bd446b0956f1506987	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427197214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000703592975c07d0b00392539a8eed79b8566bf8a7500b1fcaaf54467d6d71d762000000000e800000000200002000000016e0bd134053c2eec495b92c5c6bacbef965bbce116b5890957621ef7884fa83900000001fbe54a856834c763de729c28095466f58466814a57726ee5753d3aa891b025a3d2c88ffcdb317f13878a98172ef2fdc0ccd188eea7a456412dee03f56a4bffbc20e50d595a93be85147356cd51c00992f6c0e7913ea5805414aa336c6626a15281acb59a9e9608535e8ad280eea324dcba0e00311d7d5ee44cb7bf83bc356dacea1f545b14f968623f43ee021600aeb40000000db5dba91fad0158379c5614feead0a9366ed64285b305a28c774f562dbd6b79d3473d81c2df0f44419959bee055822dc2f64768a6d94caf0bfdbbc3df9fce802	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2740	2684	iexplore.exe	30
PID 2684 wrote to memory of 2740	2684	iexplore.exe	30
PID 2684 wrote to memory of 2740	2684	iexplore.exe	30
PID 2684 wrote to memory of 2740	2684	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FAX-MT104-INV37738T839Sterlingcheck.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c27e2d52f2398af762e96e96095d041f

SHA1
1243c5b8de5c48bbbcef85ae9ae78446825f756d

SHA256
205e683dffd508ef2088c2fb505e080318abac33bff8a6118263d2f0feb5637b

SHA512
6ec1c382b225dafe553c2679110536daf16f59769c051145bbb1999799c130960d190e3f7efb5e988e82c861e2c115eb590a0e1fd3886ca9356382b182e724b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c035bcfdf28dde58142a7c69ff6af8e6

SHA1
44a81876c2718342b2ed30cb418e6b6c67f0d68e

SHA256
74d6c2d25ca14712f601d978e4a6791c1fd7189d1bfb10394bacfe104e9c6dc2

SHA512
8382d8e1354c09b6e11b3df5005f32e8f4cf5d3105d1afd7264437f26e6194aa7652a2badeaa26b6f96e311615710ca4419aa0ff4bf1256637e4449c6ba6646c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e2f31b416a0d88cbb1acd6af1ae181d

SHA1
a97ddf058429f3a5aa403ba46c5e7524c391a101

SHA256
60aa378ef6e16d91ededda791a20ed13780858a0806fa326c5a60b8000e79225

SHA512
efadfa360d1ae7ebf81b913944070880a20c868c4fd017046ee34bf216d337a33493c860100777794b4de7c3cc3fe9468cd2efeb44b09c0a04866ca3069f6b4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05655719705803d15760c6c5ae847973

SHA1
420667edd5a0b064d16f208480f37711ee70457a

SHA256
5ebd25fad193a6d1c1fe0e5808d0322848fee04804fe845fbefe5f89650ea21d

SHA512
6c10f32a8ffd54ce8a64ec0c1ecc60ca83373047949fbfe28682c55c53c9d3cd169a1dcae56f69c4ab1a5cf8c51b218fc7624f29adf3ec6c57d28f6f025d894d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8ecc005e212b611600bc445747432cd

SHA1
603c4fa08ea2e227f5a447eb67736087823d1e74

SHA256
6952235e465cbffc48500fc0c416324b5de1fa973dfee90b0412f2435146011e

SHA512
1426762a9f56dbd6ae632ca92bbd049a98c8d2010ab7b85761c847557485150137b4927a82f5418cc6c50e735be1f566bdd06d8c4e2faaafb2e0c532fd483d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ce6ec4f3fe858fa253b43fc37e1326a

SHA1
b61c8b7901a2e543db61539d1df5e18860f9ec58

SHA256
8c02d73dfc88f37527f1017a78b2a39d23a65ac4c9aa440a682966949d71fc0b

SHA512
63e80a26fd7d40ee617f6a402a55009a75f666bb7fedb8bc42f3a18a35f384e2ee7886e34aeba8a58c89d60c257e09129e1e85d403aed90ecfbd80bc4ca273a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39425c6c9561817878292bd2d9e5ff17

SHA1
8fb5e9857074532787582e9d55b118e7e55a9396

SHA256
957e572ccfb183de4f1bb1a131c414acf8bb15ffeb881107909379f7c3cea2ae

SHA512
0e4bb4af74bac2c7686971c13f89c69fd83776fe0fb7d17d5f15d12e0b161bcf6e626b8262b00fc1eb9fd5306ceec03cd849760c72209e4ad9334ca3ad332dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7152d8b1fbf1b3f4d0a3c3218d12c178

SHA1
8b2d5ad70711d19694d1b0f84441cb98da6dab72

SHA256
9b9fce331b5a1f80351eede3b4c432f6e9cfdba7b76522aa97f477ed8bc2ac98

SHA512
aba992ac858e93e5caddfcc52e8f613ae2df339beb4d0050a742f1bf991ff48bdb2cf1f270f0d95cb88027078fd28c474d74eec626ae76b3fe889c50ceb7ccd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db1b60ff2c88195ccd493f9fe17d1bdd

SHA1
429c415070f12ff802f760e6feb43f04c58a43fc

SHA256
ab51a641619177b9d5110311c6e2fb3d729584c6bc84e13625caadd3f0626056

SHA512
3c7d2e02c73a55a424a4d8d63fae1e965b9943d4f9af8f18c63d9455ac63c8fd7ecfeaaca5e73e2ce69e65e1000ff5adfb151fe953ff61015e757363484b4b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21dbc74bd374725f27f93691f252bd8a

SHA1
94f392a61982ff65f09ecdd3144171264c8eae58

SHA256
d35099d458432314d53416bbd5ef81f9960029a32e60fe69b6526c3bc465fa55

SHA512
3b3a63f0fb9ea82fec2072bf56a7b1f7a07356f5d0dc0e16bb03277e31d5ef395798713af2895cd2e261ef5d9e28d38a9638271ec4339da9edce12cee7fc419c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97150cbeca97aae2dbc9b3eea0c924f5

SHA1
85dca0617c74e3a370bb0a049a2c8c7b50566120

SHA256
5b243926d50850bdcce81175508e7738817d62f8b3075dafe0f898b43dcd5e66

SHA512
65da58bb698fc3041f6a9588ebe696a8d8c534d99b4ca89cf4823f8512036f0c490dbeb4f3a047b6815e731f51c940f00ac2f7edebd7760f1b56b827c2d37237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b991da0fadedfaf90ddfc98ba408ef6c

SHA1
df375ce23dd1be69ba8b8e94df2a18b794a1b601

SHA256
d81030aa30fea59f9680522c45509352e9bbc4b8067c2441e66fb6268d04db06

SHA512
503508f1021195a3ad790132cb4df0c659e88b03a1857a459c8c5e2e73bb883bbb634f0d4645c45c322a708ecd4db22d27bd4c8b5571a6b772c69235f92ed70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d165b6de603d101e79bcda9ec4d1a10f

SHA1
ba5abc41052160a162b30f302c526885aa61ea34

SHA256
c45f5934244957da93f487ba833f025346221800bed68fe099592997b6c0c704

SHA512
db68eb893ebcea20e0e5cc93838902b6a2786bff47a1ad3aecf57272750941376308d7456d71c53be985eb377d781d9da8046208fd00dd1a118bdce4f1d51363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01cafb61240f4f86d6fada43dc3e007b

SHA1
7f3c7e82270ba4bc86545eaea275f367ef0baa4f

SHA256
0b2490e402460dd8f019e8909f852d136dad330f53fcc33774b9a21978206d97

SHA512
a909504ed365882ec9e74528d78bed0c2041c098a3080c2b4f894b3fe863a7a9553c9ec4fac8cb606546810ac1520a9477153ff6dbd6cdae0a22bca5596569da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c9f5006301522c954afef292e12cbf7

SHA1
592f7dee4ed1b7f366a1328182c1cd4b02d6ec2c

SHA256
25a8cb4aa04e1084a0aabe7189d1500733c5b0a873f250c558a10db08ee8f2a6

SHA512
2092d2aa58d570839f1a3a1e513e7030e98bc6ec1916368121a930ff0bf5af22cba8f438f95cce0148247dd0dff968c5b10042d8256ed1885f3c2e96e7fa2de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eff7e1ba0743744d65c6cd6521f84916

SHA1
e8d54716fe4f0e8013c243434ee70b4d9e7e8f95

SHA256
c4d8947dae1846809dec7640b32d727b2ec5e8a250a5634da89ba3ef036ed848

SHA512
d3c836b4b0a07ed1278017277eceb06a138f04974acd7caeeb500ebb408094e2f1a1d569b8c25d5dec1b63f4a1f581961e078a5affbf605017a3a00e7d70c1cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4c239b900ca459b06f7d48e6c3ee939

SHA1
1efe0cdfddb80676bd101b1a68560c566ad64710

SHA256
e55a28320fc41d373e8a01bd3d7599127e10edae275c5cba35bcbef512429ada

SHA512
39249ccd5c59b3085585d780947f583537867788258e54dfccd8b0dda0b2a91afa1d301919183203c65598e2f8fb084b464b9fefdac0d8c80409394c76acfc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5860.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit