https://www.diariamenteali.com/

General
Target

https://www.diariamenteali.com/

Filesize

N/A

Completed

08-04-2021 07:26

Score
1 /10
Malware Config
Signatures 4

Filter: none

Defense Evasion
  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbariexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d073cfab592cd701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPUiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetupiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c3cb43f365fb3743be16f670c0665c6100000000020000000000106600000001000020000000c736a6d5265c4ae73e8061fb588f46f58fa43386d1b55e00ab12237e5e8f05ea000000000e8000000002000020000000ba246f6e038dd36422aed4908584369a9ea3f696d3f3c0e2678f725784a4a85920000000d0b218a800d8cea6d72b6f1f92e27e5df52e1c504549ed45906c126214a54edd400000003d706b8d7bf79101b49e142b8b29c4f8749cda97fca3d0b68dbc0167aff315decb00084924f48105c210b53f0379b735176105b8a79653ec26a150c6970d7f38iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowseriexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D28C44A1-984C-11EB-824D-DA78EDA9FF87} = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoomiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c3cb43f365fb3743be16f670c0665c6100000000020000000000106600000001000020000000a2abbb92402277005e550c5681012b0d4e3894c3ee16213758845fd1e7c8143f000000000e80000000020000200000002b46c0e42295ca9afc740e3e7885894176955bf2a511f167949a9c6c4defdbd1900000009a59602dfd5fcecb342f174d64c66cc7e0c93204ba6ffee6b79339119ea8dc9d0c1fe0bf036d3e9f198d443d37d6d7fe17754f7dcd41302cb1c4b7986bd491d54b37d1a640f159db0ee4e9feffbd0ce36db260b333886204225a7688d117ab14cb9e7c6b17c01020c3eca78ee59fe584f554e40a2ec91d72de48e0b1b5a721001b9a9acb9263cde74ac80238cd692e284000000062f7a92d64f74ebb7acc44897103eafb10fe15281b7dcf1e6596fc64031330b29da3986562b03da57a971514ae92bf3adbacae82b36c7c9cc5bd703a7294bb9aiexplore.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exe

    Reported IOCs

    pidprocess
    1656iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    1656iexplore.exe
    1656iexplore.exe
    740IEXPLORE.EXE
    740IEXPLORE.EXE
    740IEXPLORE.EXE
    740IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    iexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1656 wrote to memory of 7401656iexplore.exeIEXPLORE.EXE
    PID 1656 wrote to memory of 7401656iexplore.exeIEXPLORE.EXE
    PID 1656 wrote to memory of 7401656iexplore.exeIEXPLORE.EXE
    PID 1656 wrote to memory of 7401656iexplore.exeIEXPLORE.EXE
Processes 2
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.diariamenteali.com/
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:740
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/740-4-0x0000000000000000-mapping.dmp

                        • memory/1656-2-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

                        • memory/2044-3-0x000007FEF7BD0000-0x000007FEF7E4A000-memory.dmp