hxxps://contatornew3[.]3utilities[.]com/p1[.]php

General

Target

https://contatornew3.3utilities.com/p1.php
Sample

210721-8gegcs23j2

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30899845"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099a58ecc861cd64b864e5f22b65ceb26000000000200000000001066000000010000200000007ffe7575453286d317d306fb1a974bc4a78f921192756cdad641e93f1dd8ab46000000000e80000000020000200000006bf316aff71a418fa95391ea1e02d6e257fa4fc7ca35d58683509cb4795fdea52000000015ddede86057accb68b7ec27821e010e5cf6653614e7e51577b6dd57966bdfcb40000000cc522957cf5452941297862c09aedbc6d8ba6cc074ecf9323688f60d76dd4fa9053c06a7bfe05a194f40b8ea74321c6e2423e196fd52c796429e9c5f8f9dfd39	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30899845"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3233680558"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30899845"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3267118812"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099a58ecc861cd64b864e5f22b65ceb2600000000020000000000106600000001000020000000bdde16d5d30c917946e0fae2e4b58871e69501229e96c6181c544a45ac7ebc97000000000e8000000002000020000000cc2fc92a73595e5f8284fcc7361680fa0c925a9f8a07da791f77448be1467d0920000000ab213199f8a057fea9456861a2ac87d4c8f6e575b15cb879582acfcc5dd38082400000002f41c696a5a8649806e73cffdc97f2764453c2f47f58e41f5859655cc40ba84340142f7ea16862a82cb5c166afd5ec8de4cc5df2ecc49257a0cf928fb188ecf0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01e28c5857ed701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3233836753"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3088ffc4857ed701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "333674090"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBC9EA61-EA78-11EB-B2DB-F2BB6A755CE6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4796 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid process

4796 iexplore.exe
4796 iexplore.exe
3392 IEXPLORE.EXE
3392 IEXPLORE.EXE
3392 IEXPLORE.EXE
3392 IEXPLORE.EXE
2292 firefox.exe

pid	process
4796	iexplore.exe

pid	process
4796	iexplore.exe
4796	iexplore.exe
3392	IEXPLORE.EXE
3392	IEXPLORE.EXE
3392	IEXPLORE.EXE
3392	IEXPLORE.EXE
2292	firefox.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4796 wrote to memory of 3392	4796	iexplore.exe	IEXPLORE.EXE
PID 4796 wrote to memory of 3392	4796	iexplore.exe	IEXPLORE.EXE
PID 4796 wrote to memory of 3392	4796	iexplore.exe	IEXPLORE.EXE
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 1672 wrote to memory of 2292	1672	firefox.exe	firefox.exe
PID 2292 wrote to memory of 396	2292	firefox.exe	firefox.exe
PID 2292 wrote to memory of 396	2292	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://contatornew3.3utilities.com/p1.php
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4796 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2292.0.2055034711\786400611" -parentBuildID 20200403170909 -prefsHandle 1508 -prefMapHandle 1500 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2292 "\\.\pipe\gecko-crash-server-pipe.2292" 1592 gpu
    3⤵
    PID:396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
4e64ee3a1f4c34f528e8de9b728dbca6

SHA1
9b27bb889cc2fe2fbb89c0c7c8aa16a841291499

SHA256
ec75d601fb9309c65a60ad6bd10b10c5927c77648d42de670003dc0b2693105b

SHA512
e23b06910c9009d254dba06b1fe8910d10fd0c11cf0ad22ebf21cf41765da0f51f9179eeb39ca7317cf3ccfcce01622914171ebb9e7c661373dbc92acf9676bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
3175246e6a694746934380e8b13dbaf5

SHA1
f3ee7a3da469bc0b02cbecdbfc7b30551e292abd

SHA256
8aaed3407514abf926e62bb1a869f05add46a72019f868d12aecc8ed4de45362

SHA512
b1e0140453f238ac845b9c2222225c5552950b7c0a779cf15cea72eef1e571004a2810c09e037ddeeeee7c01041c02b11e3f64e5c9262b398dee2196bea52161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\F7APRRHA.cookie

MD5
08a7155e4bf2d3f4b37381b520a37732

SHA1
6fc5647a9828dbf7be9af3034c558e670853675b

SHA256
e347035ede40f61b4364503c282ffd587643e4e724202fffaaef0a4ffb356066

SHA512
2bf2cacf91bd06a362219023ad0aad351a74ee408e55898b6e0562c4cdae8b96a1f99b9aad86ebbe10d9226a4835adeba9f18a961cba3b72cbe90ad8f361c52b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\X81A2QRJ.cookie

MD5
2c7ad1b5c4166a2f919d39c1721e63b7

SHA1
acff578a489e6cee185d67027afebbea50d7dcff

SHA256
58c616d4af106490bfca0f0e365503a9adac10c40c85f8a90501d72a9b07602e

SHA512
a5ee65dfd5d8986c000999e966231fca62d51bd703fe72fefd53752168f53dad4d4492048b462dd76738211fc04542c990412cc94278be4c4e8a7b65f6e17320

Download Submit
memory/396-348-0x0000000000000000-mapping.dmp

Download
memory/2292-118-0x0000000000000000-mapping.dmp

Download
memory/3392-115-0x0000000000000000-mapping.dmp

Download
memory/4796-114-0x00007FFDA1F80000-0x00007FFDA1FEB000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads