hxxps://08863299[.]sso-secure-mail0454etr[.]pages[.]dev/?emailtoken=test@mobily[.]com[.]sa&domain=mobily[.]com[.]sa

General

Target

https://08863299.sso-secure-mail0454etr.pages.dev/[email protected]&domain=mobily.com.sa
Sample

210929-d8zjlsdfbm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4152846478"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30913763"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913763"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913763"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000be9a20f183dcec3a95741bbdfcbd46cd31dce3b086e0b56cfd0e510c1b459b42000000000e8000000002000020000000b734198755c84a417392ccf769c9ec68766c00c55a7efec79e6e513cacc13b88300100000480113554b2baec58028400762b105ac382350b8b2e9a14c36f5fa308a480c2971fa297a5990bdc894a1f36dbe4cc256e135785498f995a262b5448be010409444d5d66e3dbb87e081b299d6e41c381873b99d8efcb0187116129e635f1bfd990a42d7901a8841972713dd596bc01d97b6244900a55bf0681cf7b8099b9e30237ca94abedad9b98de207d34ca94318e6a07cf63f71bcdcc06a2204d977f06b0fb18d7822b1143b33492985b339ba3e3bbec84823202090762445b45aa2e0af01377ff364aaeda678e0f2cec04786dcc2ed55f6f5a6f034e5c4195bb4a3d68880cfb1e228f03d156b694c682f5f499e40c11a191df4dab4875360c503043342443e198b590d4aaa48fb51e3eb2a7519332165798ae2969d1aa546420add3370142abf68acd08c32c2fccf33dd9bca149400000003ff2b49912c654fb62140a56f0a4ca0644e532f1e6a871ebe567efb08d836da6be8c471b4f20b17b6e322ddea79430f390835e728448ae093897ec1f567d39d8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000008dc41c7fa6e34da0787553497c8f3efbd5f0e85e7d7832812558a1141dda0c44000000000e80000000020000200000001516afc0973de98b3a695c00b1550bdfa971f396fc8e9f242255232b21b76dfd20000000211e9d810e24e668e45f4f809ef1506d04f13a3e0a25b66a6a1e051add5a4d8b4000000096512e32c9d5f5433a0528fe4212a5f4bf84e3168e3b86886354b2f26d690e5daf9127167bd2acd9cd33df9acbb4f716b1f796e657e6b3dc25e51a98eb4cdd2b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000bfd7607ac3c1b39d14cf680e34c333e60eb2e03caa821bc5d04dd57bab737afa000000000e80000000020000200000008f139321bc58819fa4a88de96a4dcad2ae4eb490fd9d64edfd7ac152e504861430010000b2a909d083d7cf0fa47c3a9a1a6ee1d1a7f6fb3251bd93ebf64c75ba1b5d1d9340bc84d76e60d3cf59ee0b6fd83d969a2f00cf5dafa03b55305433ec83939c3c73837b604b6f71b8b63aa7b753ae71f954e77f22ef6ffe43194dfd47378a46350e9794c3e729e06763cbf97397bafe631dd75fe99731304b53282f113986de2a7c7bd0d2a5b66d8b9b146f49f93c2e5b73991a296c59b0b458f6c68e3c97d88556f5a38335984769cf415e84fb0a20475c3623805866f5e8f9cf038067f7503862b43dda600ec920345f38f8a20c151b4d3cdae44cbcdabe9ba22d9db1feaa72dbac4e1a08035fa11800d92324470a5722578b25515f47e1e9dd50f94d0769e648dd6408cbbe64375bf3c77a3576aac36b6723914433b0d2f720dae4430c94a01374dd2ff2fc154ad10f8f236444be54400000004528092545678f7527e0322c68eb4b6ab01becf0112a9a85c5adb374a7436ebcb75dd93853eb7b0c1b89ee852a2815741963d8222deec0e725a46a291b244e51	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4152846478"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22D6699C-20D7-11EC-AF2E-4208BF05CDF7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4159097298"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a2e1f5e3b4d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2060 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2060 iexplore.exe
2060 iexplore.exe
2424 IEXPLORE.EXE
2424 IEXPLORE.EXE
2424 IEXPLORE.EXE
2424 IEXPLORE.EXE

pid	process
2060	iexplore.exe

pid	process
2060	iexplore.exe
2060	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2060 wrote to memory of 2424	2060	iexplore.exe	IEXPLORE.EXE
PID 2060 wrote to memory of 2424	2060	iexplore.exe	IEXPLORE.EXE
PID 2060 wrote to memory of 2424	2060	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://08863299.sso-secure-mail0454etr.pages.dev/[email protected]&domain=mobily.com.sa
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
f4b3b7008b0621c6ae9191147cc92e32

SHA1
e0505be068610401787b76fd081568d8d40b711a

SHA256
509865bccbfb3719690d1b4a3d7acdeced5b4906c67fb2c1ae0d9caec3074d0a

SHA512
7eb75cc871fce15f8496d78f9c27541439f2ed5ca1dbf9737d47e0a7a198ef91a21cb666bd2dd26171466abbdd4cef6109fb76d523782e57d382641c1db1b9b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
7d0c6bc661659858a4aecbf79e7c2c9c

SHA1
67e3791ec51fcf1cf7fa8ff3d404266b3f9b4301

SHA256
92b4114b5c423fda069592f6675fed5947280306bb67165572926b7cbfb694c6

SHA512
9560a8d0f1f1573ddef839bdcea8c5ed8c7b1095fd430cf4915ea1e3a2c916f51c150da5991ec9a99c73a806a4ec2c412699f28e6a8e8d9bd9cc6c0e73ae9228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
70e071e859956d4aa1071d9bdef4ef49

SHA1
3463e035590257c11cb3608b128bf0ed362c64f7

SHA256
ed6fac9f862436556ac4971d9e8d03329a946bdfbcea3f6f64a1a1579669ae98

SHA512
f2c0914395d115457e0bc2f0f8fd169b68dfd88ef29017b9d2c1a9bf8e5dc3a41436ed1412e198069c61d9dd1aa4c17f05953e6f3e02cd7106f8db7c293f3079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
80b30d6b85d788fe09704668eb2a7599

SHA1
5fd7607c6853ee173149865e92b0159008d20742

SHA256
63b788e335c6626c00975cbe6414237762698613a334ad6edc716711f062a3ad

SHA512
ead5f7cb4e2c55366ac24a426e29fcfa4761728427084be2a6eb3083ed0bb025e633833f5904a6893f81674f7dd555970184dba4061e09fe4ebb7afef94e5ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QT2UOKDP\KZ5D7YFR.htm
MD5
286ec32a447b0ea3404c4c3df32dcd03

SHA1
910fba7d799a881ccef82f0656ef07f5f9cd984b

SHA256
236c077bc71571633689df6780986079654f1b450c332f5de3d25eb5ef40e9b8

SHA512
5f58f5e4d50c2f112b4871b65e221495ab765bd9ab574e178397faa4b555fdabebc877897b31a792279851f0b2814fc2f37180dbcdf4a3a1f3c2988e20661f88

Download Submit
memory/2060-115-0x00007FFEC6500000-0x00007FFEC656B000-memory.dmp

Filesize
428KB

Download
memory/2424-116-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing