hxxps://samahluarpijamas[.]com[.]br/BDO/[.]=www[.]online[.]bdo[.]com[.]ph/sso/login[.]php

General

Target

https://samahluarpijamas.com.br/BDO/.=www.online.bdo.com.ph/sso/login.php
Sample

211005-qpz29aabgq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3F9725D-25F0-11EC-B2DB-EA801B2465EB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3082108efdb9d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2313571182"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30915069"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000084d01ca041451340b522347e88388a0700000000020000000000106600000001000020000000e35d6189f38ff0f8577be2907ca69220da223501fb3bab6465501fb1d71714d2000000000e800000000200002000000095e365de4c761f18791168fe1c78c8f3258d56477a613f730b1cbe26bfe0153120000000aa506fa45b6b2764beb893eb6e2b655115f8b3c628dbfd0fe2aa6d7f1999607c4000000034edbe04f6deec6d90b6ae79e60c8ce86c8177603b3e75e5567eec4182ba3a85e00171cde8642c64d752d714c15678891382e9915cae81228d6938195dd67658	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30915069"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340212608"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000084d01ca041451340b522347e88388a0700000000020000000000106600000001000020000000a6d8f6e39cee3b28ed1c7725c495e9784c959f357f88cefdec753f63623d7046000000000e800000000200002000000078c031ab1e3dfa1fffe6f43055d726a66907171113da51d18442afa31293efd3200000000153735225a6833ec94c37176d1cbf99df176bb041dd315ed7f1c04fc4b1d01640000000f493ed1d91e5b9a26dd34ea7417a50efd1db7364f4d03ea468681ec5289bfa72880a2deea668808c6b60b505af041178c8fe3cc9641c198d477a6047e457f7a2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000084d01ca041451340b522347e88388a0700000000020000000000106600000001000020000000d38d9357521781b8984018076169183b6e891dfe81a9a52581ee6d163d6a6973000000000e80000000020000200000004d26c92c6486f4b8dc3dcdb8f62ed6ab0886dca9c1bac920c861bb995bd9eb1a2000000025887aee7ce8b351bd7e5f4ef366ec58046a9954e78184911f331353146902df4000000082b4d11afc26c5a8cb7d6e1401f1860f9d68331731b824791c1d5611417caae9990d067757e407f27a7196f37d7ea3a62538e68bc8b9297587c826a771101c80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2313571182"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340261193"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\IntelliForms\AskUser = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2345134908"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340229202"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03195a2fdb9d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30915069"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e483affdb9d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

996 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

652 iexplore.exe

pid	process
996	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	process
652	iexplore.exe
652	iexplore.exe
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 652 wrote to memory of 996	652	iexplore.exe	IEXPLORE.EXE
PID 652 wrote to memory of 996	652	iexplore.exe	IEXPLORE.EXE
PID 652 wrote to memory of 996	652	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://samahluarpijamas.com.br/BDO/.=www.online.bdo.com.ph/sso/login.php
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:652

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:652 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
54e9306f95f32e50ccd58af19753d929

SHA1
eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

SHA256
45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

SHA512
8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
e64027b6bd9cb0655f7ac4d9354d78a1

SHA1
3a423294dc15027e91a97aa64ef63da18b5a3ae5

SHA256
22b8344fe9220b65a322c4700f62235d9d355d010e67c5bfadc141b715c607fe

SHA512
211987792895e0410985d59ba60e0c0fa41d031fb36061123da14480c5008685596ca15104d68d5ec7ae0363e21a02db51b2ec0d37fee9f2a7219d60cd095c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F3C6C7E8B179283545ABDBBD0E815F32
MD5
773067866d6d8be51590869d46847d01

SHA1
aae27d9f398f85edacb6437f11eb237c4f032568

SHA256
8c9786a647400f230645c78a7a37e32551c593d0e0ec7d0545256a3f59b6c535

SHA512
0aba971c7fdc18c20603986db35908c783e491721d7078573fa4badd3c7c246d064bcc47522f564728dcb9b45ba18081742dbfc6cb9dcc44adc8b6652a72a8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
dc4371b3e09456a8d09040dba4f5ee61

SHA1
55783ad806442a929ac54d877a443d01cabd8352

SHA256
ae3b5618fb84987fb105407fd2b17b21f7348babdaffd53a4a67f48fe200f37e

SHA512
aaf66361b9133bf98679e67b54e71d91e59aab7bde03e3a5612789ece7e434ad4aafbfeabecb3d429d6019b014ada580fc15f204cdf0b86d5a00771c7f6eaac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
2048388227f74b496730350bab859492

SHA1
1e35a29b2b5021fc18894169997ff95d24c47157

SHA256
1cc8e1259d10ced5d5578629f7431804d5e6fbce0e055d7a8a3070a67d3a0765

SHA512
36c2d7aa4af25265cf0f84435a0f4fbfe342696d0c143396b7c9171a4d15475d02ff6c945c91bedcba93cf109e72c16a33dbc5a62f20e969c44f28518770399c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F3C6C7E8B179283545ABDBBD0E815F32
MD5
76a2958471c873cdd4d1917a1ca70163

SHA1
66946c338a7048e13094dfcbcb9c5f42cd5cae63

SHA256
f32f75d67da8a1dc2d0af250850bfaabf83f1caec068276eff57456061529738

SHA512
1039c990273b2a4d024985521d69c2ec72c72c42c9baf22541a9c1d4ec19f46009dde26827496a927341255c46eac64ceddfefe1ec76eed1027b4f24bc44fe89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WU0YCW67.cookie
MD5
935161996a3ec0485dc537e0610ea05e

SHA1
44e5d3ca2d633fa3e4bf3f05992d0367dec61656

SHA256
184f5e122afd0dea89c6ddaf55f08155a577a8bd733b84851cbe022da75ee3eb

SHA512
f87b1afcef83455b98ea89651bbe5dd47cfa937f746a54f67bf5bb129982b0d13d34bb18c53865fce5780f9ff97bb733e23a9f271a99ec6072de2a1f7cbf4d34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ZQVEXNJH.cookie
MD5
d215aeca6a8527dcbacd894ec7631df5

SHA1
913c0fbeb6f36f5ac4f5fa2fa058fd520ff27ef1

SHA256
14d11e6fa1b68da7d91fd848b301b77a0acd0b776d167934091089bdcb1cecbe

SHA512
92c4a0eb51011e3166e77133b051776736668d390b86468edbe730d9fe7443b6b911d1fe38c2eb7727472ef83843ae0f4fbd54ca83fb9c76b7fdf312ae7b1925

Download Submit
memory/652-114-0x00007FFD272D0000-0x00007FFD2733B000-memory.dmp

Filesize
428KB

Download
memory/996-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads