hxxps://determined-merkle[.]178-128-198-133[.]plesk[.]page/124/csc/?email=user@domain[.]com[.]ph

General

Target

https://determined-merkle.178-128-198-133.plesk.page/124/csc/?email=user@domain.com.ph
Sample

211025-sh4szahbgr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30919693"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000005f54fec57a80b432ef6323d8b9613f1429e8104ba28a7f1cad20e77230f07613000000000e8000000002000020000000f4f019f2b18b99f06671a54d0fc80ca2afd5a0c4aae9c0a6b48ab20f52d8d88d20000000d2287e8c5060f8812fe2f9f04b01e6d3684f944ddb5b17fa56c79e8bbb02fa9e40000000487a70e81717a6f83c9edf6fc4a93e9a862597309823a7999110eafa7754e85d02c819c7c7154a26df6778ab28c6c904994b9bc507c784ec93f78b19745c6d94	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0018a9d10dccd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30919693"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30919693"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "342247296"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3425794021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000005010df38928982e6d478f5770c0e91f2552975a1ae737c4fd400b04c84e30a35000000000e800000000200002000000040993d67b7236152dc14e8fbd45db4edcdce4c7aa2a553c9c0bb0190e1a3ab5420000000cca7044c6f7cbbe612e6adcbd4ebdcda13830076d2b4cb7098aab0495d2b63df400000002d24c5c925f23b9ab92c25df9e76dc4ff53aeb0dd0c361db9880f6f40e987e9b626ecff886b2d2d26e0b3f849932bdb44887113b78aab901c964228ed63f3b30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3425794021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3440325296"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "342198711"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6F71691-3800-11EC-AF2E-4208BF05CDF7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "342215305"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05bcad10dccd701	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3048 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3048 iexplore.exe
3048 iexplore.exe
3944 IEXPLORE.EXE
3944 IEXPLORE.EXE
3944 IEXPLORE.EXE
3944 IEXPLORE.EXE

pid	process
3048	iexplore.exe

pid	process
3048	iexplore.exe
3048	iexplore.exe
3944	IEXPLORE.EXE
3944	IEXPLORE.EXE
3944	IEXPLORE.EXE
3944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3048 wrote to memory of 3944	3048	iexplore.exe	IEXPLORE.EXE
PID 3048 wrote to memory of 3944	3048	iexplore.exe	IEXPLORE.EXE
PID 3048 wrote to memory of 3944	3048	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://determined-merkle.178-128-198-133.plesk.page/124/csc/?email=user@domain.com.ph
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
e630c11543a0c1cdb641c29134f90306

SHA1
de6f14b6eafe2525e2262fcd11e3ec72cc35aaee

SHA256
01ce91b38c5f6f73d99a3dafcf47484265fe784983130196a2a00b92ead1ccde

SHA512
80ed41c9efe8e66aa3efe2946e44c224cd9c363e2187f549ee8a8e75809a6dd6ee7b7a1811ad9fce26b2479b032fd4c45d06c473f310384e30cd4998e0c01b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
ccb891f2e4ed3b343b05e770faaa65f7

SHA1
dafa056fd62bb531d9b65886419a2b96faf17f06

SHA256
a431a84e33172fb9b6f7452516b565f6f751a76f7ddcba2e7af18affd00a9fb0

SHA512
6cd9965a2560b8f5b8c66b35afc46f7fa87d2992c4f1e512217513eda088d0f738cd87171ea939505986c3606706d762c3178cdbb12add95ea95a26b2e8cf7e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HBPS4WXS\favicons[1].png
MD5
3ca64f83fdcf25135d87e08af65e68c9

SHA1
b82d0979d555bd137b33c15021129e06cbeea59a

SHA256
2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947

SHA512
7675a8c4e6146e62dda019340ef95e477aa3d14364b5a773114ea1110c38233f5d8d9b08f6c83bf7664b33695aac7254b25d727a15ea6a9ded2ec9d1ea07dc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\IQWJNSZR.cookie
MD5
4e35683a55c03bdb8966529de4f92646

SHA1
b82c3c25ccb07c415893075020cb52d680315a5c

SHA256
563fc1e2eeac0b51ff46ac5f0e79a6870595badb2cc1843c22f4ac1baf08843d

SHA512
1d9ed15869afadbd598e2dde9f6b6fdeea3f579819e54e79749f93f3960c5764a4fb116dea07c7fd49bc2fbe5660a263cbd68cfbd7b9a0427ca395aea843d766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\K3BRQ1IB.cookie
MD5
78c64e85137c810866c9ca8774f65146

SHA1
e46016e6fe5a9b225ebe7dbc6eb92abb2728e4ad

SHA256
9ed881fb70091a6942d328b79d66dfe89fc55df58568e2478de8964a725097cb

SHA512
a10d9ccb589734840705c8b8558d4b036bca2ac5415d3089d5202322365debea1e13d02541770c951bf3474af6c66f2353c7bfe5cfcca118619971060f37310f

Download Submit
memory/3048-167-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-124-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-122-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-149-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-125-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-127-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-128-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-129-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-131-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-132-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-147-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-136-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-150-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-137-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-138-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-141-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-142-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-144-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-145-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-116-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-134-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-123-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-135-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-151-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-155-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-156-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-157-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-163-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-164-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-165-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-166-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-115-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-168-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-121-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-170-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-174-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-175-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-178-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-179-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-180-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-120-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-119-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3048-117-0x00007FFEC8750000-0x00007FFEC87BB000-memory.dmp

Filesize
428KB

Download
memory/3944-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing