hxxp://links[.]myittopics[.]com/redir/615ae06fa304ff7e69201b6f/eyJjIjoiMTE3YjZiODYzZTFiNDBkYWJkMTJkNzRhMDgyYWZlMzFmZjNlZmRkNyIsInNjIjoiNjE3YTU2YzA4YzQ3NjkwNWIwYzc4ZTNiIiwidSI6IjVkNzY1MzNhMzA2NWQ4NDQ0MTEwYjBkMiJ9/?_ze=test@test[.]com[.]sa&email=test@test[.]com[.]sa

General

Target

http://links.myittopics.com/redir/615ae06fa304ff7e69201b6f/eyJjIjoiMTE3YjZiODYzZTFiNDBkYWJkMTJkNzRhMDgyYWZlMzFmZjNlZmRkNyIsInNjIjoiNjE3YTU2YzA4YzQ3NjkwNWIwYzc4ZTNiIiwidSI6IjVkNzY1MzNhMzA2NWQ4NDQ0MTEwYjBkMiJ9/[email protected]&[email protected]

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "342813189"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb00000000020000000000106600000001000020000000f18ea58fd3e5b47934296f8a7faa8a35592c4af0a6a03b485c33a9037aab14f9000000000e8000000002000020000000a119e7f55997ed568b23355b8978dd56f52815a8e9644695574c392d32a7a47620000000aaab24310b0c350f18aed268ba56536b4afe87b40a95d391e3399d23b55d594540000000b26be01e90692ea241b1f14e4624f317993aa70fe23e9d4f8e60ffa43636d1c2bfc59973830e906e2ad17c48052951d2797a4e1a988ce9d78d3b7d4e9c8c90a5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62A991D2-400F-11EC-B8A2-DA737FEC8C9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "342845179"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "342796593"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0857ecc7dd1d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3140 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3140 iexplore.exe
3140 iexplore.exe
1716 IEXPLORE.EXE
1716 IEXPLORE.EXE
1716 IEXPLORE.EXE
1716 IEXPLORE.EXE

pid	process
3140	iexplore.exe

pid	process
3140	iexplore.exe
3140	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3140 wrote to memory of 1716	3140	iexplore.exe	IEXPLORE.EXE
PID 3140 wrote to memory of 1716	3140	iexplore.exe	IEXPLORE.EXE
PID 3140 wrote to memory of 1716	3140	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://links.myittopics.com/redir/615ae06fa304ff7e69201b6f/eyJjIjoiMTE3YjZiODYzZTFiNDBkYWJkMTJkNzRhMDgyYWZlMzFmZjNlZmRkNyIsInNjIjoiNjE3YTU2YzA4YzQ3NjkwNWIwYzc4ZTNiIiwidSI6IjVkNzY1MzNhMzA2NWQ4NDQ0MTEwYjBkMiJ9/[email protected]&[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3140 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\9EQYNKS8.cookie
MD5
6556874b88bb6b356f6ec801f65643d4

SHA1
1a3e6347f5f3c03e57ac3cb9eac32d3e44aeb887

SHA256
8d992d46bb90b9ad82e29fde5e30b051c52900ff47b603f3e3c8395deeda8210

SHA512
ee4bfb434d0da3fa159b2207b7c2a927cf3469127fbdaeff2c960093896a1b35cc2a3fc21481e7ddc958a352186cd8decacc26f3317b173845a9d16eb5487b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\TQMA27SR.cookie
MD5
9447812071f1aa5d8746badb8741e27d

SHA1
fecb71e9d4977c4bb9963be11051e79ce5fd487a

SHA256
50bc09c7788fb758209916ee56d8c3f3984f75bfcc381bca358ceb650b740b16

SHA512
4b9c9774cc14b1fd0d2cbb55976e47d145a07c10c423e737d176920c5a1f423768cbb80449811f5894df9fc6f1a56efc5b2677e187880fbdc9bc5f41855e8272

Download Submit
memory/1716-140-0x0000000000000000-mapping.dmp

Download
memory/3140-142-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-122-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-121-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-145-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-123-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-124-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-125-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-127-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-128-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-129-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-131-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-132-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-133-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-135-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-136-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-147-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-138-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-119-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-141-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-115-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-117-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-120-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-137-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-149-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-150-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-151-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-155-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-156-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-157-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-163-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-164-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-165-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-166-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-167-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-168-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-169-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-173-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-177-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-174-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-178-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-179-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-144-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download
memory/3140-116-0x00007FFB28450000-0x00007FFB284BB000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing