hxxps://campaign-statistics[.]com/link_click/wRiWTVBH5m_rOaAw/d443a605972ffb67e79d0c4ae8a49f6e

General

Target

https://campaign-statistics.com/link_click/wRiWTVBH5m_rOaAw/d443a605972ffb67e79d0c4ae8a49f6e

Score

5^/10

whatsapp phishing

Malware Config

Signatures

Detected potential entity reuse from brand whatsapp.
phishing whatsapp

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000ae4fee351318db6d76a85e8dc259a80a3009e408a7958a6846a7a2845796f1ed000000000e8000000002000020000000e7d7f1a708c3560ce449730d3e7fd660e3d502865c174a47b7b6c1aefb1779f12000000077c0ed9c6d9a4ab0ee30fda0216dae9425b876c52437ce8257de3678bf61e0ff4000000058c0d73b85394d7973a3c2bb327d367508bafab26758f8cb721ff2acec693a2074b4e60914da2092622a3eccc7810a4c550b937c4f88bf9d002bdb0c0c52d6f1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce10000000002000000000010660000000100002000000007b8adce2f1e6808c8ae4339ed42ea9cbe0d71e18ea2b7501b5fc6642fbc1a7f000000000e8000000002000020000000d089d650909c2e31a3fbd0e5a2c1f0a207db8a4b3e969a30c4261c20d767649420000000a6970cd02f2aa911256c6e8cbb196cdf9a40acb20ece0b255c703bd07d7393434000000050fc11b3bd5085311b3428b2ad9c543cea94faababe0c6d841ad3a2cf1f40ff9cf7ee3ef8160b5e13d7ef924622b1ef0b2ac4c6c19898a4e77657fffbac58395	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359134428"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1233182752"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30959125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e057fc7f1566d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30959125"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e28c811566d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7A212C3F-D208-11EC-AD90-FA63415F8E77} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30959125"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1363964090"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d32e831566d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1233182752"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce10000000002000000000010660000000100002000000074814bf84ac0475615f60700538da2d53b6e3d95dec2538e8466111544c66a00000000000e8000000002000020000000103d69170a950d98db19e568e5333b6450657a8edc85c2c31995c62a4a3b31bc200000003b6b5206522cb00e622c8c9c6469fbdfecd401e1b8c8f202c9e40bb9c4f519b440000000200dfcf420f40cdf8bdc4f14cfc80cac4d29eb98520837c8174ac08a9b45b5b827c501ea6132266212749b219ec035f3df38a58e9a841ce562c43377e5dd4540	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE

Modifies registry class 1 IoCs

Processes:

iexplore.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings iexplore.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

iexplore.exe

pid process

3968 iexplore.exe
3968 iexplore.exe
3968 iexplore.exe
3968 iexplore.exe
3968 iexplore.exe
3968 iexplore.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

3720 OpenWith.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3968 iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	iexplore.exe

pid	process
3720	OpenWith.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

iexplore.exeIEXPLORE.EXEOpenWith.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
3968	iexplore.exe
3968	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
3720	OpenWith.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE
4312	IEXPLORE.EXE
4312	IEXPLORE.EXE
4312	IEXPLORE.EXE
4312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3968 wrote to memory of 1416	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 1416	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 1416	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 936	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 936	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 936	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 4312	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 4312	3968	iexplore.exe	IEXPLORE.EXE
PID 3968 wrote to memory of 4312	3968	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://campaign-statistics.com/link_click/wRiWTVBH5m_rOaAw/d443a605972ffb67e79d0c4ae8a49f6e
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3968 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3968 CREDAT:17414 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3968 CREDAT:148484 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_E52792650B3F2B5D290136B51796D30D
Filesize
471B

MD5
499431269ac5818daa8f25403ea4c1a1

SHA1
736eb2381275922556ae301795f142d06732ef64

SHA256
fd8de187c822d153d0230f3de8903feee93bafeb9b0f6d87b4985b764292a893

SHA512
413bb4f91abb2e45fb6683bc3aa9645e75bf959fa1d132447777ce0aaf026112fa5b9a04280c8634f6a17756670fdf8270c1f9829562a462aea028988ff2b349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
Filesize
471B

MD5
8cba9ed5a8445ff44ac21fa3b49a1c8c

SHA1
1638b7e12aa4cc0fc313d8e8bd2372d15be3515c

SHA256
987ef07679503b44c2750318036a6c6c8c99a2552dd1b145ab4c42b0cb985f21

SHA512
ee101b388351714df2c6efb3f84078acc63a6b5a1269ba25ade699f9ac0fb29b270853a3b90ff5980b6c013aa4ddaa935919433af93e9fe8238aeec928766012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_E52792650B3F2B5D290136B51796D30D
Filesize
446B

MD5
55388ba7dd3eb021a7628131bd803fe5

SHA1
3d7c74f8d2691750fc31291690c6e796e9a26903

SHA256
a21d614aef6dd556d2e4541f06828ca5791371876d00b3db82a7d09de2a74ea5

SHA512
7658f92baac67305ad5d6101eb96f43a082f35855111121249812c3a9ab678bd514b6c9d050da2ad511f4e08bcb6a50b611c583c3e594854e92a81373d1cf481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
Filesize
396B

MD5
f9ccbd534fe424efb6fe92cecb4a9659

SHA1
14a36b8b1acafb9b8172263cffcef3866f4c31ec

SHA256
995e4954304ee5c31ec86deb6fbec859284f47d8d7fce4c9b1d54216dc30803a

SHA512
ef04928ecb78b5cbf84cf2f7e34b683d64ff5fe4ac526ab57ae8e95c1e36856a8f913edb738525e496858a2d6406f2e94183b9168917036224fa7c41b386e1fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
935B

MD5
4df8eb1e66908df12848106e2da957fb

SHA1
2e75dfff5eae1f67c01a129c625efa021ea68f4f

SHA256
af313591686674fd86e48d45f9a1fc5b4aeea90c00477af1a3aa72b30d0ec2ad

SHA512
fe2b5a0f7651e8457cbd33d7da224365f4c8a0cbcf8627f9c11d1bcdfa95b23a0af84075fa59285d97e67df4078f79472f64bf474c27dc059b349172072fc301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
1KB

MD5
9df9837d79ee9e39f41bf9cb6726fd08

SHA1
86e447df5ded393da6cef03e92e661fa4dd130d5

SHA256
9ab88fcbd8e75458964b04fb3403b4c082afa188469c3892eced76732c9433bc

SHA512
8ea047c1767faf2d083cf666a45a229b563d3d1fecc56c23c9a6c3a4e3148169b14118c88b28a8d9a7f59231df0c77700c3310f97c59a398ff4165a07a1808ae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads