Overview
overview
1Static
static
URLScan
urlscan
1http://Automotion.io...
windows7-x64
1http://Automotion.io...
windows10-1703-x64
1http://Automotion.io...
windows10-2004-x64
1http://Automotion.io...
windows11-21h2-x64
http://Automotion.io...
android-10-x64
1http://Automotion.io...
android-11-x64
1http://Automotion.io...
android-9-x86
1http://Automotion.io...
macos-10.15-amd64
1http://Automotion.io...
debian-9-armhf
http://Automotion.io...
debian-9-mips
http://Automotion.io...
debian-9-mipsel
http://Automotion.io...
ubuntu-18.04-amd64
Analysis
-
max time kernel
1792s -
max time network
1616s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
11-08-2022 23:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Automotion.io/team
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
http://Automotion.io/team
Resource
win10-20220414-en
Behavioral task
behavioral3
Sample
http://Automotion.io/team
Resource
win10v2004-20220721-en
Behavioral task
behavioral4
Sample
http://Automotion.io/team
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
http://Automotion.io/team
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
http://Automotion.io/team
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
http://Automotion.io/team
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
http://Automotion.io/team
Resource
macos-20220504-en
Behavioral task
behavioral9
Sample
http://Automotion.io/team
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
http://Automotion.io/team
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
http://Automotion.io/team
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
http://Automotion.io/team
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
http://Automotion.io/team
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "367031844" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CB1A0C1-19DC-11ED-B1B7-6A95D25CEF73} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a78462851412500000000020000000000106600000001000020000000ea4d4676a7b3148de4df4b07fefc4f92baaafd7895c6f481a3853b36cae3839f000000000e80000000020000200000002e030e333fdd4314372c274212a584e30d030ec4210f812b73091386fd25c60d200000002c4b937643d2c3d55be8361b9594f6974a780433c3126b2a8270533fdfb769e14000000054fce56c649ee9ecf36da59a3f9f25a286904eed4a28e17fc3c7b1dae165a3686e3df567c5871a6112a55d4a646d23fc6a71c77c2662a5544b9ec97b4463ad03 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a784628514125000000000200000000001066000000010000200000000055d4e9b885a5bb238c8dc27942fc112ecff16c9cf7079a2cfd390ee066403e000000000e8000000002000020000000882f6162e505896fffeb6df5891a76d233e6f2bc4fbe8f3dae7d0835d60678d090000000ad4a7c53b98d710091f4cd87b8fdf02eee147a0bfacc374fe68653c7c4ef3ea576ef963fb8af220081ec5bae9ed8eba8b3a64a469e86c8cc675e153c75f4e7f8116f6a526aeac118cacd53110eff2418577cb73c14bf0971a8db61241aa9f1d587d3c973020ffe260beee5f7b282029f33f9c8a109b9a7d1f69da976e4b56b5d9471f01e6dd4672cfc9092aabbbb2bc6400000006ec2d064dd47281dbb3e30c8b00a5e50dfc1dd27bbf5c922db261c1eda21c0c91837feb291cbdaa9bd0c598dabc81b971dc293afa20e2f63589f5e7871a8d620 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805126fbe8add801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1968 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1968 iexplore.exe 1968 iexplore.exe 1812 IEXPLORE.EXE 1812 IEXPLORE.EXE 1812 IEXPLORE.EXE 1812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1968 wrote to memory of 1812 1968 iexplore.exe IEXPLORE.EXE PID 1968 wrote to memory of 1812 1968 iexplore.exe IEXPLORE.EXE PID 1968 wrote to memory of 1812 1968 iexplore.exe IEXPLORE.EXE PID 1968 wrote to memory of 1812 1968 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://Automotion.io/team1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5c8e107766d1c9c7dfa261cb3a854d3f9
SHA11539f9d7546c1460983251ad238be304e5ebc948
SHA256748dc6e1106def80307e6cd2eafe8b7fdc826824f71fe461090f90a18f598dcf
SHA512b11f8e6a561d0037d22a61ee1efde2c2949094277a6502551abd57f47753d78fe28e2f672641903927ff3350fc87194819d56f54a74ec4233c58f82620aadf94
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JO2SNJ3V.txtFilesize
603B
MD536f5d3389813f16c70fd6bb818b29c5a
SHA109466997b41020863fd5fcb136d82ab82bc38dc4
SHA256d49fea3d77b0a59c68631a8605b1768a257b7fab4603730c1a09d87d6854ea27
SHA512ecf9d5c9e85b9f9897cb68a81b5ea011b6407911119f41abc8f55581225108a6d63c84fc74845c68dffe6ea727c7d8b0d3908e72910267c3a7c92e89c666d5a6