hxxp://Automotion[.]io/team

General

Target

http://Automotion.io/team

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b3f231d8add801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cff55305f4fa06469f15df67a272305a000000000200000000001066000000010000200000001fb9deaeee5076078abce21a0dab3c8c7875e6c618de8731fd1a577840df1902000000000e8000000002000020000000415f1b3fca2571b13c00329e5dc0a68b3701ed6057ec1f1eed04cb7a081f04192000000073ca41f436e19bab1122914c2dcde6b1a46a6216000e3f179af4fa90ba9d380b40000000776f7a7b980d39e0521c46185e4851a02be9370dfcf1a6301e564b7f992236021b04c2375c77d22c2a1aca89846b1ee418d770097d3d9dde12bd4e27ddfd0e5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30977496"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "714086985"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "706273021"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "706273021"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54C62984-19CB-11ED-A12A-E67E346B296F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30977496"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30977496"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DOMStorage\godaddy.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "367073224"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DOMStorage\godaddy.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "367041234"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "367024638"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cff55305f4fa06469f15df67a272305a00000000020000000000106600000001000020000000250d298db43bed8cfa6a917a442f7032e885e0f8ab37c5e64902d62040f16889000000000e80000000020000200000002aa2dc5a9530e4441031374601d9e684cf093b4dd5928a850268284baf5fa5c5200000008604a2cee54a733d52db3ae6673111f3406a187bca2d5ff760100fb7aeb3bc93400000009ea95ee5f706b747e6d95299520d7829e76e6ec9ec26f79319ca5187b8af1e6cd02ec6d9b7a87f71966b110cfc0cd7b68f040ee3c10dc6858a79cd8b6cdbce54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "714086985"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10550332d8add801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30977496"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2664 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2664 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2664 iexplore.exe
2664 iexplore.exe
2900 IEXPLORE.EXE
2900 IEXPLORE.EXE
2900 IEXPLORE.EXE
2900 IEXPLORE.EXE

pid	process
2664	iexplore.exe

pid	process
2664	iexplore.exe

pid	process
2664	iexplore.exe
2664	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2664 wrote to memory of 2900	2664	iexplore.exe	IEXPLORE.EXE
PID 2664 wrote to memory of 2900	2664	iexplore.exe	IEXPLORE.EXE
PID 2664 wrote to memory of 2900	2664	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://Automotion.io/team
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
a96cf43a18e41a5813004bbff1c75cd9

SHA1
8c7de2e2dc64f38abfffaf839bd1f23fae175ae5

SHA256
8f748149620ef743fa23694045643e6cc456361ceb9d1283ba8be217a74e03b8

SHA512
a9e7b84eecb37221188d7fadf1da4ef5dcb86eafc41b2bbc19c6f818293243013e4fb3fcec1318c5d249f65b5bab0b74548e8f3ce5baf7468f66c10cc69dbee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
Filesize
1KB

MD5
58a65c47bd82612e98b4f665714e7ed0

SHA1
0915a6798e542ee2d784a4635e922e5ad9e065fa

SHA256
020ef3f27bd0d478648089e493fa13885d613d9b38f1b3294d176cee3d986af9

SHA512
2485bed4a6a5d931ee0946e1193ff1eb32a930e92494edcc71bf539d71b502913c87dcd7cb8cbcff0c953c9fe332d9f70d4c5823795f266fdbfc15416c04105e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
Filesize
1KB

MD5
85c02a3c067b855e4bef7d76e979f371

SHA1
366064a786ad228372c46a51ad5d28e20d279bfc

SHA256
5373ab9aa8745a448600ffa5506b38072b879a9cb3e01ac7bd0b293e079c1d39

SHA512
df719fd5a28596bc0d041ff731c65a36b403da7b9f3e6289d8678168effd5aaeeb1511ffaf0a9852667840c46da959a682a16f04a32a7885a422602ec1a5c8aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
9fc8bb8636846311d52e44a0bd09de9d

SHA1
aa8472e4d51dbd8e7c3b8968a8866dac6d300ad9

SHA256
8a8a0088b2c49a05f632a63ba6b2f2a6364cb90681220ecb127afd2f85d1262e

SHA512
257812238db4271acd5b56322dfd157ce2c8791589d988d32dc2b95189e6bc2a0cd47d8773fd7ed53508b6387c4c82c68dcd677d05d1bcb9a58186d572d5e7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
Filesize
466B

MD5
6fac7e60d9f25ce8c18b382d431ea56e

SHA1
1645403177a7dc53e8a24aad6067e705715644e3

SHA256
b69e2854954b549d7f3867d33d7925042a570c7668a36e64731cfbae02475447

SHA512
90bf39ac557d72afcfbd1d88f786fe9de8a56fd2afa12448d3a3e294158f97840a7f3f935bf28e05f3eff5fb1dac22f87ddeb866c44d3aa579a5a3c191fbf5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
Filesize
470B

MD5
bb7347cbf8f6e2f8a7d783636451f5bd

SHA1
a981a95a06dfebf2b475d4e2ae211fd8d1ec34d3

SHA256
094744b203aaa78232d974f109b2eefb7b934ac36821dd83aabef6e562027c8a

SHA512
5b852e26314820fac9d7db3a5196e7609d288a6a380af2b1bb90db4bef3aca09b83a28472985c8d07f40d2ad84005fa74980eb9fe983d9496811be727eb44050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\939TDORU.cookie
Filesize
615B

MD5
123289c0453901ebecc012879a5fbecf

SHA1
2904f1f4e018e26a9aa18c4b0189020d8d929505

SHA256
55e225cc112292ac669b4faf82929250ce6ff27fadf2a76e23232c06627fe864

SHA512
62fd3d3dae3a733342ca01e6de822196c77d08bf4e1f4907014686e7e9b0c95f6b3b7f13cd2cc6acb45640ba3aee80baaf58105b977c455ef31460f61c385b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\TVQ9S1SV.cookie
Filesize
615B

MD5
573d3f18361d9fd329285cae63c3c5d6

SHA1
b0920f47891431927ea5d6a79d2c6087b7a4c30b

SHA256
507a859cf78d16ab2fca997820be0f7f384c3b43f53bae1c06b81ba893feb244

SHA512
d32dcce960d9a2755a132175affd6f83a22dcca00868c04b4db3540547bb42434673aabdfe2724c0459a1797228acc4f0db7e16cd2f1272dbc70f8b0011dad92

Download Submit

Analysis

Sharing