hxxp://20[.]7[.]14[.]99/server/

General

Target

http://20.7.14.99/server/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 30a1630a15bdd801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c0000000002000000000010660000000100002000000053e936600aed32a7100ce61291756f16a67ed49280acd7f3ef83010d4a7a19cc000000000e8000000002000020000000b2eac222c4264e93565c0a73a4467ca143f20054f2affcbb6f5ca1c6c94906c120000000b98a3ce0fcac79cfe24b69ea228ea14aa60c8c699d191e06a639f51077df4e4d400000000d4a2e0ac118d87f6b9f234c2909dbbda73d39fdd44db3fdd411f6f3b92ab414ba0a1267cb1b40c536e8837fb2a662723d828391ab09059dfebe9661264f37e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fdb21315bdd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000aa39db6fc3950c74b17c5491b16b7c34738b9823c44ff947e0c8e44e246bfdd8000000000e80000000020000200000005425afec2dedd67ee700859b199f12a94cc2a909885dd5616b615eac4cd0d6b590000000d5976cf0f745d2748e89bcabf5d03e435d204c4eaa2a9da1cd308b3353f55ace4b600d532b30c5da3ecfd9bd6ef431a8848942c0a880715fc3b9005b61f89da30d576136ae471c5751b4cfd1b154eb8848027e6457b32dddd160f4d409dc07bec7ac619d80cb91d1889726e2309d69856b4549c663888ca7080895b4705ffc8b834a91dfd75966b1051d770b4b1a66574000000012c7a132848786cab0ba73ffa4650c99006d8755d512d92900d9735e4193bfd4397dc6aa8f0461edf8af33684ff1ad416be42759b5119d0274f3fbf0e27fa310	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "368700052"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34A291E1-2908-11ED-AF6B-DA7E66F9F45D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

564 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

564 vlc.exe
Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

iexplore.exevlc.exe

pid process

1976 iexplore.exe
1976 iexplore.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

vlc.exe

pid process

564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
564 vlc.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXEvlc.exe

pid process

1976 iexplore.exe
1976 iexplore.exe
1272 IEXPLORE.EXE
1272 IEXPLORE.EXE
1272 IEXPLORE.EXE
1272 IEXPLORE.EXE
564 vlc.exe

pid	process
564	vlc.exe

pid	process
564	vlc.exe

pid	process
1976	iexplore.exe
1976	iexplore.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe

pid	process
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe
564	vlc.exe

pid	process
1976	iexplore.exe
1976	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
564	vlc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1976 wrote to memory of 1272	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 1272	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 1272	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 1272	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 564	1976	iexplore.exe	vlc.exe
PID 1976 wrote to memory of 564	1976	iexplore.exe	vlc.exe
PID 1976 wrote to memory of 564	1976	iexplore.exe	vlc.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://20.7.14.99/server/
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\njrat.mp4"
2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1evexod\imagestore.dat
Filesize
34KB

MD5
56e55c8119ca9f71297506e9a5ac730f

SHA1
bcebe05b564919153eb5d59f9c032f71f4835f52

SHA256
39724f61abe5f29f8fc7a22e7b5b4ece7eb34557da36f752b39aef7ea9d10540

SHA512
182d91a5f6e2d2e156c1ea20d9bece9da1213142be0fedc676bd102a64580140e55fe7555c1c480ffe9718ac603640fc4d1da7767987744bef3ab188c0ac3cd8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5U4ZPOH5.txt
Filesize
601B

MD5
50aaaa526777974d94d3ba968c1ac1e3

SHA1
d81d104134c1198ffb7bb6046df874b6dd186d75

SHA256
c800f2b70c925686734bb72dd73388adfdc0c9d89619dad9f695df4ab55849c4

SHA512
9f6e73b55283492cd0af25f87562a25d87d7d58ea144aa6a0b27397c5d4eff89f39a02f39c89c2bf5df3169606a85401a138f3dba35389d0edd44c36ed693f63

Download Submit
C:\Users\Admin\Downloads\njrat.mp4.yvf7e9v.partial
Filesize
42KB

MD5
1814573dd0c6f90c941b786a3271e33e

SHA1
4d5b9efdacaa0b54ff44b537b57a864575f0a6c9

SHA256
f856403c55eec0fe9eb24472b76e7d9b620c5299bc14142af2f20f0e68af4103

SHA512
8c2213ab7251b66217ac45f93490b2db7330366c90aa8c896cbf9494c27038e4c8c4c1354b2cef49089df0a1c12af0120e706b2999c8bc853267c2b19f3acfa7

Download Submit
memory/564-56-0x0000000000000000-mapping.dmp

Download
memory/564-57-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads