hxxp://mobilejump[.]mobi

Resubmissions

13/09/2022, 14:38

220913-rzygvafgh6 1

13/09/2022, 14:27

220913-rsreysfgf7 1

Analysis

max time kernel
139s
max time network
222s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
13/09/2022, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mobilejump.mobi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3609164263"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30984077"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30fc5bd98dc7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0288D698-3381-11ED-98FA-F2C43DE0E5E5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "369868039"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "369851445"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "369900031"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3618383677"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000742693025ef6ab4aa9808eab4c23bc9a00000000020000000000106600000001000020000000035cd4496287cfb41df8b98343ab327dff3cdf5a795420715a79a7d5554efc3e000000000e80000000020000200000008b351f02565035897eb053d719f73fa0f26734bbdcffa333ac0e1f98106ef34220000000dd61648b3b0aba1b14d9e9eaea7434d1517d93b9d51305be466cbc0444274c2d40000000803dbb0a5dcca8850844132d47268738b58415772029ced674222583b2984d4c16520fa1cf6589e3a848d512dc62d9cff26523334894de7a49a99daac65e5a2e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30984077"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301a57d98dc7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000742693025ef6ab4aa9808eab4c23bc9a00000000020000000000106600000001000020000000d5bd41f89395c7f452af37ac9bf6666410c9ff834d6cf06ea1996f67f53fff89000000000e8000000002000020000000083c9ecdf7c0c704a31546aef715feff2690993bc1071ea61d0580ee94ea32e9200000002b2daa6d3e819a362c748b49b976f2cea130f58aaacd7c3e3343ee305bdb2a5a40000000316f73d344c45fbbf1b99eef4f4536c0ee25b67cefb15c39663e7d1b15bd804a767aa3f2184e2cc00a4e98877d38bf07d81d515de2267f7acf1b976f29518222	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3609164263"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30984077"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4872	iexplore.exe
4872	iexplore.exe
4012	IEXPLORE.EXE
4012	IEXPLORE.EXE
4012	IEXPLORE.EXE
4012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4012	4872	iexplore.exe	66
PID 4872 wrote to memory of 4012	4872	iexplore.exe	66
PID 4872 wrote to memory of 4012	4872	iexplore.exe	66

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://mobilejump.mobi
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4872 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
300B

MD5
bf034518c3427206cc85465dc2e296e5

SHA1
ef3d8f548ad3c26e08fa41f2a74e68707cfc3d3a

SHA256
e5da797df9533a2fcae7a6aa79f2b9872c8f227dd1c901c91014c7a9fa82ff7e

SHA512
c307eaf605bd02e03f25b58fa38ff8e59f4fb5672ef6cb5270c8bdb004bca56e47450777bfb7662797ffb18ab409cde66df4536510bc5a435cc945e662bddb78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
e2f801ed2060ec1e524a22dc90253bfa

SHA1
c034d16f7336bf36a27d04d33e3bdc08e5eb5043

SHA256
2af23b59f601caf27504de53a1d3193a4bdcebf2cb8f2f99b205d69d2c18cfe2

SHA512
c3421e084fc0652fc538cbbc8723585ae1d59260ca643ed906fbcef1b826433ac5a883fa181bd119406cc55bdcc1f29120dce2f0ccbb55637f6cefddd32b6f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DB426D82CC0124EE9B3324E43739F722

Filesize
345B

MD5
3170d6e83828bddc0f2492d31a462e78

SHA1
dea28ba41b1c11bd5d3d985bc6afaef187a7f5ea

SHA256
ee2f4851f1ed2e562173abd09bbda85b8f346718e206f78a219273c7a4f5ce2d

SHA512
ea9ad492523ca99e4e83ed27953cad5baa29315ee71a47b95fa2fd836f3593f95be797a8bd02938bbee8a7f999dacc8b3993a4990f2ac9214ed5e0d121df9796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
2e4a4d622e5c636796492fcac91b6976

SHA1
e2d370514490bf4dcf8d4a2118730175806b0258

SHA256
1b74e4015365baa9cca9cba892f638d3637ab5f7e01d9b01c53cde1954da59d8

SHA512
89ef191b56eeb80ec2103af4dbb4eec0d0431c64bbea0a859591d43eb88aba54ec9b8d33ffc665fb26d14a322e6fee13cad04f26d6243da42df1d23299dfeb3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
192B

MD5
aecbffd41e7e98c89a30daa4641e8270

SHA1
f2992dc9422fec355aeaee541d1ca79f754ce937

SHA256
3b56af44bb8ca0358b6730cec9e3b4b1ed63e725789ba2534f5283518ea947b6

SHA512
ffae9b03e89987c2a20e23415455f43de09f3aebc403dee1421c5c193efe5b8d0aeebc69cda1abf9633ac0bdd00dc7e82989e5ba9804644753d013ed03a5ad8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
e805fd7591f2f4ce44e53c910b27447b

SHA1
aaf9a7ad338c674c2bc4997805646785c7047bd2

SHA256
3c1480cadc279c04fe8c08ea22c59f1b55b32dfb44f391cbe160649cb20380c1

SHA512
10edd990c57373100d22e2a33f857dbbed1b962af1156232bf82be3a719db0f4314b05b26423bc1904f1c224b7a17d212a1718c488b86d724965dbc5abc0ae9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DB426D82CC0124EE9B3324E43739F722

Filesize
540B

MD5
6635b8aa47b098051079f4e201c70c62

SHA1
fd3e2cf1e94e35e4c63739e617e9cd2ea1cc065b

SHA256
21485a3596e5df4eb3ab9205a0087185c98dfe157f6f5f1a2006abb23e207f91

SHA512
c60adb98f895cdf8615aebe608dd4b223f7928075d3c66c08f64a4a98da2aec2c5856431740b141801e351fa9b477db9a048971e68641ba0a40fed034c64f4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\BZEW8UDU.cookie

Filesize
615B

MD5
a5577fc8881bd856e8323a838dcd90d6

SHA1
89e0c0b0c453d5539bc9ae0a6fb06acf54c10cf3

SHA256
f24a8d69ec385939da21a5aea809ffef22d37a841c207f49a24f85fcdba4309d

SHA512
b320297d2bbff672137ecf0b9e5a9a8876314916549bf7302a62d95f5863ef49c77f84ee078f7ee7ded6ab221c7c6c50820fd8f9f5f3fc8a71494a0cfd8a9ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JY6NH3JT.cookie

Filesize
615B

MD5
d2398f5de2e6ae65406c5a0aaa1b32bb

SHA1
db62bfbb496ce185fb14a8c2ddc08c4b986283fd

SHA256
89023a834b2dd26c7158ce539698ef5943aa59b78c3214617ffe294ead2f6cdc

SHA512
b9296c0b9df5ea8351460ba1994e9bf89f84b376473334a5da6a87c65311ad703dc7644153ea9466687f3799473e8737b0f3b51ecaa861515401d1b7ef926723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\S622Z9F9.cookie

Filesize
215B

MD5
d1e8efdf14a86a255660b7061d890c44

SHA1
75a28f89a0dc84857a52ef252653547d335cdd4c

SHA256
65295d1d2da1519c970544e2c1703824f0623535405f17d9855fa456e66bd560

SHA512
b435932262e1dbd8b6e3bda1c6f83ddebbc8f6ece7d82e17adc1696a38e9807e7490d0c9abab1d2d1de88d49bd7c7ff800973150cc72d5aa0040460e6a81d7de

Download Submit