hxxp://quarrelaimless[.]com/mkj9tyzh?myp=28&refer=hxxps://vidstream[.]pro/e/xeylw9zw3jvn?sub[.]info=hxxps://fmovies[.]to/ajax/episode/subtitles/a2fe36e607d27fa935675e908f6cabd4?&kw=["house","of","darkness","2022","1080p","web-dl","dd5","1","h","264-cm","mp4"]&key=e35fff0d600aad048bac0f7b692e007b&scrwidth=1920&scrheight=1080&tz=-7&v=22[.]8[.]v[.]1&ship=&sub3=invoke_layer&res=13[.]31&dev=r&uuid=d8b10da3-1d2d-437c-8600-9a3ab82d3656[:]2[:]1&adb=y&adb=y

Analysis

max time kernel
145s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
28/09/2022, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://quarrelaimless.com/mkj9tyzh?myp=28&refer=https://vidstream.pro/e/xeylw9zw3jvn?sub.info=https://fmovies.to/ajax/episode/subtitles/a2fe36e607d27fa935675e908f6cabd4?&kw=["house","of","darkness","2022","1080p","web-dl","dd5","1","h","264-cm","mp4"]&key=e35fff0d600aad048bac0f7b692e007b&scrwidth=1920&scrheight=1080&tz=-7&v=22.8.v.1&ship=&sub3=invoke_layer&res=13.31&dev=r&uuid=d8b10da3-1d2d-437c-8600-9a3ab82d3656:2:1&adb=y&adb=y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987037"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4196936461"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987037"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{259C3FC5-3F11-11ED-98FA-523C7D4F90F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "371139424"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000742693025ef6ab4aa9808eab4c23bc9a00000000020000000000106600000001000020000000041272f6aa36df37edec61ceb50203bb57a69893e09f3f16a71cc001321eaeda000000000e800000000200002000000071c9f2c947344b3ffe8c8bb1a6de1312e0d7ff995e6ce482d36dd793ce5064992000000036d730a0573681addc090df1a12b36cb67bd989ac197b341f6de046d15a9590e40000000ec1254887f0352c0e41857b26bd9aa4294f163efa779171104ec1b32af96ad5d43c0246db866d0e8e21848007f9638987ee1eb895fd89bb11227749318432694	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371122815"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8083cffc1dd3d801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000742693025ef6ab4aa9808eab4c23bc9a000000000200000000001066000000010000200000005b5a94b51dd6407f80712b1bec7c41df16286c8bd2c481c11f1350969efcbe3a000000000e80000000020000200000000d98a0e9b95a444de110729090f9d34f31d2d79a7d0ca1eeb0f299fb1d80854020000000bd2acd1eee4de8312adcb86d06b9b10d48dfb3e998f9937ddea63339a70162aa40000000e70c09b1462961f916d812d1724a9a0f676695f95885c1ca73b3038bcf0bfe92cfe1354272d1d34c1ccf054623c378e5fbb0e4266c168311c1725f5aa5b6fe15	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4205686460"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987037"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "371171400"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4196936461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60dbddfc1dd3d801	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
3832	IEXPLORE.EXE
3832	IEXPLORE.EXE
3832	IEXPLORE.EXE
3832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3832	2696	iexplore.exe	66
PID 2696 wrote to memory of 3832	2696	iexplore.exe	66
PID 2696 wrote to memory of 3832	2696	iexplore.exe	66

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://quarrelaimless.com/mkj9tyzh?myp=28&refer=https://vidstream.pro/e/xeylw9zw3jvn?sub.info=https://fmovies.to/ajax/episode/subtitles/a2fe36e607d27fa935675e908f6cabd4?&kw=["house","of","darkness","2022","1080p","web-dl","dd5","1","h","264-cm","mp4"]&key=e35fff0d600aad048bac0f7b692e007b&scrwidth=1920&scrheight=1080&tz=-7&v=22.8.v.1&ship=&sub3=invoke_layer&res=13.31&dev=r&uuid=d8b10da3-1d2d-437c-8600-9a3ab82d3656:2:1&adb=y&adb=y
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
9f2d56f4004dcb03980839299b8bdf22

SHA1
0fb7fe26e552fd15cfcf173df9a4a9c77810045b

SHA256
7c0f63236995ea903c8cac60d3b994fffcad4e956fcdc804c0ebbd602ef045f0

SHA512
39dc994dd920557ede5b842f9e42911fd92c36603db8fa7155895d519e9786f35ec0eb35432ca9fbe788d8f2b4fb8a51ff348eee51d2218d51b830acf11e5a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
e12c82661cf68cf0eb64f50e0c68ce34

SHA1
a92b301c88611dfbd05a56b2d2758c0301e9cee7

SHA256
1ff3db3a11352a904d8ff5e2943786ffa250630a2d6a90375c8fb65557d3d251

SHA512
71eb9c0a25e1c39c215713d6c06c7068f861c73a54b07965e28e7125524726a70c6b335c48d1c5a6373673c3a76227dbd3f8a4c09ed4d858967ec112d30e7edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
865351d3a2362d315dfe4abfe7ebb7d3

SHA1
ab9e3e89c9296938f3ce81a9100f1419c68335f5

SHA256
8f294312a374504d64b72a5a552bc1c6efe75196d4901309d4b90a28239b52ce

SHA512
ae75e3f488b9abdc17f32040d8657c6a9e5920563fa8544afb3a6e01a0a0692594aef372db85d83d2c0b4231bf96442f2b26dd16f645c1b5647fcfced7cbe89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
0cb501fa8c121f79f5b13400fd4a66b3

SHA1
3f9c740f0a18a6c505a617471f8ef1ec46ceb4d2

SHA256
6959bd906693ca5a7688e05f08beb37786470374a58b01e301615246628bf092

SHA512
56983b7255f8da25725455081afac1fb42ae85f7778ca078b27db421e4e1cfcb06ee5e4269cb287de0b15a2c745f4631e926c17674982ac380a1ec3daf34ce14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\2Y59DCWY.cookie

Filesize
610B

MD5
94217e63d94e813716b6e828956f35c4

SHA1
e3286ebda4ff6b705a875e82f1bff068753bfc46

SHA256
57530dfa8f8b2661b2f3f5a99e19865f80ea09ac7bd3ae426ef62cb01b2f70c6

SHA512
97347200a55a061242bba7e832263270e99838a7da058157b117e0ce1f7ea1aaca0b7a457ced7c096fef5c41b006e1c71dc824a4712a63ec5baa983ff63deb5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\XW62EMAI.cookie

Filesize
610B

MD5
2a18515cde5b942b8562e94a40786753

SHA1
b00735d0027ccab29438b8ea29b181c5595d318d

SHA256
355c672dbbcbe761dfa0bcbe2b919be20e0f59f5c83722b6f6c96b4b6e0f4ed3

SHA512
93ec8e58f2e0a96ff39cf72cc26c73a6a4b50896085a38b4a3ec0f7a0c54960c7b927dd83766479889e53fbc0aaea948854192c051b0913172745d145926c9fa

Download Submit