hxxps://clt1488991[.]bmetrack[.]com/c/l?u=E666C4E&e=150DF82&c=16B85F&t=1&l=8DABE5D7&email=nJRsej4QjsOjaaV61Fx5VC1oDpgEbfiZ&seq=1#dmFuY291dmVyQG1hZS5ybw==

General

Target

https://clt1488991.bmetrack.com/c/l?u=E666C4E&e=150DF82&c=16B85F&t=1&l=8DABE5D7&email=nJRsej4QjsOjaaV61Fx5VC1oDpgEbfiZ&seq=1#dmFuY291dmVyQG1hZS5ybw==

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EA3A961-42F5-11ED-8C11-42FEA5F7B9B2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108c8f7f02d7d801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c0000000002000000000010660000000100002000000063b0de8d214724f0ba0f3d63043e06140eb8c6cc36d7ce957c0ca419db5e3bc3000000000e8000000002000020000000a9956dc615ccee3cf7102e8218a32225dd54f24c4b08dbf3982caf720a9d568d900000008a3cc727594cc1711d144cdd8e46b374d07d0d85a0570d3ce9143e0ec56160552f43e0547c78c4b726567ef4f31ac106ecc827d38b48f6f2ea44081a3c2b89eadb59ad81c5d9e452fd0fd4f6461f2928a1841173742289d7daf6bc3186dd2dbc451fc8a9d596be6c50d6c068dab06cb1afd8e1a71d8b1ead444753a03e20c0d94d1c015752ba2e244ad6b8e60aa46a6f40000000946ef4c6e60c26c12eba3e58d6d937f5415026a6c727429169e2c0cc2620fd32ac53f053fb073957bcb68e770080562fb8f8aca4317dec79b5cfc4ce7c8ebc65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000d5003e2b6d67f19d5e096c57d90fc19a081fa2eb89e7026fc784bbaef4a8fd7e000000000e800000000200002000000073ec8a89e3506db646b7419b91bc6923f7aa8b3ac88e232e1a8e5c7d6287dfdb20000000a040ffcedb256ea804031b27419986ff49f9a3bbc355fcc11788cbade14e4268400000003d7118b26de7dafd33d25dec40050b4c2232b218c3d33abe7867e4a7927d5f37e880811a03dccce5624d7dcb4f0a6ec1171a82cc677263dfe68c816f6b1eaa70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371550799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1184 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1184 iexplore.exe
1184 iexplore.exe
944 IEXPLORE.EXE
944 IEXPLORE.EXE
944 IEXPLORE.EXE
944 IEXPLORE.EXE

pid	process
1184	iexplore.exe

pid	process
1184	iexplore.exe
1184	iexplore.exe
944	IEXPLORE.EXE
944	IEXPLORE.EXE
944	IEXPLORE.EXE
944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1184 wrote to memory of 944	1184	iexplore.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 944	1184	iexplore.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 944	1184	iexplore.exe	IEXPLORE.EXE
PID 1184 wrote to memory of 944	1184	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://clt1488991.bmetrack.com/c/l?u=E666C4E&e=150DF82&c=16B85F&t=1&l=8DABE5D7&email=nJRsej4QjsOjaaV61Fx5VC1oDpgEbfiZ&seq=1#dmFuY291dmVyQG1hZS5ybw==
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e8de574ba473c6ee22252d4b2df458fc

SHA1
a0bdeaf238417e4b82c5f4a68ab6375c0eca2ee6

SHA256
531f2194f7298c83f529ae6efab501f3e300c1989acccd827c887691b4f57447

SHA512
60dd46f7507a74f7cd5fb73fa56af66b06f48aa18dd6645f26b01edaef2857155c3454fd2c6aae4e20c1d7e5fb8fbc64026f0a07b2c307829ee2df32a7277efd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\L9Q2BC0C.txt
Filesize
606B

MD5
c377ba21ca3af424cfb084fc5246d1cd

SHA1
b667f7862e8748c8d6c9c17faa2d7b271a6b97ae

SHA256
d41e635a5e4eb3305fd719fc778e0184c9e27e3047b069f6a13dd1a2adc8f292

SHA512
c51086e093bed1b933100da1c801bd4ce3439d8012a691da35412dd3eb457082110b8e2665742164d83ad3861ccf7daec25c1801e2d80080bce58c2c1c380a1f

Download Submit

Analysis

Sharing