hxxps://longblack[.]com[.]sg/octopus/?arx=ybdjj1nipnp62z&t=f13qvv85l1nz&ren=negd8sxu&tkz=7ie4xeuzp&swe=ub7ro7chr8h&id=blahblahblah@coolsite[.]com

General

Target

https://longblack.com.sg/octopus/?arx=ybdjj1nipnp62z&t=f13qvv85l1nz&ren=negd8sxu&tkz=7ie4xeuzp&swe=ub7ro7chr8h&id=blahblahblah@coolsite.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048dd1ad2bf5eea499f26ca602abd801100000000020000000000106600000001000020000000ea4fa9c704547be2727d68dfb89ade42ef560486262794a7bdeb22eaa5fbe1c5000000000e8000000002000020000000a491780fedea1cf0c46f4b0d7702a9c9501a95d358c06e3ce1c208f0762bd3cdd0020000dda8179febeebd699faaf1ba8ba09f48f29c8e24886880a7831cd60e2abb69dc357843545e1abd8330cbcd36f91930a70e2907b71a4c2d533f0ea8ce566541cd4be83afcfa4140ffa1b5e6b278bf3574c1b9f428224b5ba7bc3e5af8b276896ffbe5f93fd76ec709a113354196757a4511dca6beff463f6b1454ed1151a1e3f275914179163a99e8368a33083a4d93115f2fa8b1681c83e347419f4687c9f2b1fb0e4911f7e6c17dca7f150901b94878325132b6c3d05bcff82ae8d77e4f51b6615d13af4c91dbe5442aa8feb6acfe74faad8d59789847d0b9eead1765a3c8c88d256f6304de8d9c9ec1ada043c75b1e83ff74cba2af32ea665abab214373f273cdb7184e0e944647200cd9b7fd1fe0cfb251f9e95fe4ba298a66b67adf5ad34adac5898f773359d0c54bd96a095a885f6c248ba0339ffe117530dacb78f9fd31e49a83639bff9ccc05d7357a2901c6359c5dea6bd735163609aee08a5955939bc574b1a7051cb8c13a092c114765772041a5c9cd5abbaa0d023a2038dc736fcc16b94f3eec14c9836ba424455e581bd0c375389b09f4a9b055579ff517274e70bc638c4d978b204f1d695a56fa43c85fc87231d93941b6f755a86bd2a09911451806e2a52e9a919bf84bdeaf08445fd57cfb2d6bafc47f58a33d0d68f37caeee94ee415b30cd95a546b9b578901d75e7b8c747a42f379a27771257a899adc1ed74c401422e3ea18fbe590d7621f908e00bf410a587b2039aefd3e3374951c55f00eb3dfc6837ea889041347aa46560fcd802dcc701ae869f3faba3325d41c8326c8f726934ea6b8562b3306bd329c360e461c56758941b6b8fc755b678ab7a1a6b38ddfae249a739adc461430c2ed3fd773a0ab004f18ca0fa9c5b0a7826f847833704045bd9f49b22eca715d1176107b495fd29caa849ca8260eae855c0708303679785729c8734995405183c050fb501e96e02b958f34a9fd384c05eec6619e5fcc2a47f74899366d5f21d8690d5240000000abc2bcc2b5826ccf66e5c78434505814bf633213e0d22619b4c590844cb282a5c0b7627beef854b3717f27308c250667c7d9209dae5d7154bf27e2fb37dc4c0e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999759"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4116744058"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048dd1ad2bf5eea499f26ca602abd801100000000020000000000106600000001000020000000cf075e5f53aa1b822a0843b96203c0bd0d94f48fab6913fb463b403e9b308d30000000000e80000000020000200000000abd28c1eacc6ff8bbc3f23d74197034e418ac07b5903ce4ccb852bf8ed2d972d0020000811de024064410407d0fc9dd8c65d1b6e9ac52fc76e7fc99536ece36b124f82626444e367d2886b17963c45af32f38e541b60c680c3d6a394e51760f90e165b115f2584b10adf4f89dd0bf7d01afd9032e0f6de58cd7f1bbc8853f478cbd436840c3ab8d300cc8039ecd58c8878c21280ee704aab43497b3a31cb23a00a590d2865aa0fe89e8f596882e027b22ff29fb90f91b3bca4df7078f7a54ec3e3064450c64d9604c83c2adc09785825407f65c5a78d06cd2b27f366986845a5278aa81ef4c3f08fcef47b908816cfb1422c2445dc3b910d07fd76a35428d1952d7cebe997a868c00c1ad0f35be74f2c3fbb2e4b6c831214692ca518897a14355eff46d2541d19fbe05354530e26347ccf3fc3fcd00e35bd93b19a709330d4000b6354239ef9081492056ed1f3a8114de15be7433bed117592c56c63af821b3b64d25c88468a160b9ceb4d155ec004460f6c1b4982b152116193975edf045c948f16ab4fe9e189ac6aa87d1112225a70ba9c686a094362cb07c3154c9ba4f058153a8d43c185d2e2e9011cc369fe29159341b95902708e0e6bf4c51f3e1f58426b0eb60276476191d1018c4d2116e60dcbd279b787a4a4027ab040b377301791f8aaecad08aff476f2b25666138c7ec31b90b780635178f56a571241fa4b321368286a8c9f5675ed5f05bf03fc5c406f216e90f44191c28908e32136b4862ae3c998e2b3cafc73149b6fc8fed87ffa9fbc9687e56a0961b3cbd3ac4e82af7e0a9cbe2f6b9ad9abf0b12897dadd6c649f3e255c6edf5cbeb0da6da40284db30adb027818a40ca21e3850e701a52337827cac3e2eae64b39dada59eb45171a78d0ecbc5958a2139fa29a5cb2a63be90b791ab85aaeafcc3999763aff9c792aa227b6f819ada6396cbe5f6808ca6c805c8b7f0e0086cc86fc3d1542fd624934567971cbe161dd86a09cabcb4d14a19a56aee70ca8f6343589f89a228ebd3b49fcc50af59fc471b0fdebabdcdfed70358a2115430274000000080d93741efce18bb756512bee94b82958be63b82a550f58595bfd0fcd05175ba951cc4610aacafb320114f7764189c98e2cbe33a5aa3cb420ebf7b83fe87ed93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048dd1ad2bf5eea499f26ca602abd8011000000000200000000001066000000010000200000003cc5a8002e6af72db52cb9aeab057dabe10e9cff689fdb1388e65d9c9419d3f6000000000e8000000002000020000000839d81a5fa4c1171cab6c4210714540b55492f5b0e12d86ac85bedee864199bd20000000fc8a7336a2657064d790b6f6d4a88fb2a693afaa2b1ab0aa85d50672744b0a1c40000000809b81885566acb97312a5762d0f09f09abf180675aee07b1f857f82faf948516910e6c473f2bd2e04b87b7e5e399cda5a27a96cf43da8512725a1516627720a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999759"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402888f6cf04d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999759"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20BCD712-70C3-11ED-9424-6A1D00C284D7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://docusign-octopus-energy.com/octopusenergy/octopus.php?arx=ybdjj1nipnp62z&ren=negd8sxu&tkz=7ie4xeuzp&swe=ub7ro7chr8h&id=blahblahblah%40coolsite.com"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = f86664f6cf04d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4138775432"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4116744058"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4548 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4548 iexplore.exe
4548 iexplore.exe
4828 IEXPLORE.EXE
4828 IEXPLORE.EXE
4828 IEXPLORE.EXE
4828 IEXPLORE.EXE

pid	process
4548	iexplore.exe

pid	process
4548	iexplore.exe
4548	iexplore.exe
4828	IEXPLORE.EXE
4828	IEXPLORE.EXE
4828	IEXPLORE.EXE
4828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 4548 wrote to memory of 4828	4548	iexplore.exe	IEXPLORE.EXE
PID 4548 wrote to memory of 4828	4548	iexplore.exe	IEXPLORE.EXE
PID 4548 wrote to memory of 4828	4548	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://longblack.com.sg/octopus/?arx=ybdjj1nipnp62z&t=f13qvv85l1nz&ren=negd8sxu&tkz=7ie4xeuzp&swe=ub7ro7chr8h&id=blahblahblah@coolsite.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4548 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
2385a464e17980d978246b6b59a60697

SHA1
ee57c16c00972abbea042066dbdd769fdb89571b

SHA256
88dabd9b9c2183dd69b01146358783b0dc0e24faf044331be565cfd26e1dee2a

SHA512
d85eaa2a9a0a4523eb87bd43bbe995d8658dce705024c316de12c9f9be0277ded1646a6667bd47eed337e2b790aab9760ddf2e501242c42f3d66f40c23042d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C90811770F88B421451C4A8ADF2D2C84
Filesize
503B

MD5
5f4a713a5a8b1ee203f607ada95e16fa

SHA1
45c9c076d1de118e53297c223ca64f945a182996

SHA256
3ee6bd3c984299503723221884dc1a49d10a276306c95ec9f142922d8cc5caf2

SHA512
5497c8ca7ee5f53658b53d7b9c9d11c8b161a500476a73d415c296c8a2a119b741c6eff43b107b4a4807ed784b333fdb7f6477c48488f3fac8f343e2c5601a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
cf4aac2923cad2f0609e1490846c5cd1

SHA1
37699a85aa0566fe25438ef0c0893d3b370b3f85

SHA256
98d06306aa769b9c0114a33777623a58c2ae04bc5754ade30ce86067184f6460

SHA512
7e88a5b7b2adee20985abeabf5e07c2ee01db9a32213a6fa96b456828b5f2b7ce6c3a8f3f3a051bf67d681c2dbca13f3809da597a40ea1d4e7b340b10d25eeb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
cf28fd517cf0e5dc5554db2ac7cc0dbe

SHA1
812f09c863b07b789b755ddd430c2355d9fb4d43

SHA256
00309f1a8659c9db8a56c49a35e15596ad2b5a281900618a309aa98acac2325b

SHA512
3ea3ab41b208f807d915670483e220f793f4fb5671d5588cd2eebac716af7139a6034ffe859d300be293300fd187a4a16f5df7f98bd58b44d97b41f9e01c1fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C90811770F88B421451C4A8ADF2D2C84
Filesize
548B

MD5
cd771f8aebe4241a6efa505145538614

SHA1
26b5244cc2f5db52b67d9ca979fa8bbded6e803d

SHA256
5af973d47723e864a773943e6fc67434f81a40d8cccca352228c5c1915283e92

SHA512
8373c595b5de24ac4d6b0967b7e9e44424314cd48dc6adbcae3430b4be08028bdfa1a1d961dc6dba34f378d806e32e9c4c1b68f1d963cebfae3116edd8e48ec5

Download Submit

Analysis

Sharing