hxxp://eu[.]static[.]mega[.]co[.]nz

Analysis

max time kernel
129s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30/12/2022, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://eu.static.mega.co.nz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb80000000002000000000010660000000100002000000090f0899d0e30fb0acb7b1741c51761dfe73174c7a912a7f0e526904735aa7939000000000e800000000200002000000001b8b5f8190bd1121826fcf0aba6df425110323a618eb4aa07d6f6b70eaed862900000008e36108da7f2a7fdb230013c170a8d59fa95f9384ff1f478616ee15650d58657ac2278b413ca34601529c54e6d0bfddbdb976c9f96526ae385d66db8827cb91cfff2794e2021f8fc27eb6653eee924401a4d88199ea80264ac4490bf7a7ae0fac58b96576fd8c9ce1af298610d57422d51c481f2ee9aefa0fdc86bd9ba1892eba06913fd3115f6914233051c4020d58840000000bc88dc06c910baaf5e83a02604a4c4f24a2bc4625eaf003b23d1d085913ae032124194a6a281c7b2d3f3096be909249cfeb8c77f826007205721c5e77281ba83	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E915691-8887-11ED-A15A-6A950B37D0A0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.io	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.io\ = "8"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000e117d328887705b42d96efb7304403b440f889530df910e1f95a18e90e65b07c000000000e8000000002000020000000c7cc386b0b9abb0b5866ecf333e92bbe092a63c77d5ce3f88e3e89154524ee312000000021fb949791aadb8f41aafb498df3df2daca0f3f6875e11aa98cdc42142e5e1e7400000004efd1c0e2bf4a6a0d3cabd01bdc5be5e2dae9c51150751e599bbbbc6da63a08227f765597268043dd788e3fa161b4a1904bca8545910ea94df8e9d51edd09712	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "379200079"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.io\Total = "8"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.io\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b43e4e941cd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1544	iexplore.exe
1544	iexplore.exe
1544	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1544	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1544	iexplore.exe
1544	iexplore.exe
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1576	IEXPLORE.EXE
1576	IEXPLORE.EXE
1576	IEXPLORE.EXE
1576	IEXPLORE.EXE
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1144	1544	iexplore.exe	28
PID 1544 wrote to memory of 1144	1544	iexplore.exe	28
PID 1544 wrote to memory of 1144	1544	iexplore.exe	28
PID 1544 wrote to memory of 1144	1544	iexplore.exe	28
PID 1544 wrote to memory of 1576	1544	iexplore.exe	30
PID 1544 wrote to memory of 1576	1544	iexplore.exe	30
PID 1544 wrote to memory of 1576	1544	iexplore.exe	30
PID 1544 wrote to memory of 1576	1544	iexplore.exe	30
PID 1544 wrote to memory of 1560	1544	iexplore.exe	31
PID 1544 wrote to memory of 1560	1544	iexplore.exe	31
PID 1544 wrote to memory of 1560	1544	iexplore.exe	31
PID 1544 wrote to memory of 1560	1544	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://eu.static.mega.co.nz
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:603149 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275492 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a49750cc15a127faeb5654eb4a48c99b

SHA1
8a127b5098b0eba12ca274c4f1669dd31c6b8d88

SHA256
d682a56f178e768efc09c927be89884d96a3430ad455bc9765a1fc50f8393342

SHA512
bed9ba541b920f11b4df4ca6394f346c1be6fc934a2c25d0e4102ce7e220762302032dca3aa4abacd87da5b54eff08522500a517f10d3a38a025c63f11db9dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2d45f8cb3e82e8b56d02d52ce45d8ab

SHA1
a1cd376edca4cab778aa4211511f365fef725fa1

SHA256
7d30aa3ac4436b1d849ee99db1962cd4d2812906d9793ff608b5aaafa472600c

SHA512
2825719116921f537d4c162c1affb7c0c509aaf118b06dc009ed7cc21f0c0d1e606393b02671422d7d3d0bea834981a1b2d6a57cc49c0009ea5248035b169af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f8a58103b62d33d674ddd611e10b6ce

SHA1
f6ae1f5d91ddee2da5ad85262f41c2103e3eb236

SHA256
ad1433474cc98d56aef1002cabadd3d7fdbd40bdf07175e8ba667534150c7b6a

SHA512
242dc3aa030e5aec5945d89df58005026baf24ffb40316465a176d1304ac38351220ea8c8adb80cacabf43577acfc43877384d07d5026114eca5136984c40703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
056d3f25c5bfa7baa62c6d4de8eca502

SHA1
ea5f935652458e9647fde0620e298bd7bdab69c0

SHA256
1b6121d3e8643ed5bc79a2561fbe4fab9422e7fd1eb5329f1cff44f7e4151395

SHA512
f7a3d9baed5d4948a427faad2a9fc501807de4fe66464c919c81d2f3b9359d73c715492e3d2f783d96ac87f5e263e282e206d2933df763a33c6ea629a0e1bbc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94fb0d8a6d298ba9b697ed0ab5978af6

SHA1
a7c4bb6c85bf04e087bcb130a35bd4ee7ff34ccf

SHA256
8b9302790c3c4db915221e5799a6de2919f00d44ed23ccd165896b8c4102dab5

SHA512
13f619f07c7ece404c71642163945bed404a656cdadcf6a7b9749be2e58ee6b896c0999b5ae3e7fe49e6c1dcc448bcd3650f14e02ca8f2114d3bdec7a59944fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d02509c8d4a1f7713fa9a599045eb189

SHA1
60b784be211c1c0453e5a3087a6e4abe908a7179

SHA256
5818ee2b2552560b4aab90496b12df38c2d312181c0cd67f366d2ec342a3f1ec

SHA512
24a8d6c26004342c69c8b3e581c3ce371c6813254f26c82a88aef92532f0dffa28a754be5a21199d7decd7a5dbb66290dbbce463557ff04d64417dd556540979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mlf2v8h\imagestore.dat

Filesize
6KB

MD5
124a5e732589ae03df1040fe32ec0ede

SHA1
569c7819f90000ec3f9c15f873f94804144eecb9

SHA256
771345696ba282c0746d3bf45f9c1ab844624604bbe6602000237ed569179f64

SHA512
df50da8beccb05650ac4ad9994e2377308833c4a0df4df1669581257bd0bddf630f308a929d64b96c79bc510d892ce223b0c643aa3679205cbc8c1553ceaa9bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mlf2v8h\imagestore.dat

Filesize
7KB

MD5
fbba8ac9095916fe81254088b0779315

SHA1
52ccab20c8301b2c3fbf9cdd932a0b12c17fac03

SHA256
237ad02ce0658d05281fd72df797401941801db549d51b894829d923ebbe0cf9

SHA512
9a9ebd61e046af56cadf544bf493bbae26bd959c400e394056618f9e28cfa27777360b86b5db0c62b51ee4e2c7b563d60cb6a236bbfa766f6dc2e4bf618f6ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mlf2v8h\imagestore.dat

Filesize
24KB

MD5
fcc50e35366b07a45a6ef7181075340c

SHA1
e7c7ddf738ef2de3b8c306e8399dd9f1405d65af

SHA256
61856133bca23d6711ffe93315607009e7e00775abf438ad0cc9eaa31b46aac6

SHA512
7fb3183567788f12a053998ed58ed9e962f820b6ea21f2c35c65914f4e085c54f8aa378544985c76bcacc8f02d02166255fac27e88e0c56496ca01b6e2a24b6c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\06U01JXU.txt

Filesize
608B

MD5
373d6210ec712cfeea1fd33fe70cbf91

SHA1
e2b9a4950664f78622ac73bdef89fc367cc9cdac

SHA256
52a8bf1139c91e6a511e69b568cd8e7f756de8fbde4fc01b753ff81d2ef389a9

SHA512
3deaad92fb14a8fc21e9814fbb97c9e7d40dbc67f8e0b9fb850d7dadd8d64d40bcfad468dbb98020d8316fd5eb462368f6564c799b3b76566f872b7d983b8ba0

Download Submit