hxxps://gsmiweb-dot-yamm-track[.]appspot[.]com/24WNud3XARhwmdTlyfiQui-7G0kpW0ILcydwypbZwv7e-A2ExhgFH0bfYQghHWdiSV3QNxLGRDASHGAWjGg7TK5-zLYRphUcFy0rBb36bb_JcIueI0fVtyQ_Yg4dKKhIjf2ZToPid0nmNsS7zZ9l6QJBUSg91g6ErmJF5xJsEpSuO_4JsmP42BcE

Analysis

max time kernel
67s
max time network
132s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/02/2023, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gsmiweb-dot-yamm-track.appspot.com/24WNud3XARhwmdTlyfiQui-7G0kpW0ILcydwypbZwv7e-A2ExhgFH0bfYQghHWdiSV3QNxLGRDASHGAWjGg7TK5-zLYRphUcFy0rBb36bb_JcIueI0fVtyQ_Yg4dKKhIjf2ZToPid0nmNsS7zZ9l6QJBUSg91g6ErmJF5xJsEpSuO_4JsmP42BcE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{787450E1-A7C8-11ED-A064-6A6CB2F85B9F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603d8960d53bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000432f80467284e243830852d449039e650000000002000000000010660000000100002000000012698be3ce1f9b0cc390bb5a4276fe711def4167cb91e5e416cfa930b419fe17000000000e80000000020000200000006a2c6397f8238a877f259bfa32bb71ef158ccfdf091b7810645162e2feb06ca990000000f35257a3c94e99924e24ce9569ae1bfa2f6bb7f4a48098527f765c8140860fc5d115e65c7c2c78bd5f6152ae6c524dc7f6801e758063ef0b96c47d6386330bf8f3bd68bf0038ee9fb8a694c4c0418e9d72e84451370efd32d01041b4390c64e6de8cd59c986a94f3ab4bb327cb53916e8ee7f527b8579bce8066722fe4e0563a02e11091b710c66ffffb54be462b100d400000000d21e9dc97820909265b75a683c0c8298ab3ed440d0bcc233f8ce3fd71b6fff620bcd45bbd91a8d32701511f23de257c7d728ea1aa4019f564c312c8788489a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382636473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000432f80467284e243830852d449039e6500000000020000000000106600000001000020000000f36471340fe2333feca227c4173ef2971a0078c55d8da8347199af993bc37a1b000000000e80000000020000200000004dbd4f06baa5ce756b091a1f35b09c317bee0ba7c34bb0ea12d384049ab8909f2000000051a1cc5b9353c2c0d45740d3391e527b88f796e377b18a9598cadf11b1686c614000000076078fee414feb3497257a610f4f65b8888dbd06aca5661fe128343eb14efd1f249c08cf47b97f94236ee0e2075cda080cfa2313421bcd9aa00e748c52778c5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
968	iexplore.exe
968	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1516	968	iexplore.exe	29
PID 968 wrote to memory of 1516	968	iexplore.exe	29
PID 968 wrote to memory of 1516	968	iexplore.exe	29
PID 968 wrote to memory of 1516	968	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://gsmiweb-dot-yamm-track.appspot.com/24WNud3XARhwmdTlyfiQui-7G0kpW0ILcydwypbZwv7e-A2ExhgFH0bfYQghHWdiSV3QNxLGRDASHGAWjGg7TK5-zLYRphUcFy0rBb36bb_JcIueI0fVtyQ_Yg4dKKhIjf2ZToPid0nmNsS7zZ9l6QJBUSg91g6ErmJF5xJsEpSuO_4JsmP42BcE
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
50481b0e896c0f912930286311691ea3

SHA1
47276a31cff505b7788ad7705e1ecc109c51877b

SHA256
fa5a10ac1903853f084d78dd22e043d0dee390cfa9ef18d88896de347aaa4bf5

SHA512
0fd93f94112a017ae14fd1a1268447c559df7159743c4b2e431e20796bc6ad0edca5c5a6a906a8724d8d888f4453f8812b63e897b30444d22d635c617d2afaf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
5KB

MD5
732799504cd27022b512609200471dc3

SHA1
cf812fd39ddaa6c833dabbc3827f80dea181e59b

SHA256
9ff260069a60f12701e969d9b87541268b81aa85f8c2f65963f9cd77e23bee32

SHA512
c642bd0e67b2a2fbb5d3c59196facde27c858d45ae221fdf7ecf807d78191cf45a5ea38fbabbcddb101b4ef9b697d59bc770705dca1337b5a31d1f83e87ab7bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GNZJG7B2.txt

Filesize
604B

MD5
ba6aeffd1f558f9e6155638a651b8f60

SHA1
426bb682846b49906b34c048787c597e88895ca4

SHA256
b58f0093f5bab25030934f57fe9c8188a9a27aa7076f513d6f308b87608b6b90

SHA512
b76a15b4751e79ce6a7fbcd4e77d55d379b778a514f6fcd9178219128ce7b926f014391b08c8f2848b770ba8ccf479b4c7f8429af90491622eedc94e5a12587e

Download Submit