hxxps://www[.]apple[.]com/ca/ios/app-store/

Analysis

max time kernel
332s
max time network
334s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/04/2023, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.apple.com/ca/ios/app-store/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387214202"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300201b07765d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000b557b3724711623cd05150f8113d497ad2311bb20a0d41c44abc99550b6240aa000000000e800000000200002000000056bf6de8d0358bc809829730c6c27315029437f6994d8fe3c79578764374a7662000000072f2ee731ebcd76ca0ce2e357af378071fe2de06af92c75a4d30998891d7b7e640000000e6c4423efc6cb239a81e83c75715a9aff1c2436e77cafb4289ccb51568814e813beec481250fc9b99a7d7bed7a9ee981979bc304d1e0b5f597fea444ea7a6765	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4213CC1-D16A-11ED-AB51-5E76FDCFC840} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000aea951634fc4200f5ba83a26fef67b6a16add1568357e9f842adfcc9f22d83c2000000000e80000000020000200000004b31439aea9d0534c2c6c897c56485ceef28e16c41228146c9666dd0e8eada8790000000e4463f91c9970adf4583f726664adc469589134f65d98e66e74813610d18549049db4596739d16483a343c403d9c187e56f3fa89dd63aa07ade04933050e6f339c97228d05222cc5fbdaeeea1985ee151c45cc25dadf9d999543d1a3d5eaacedd618867ec7a14b0c88a553b59cec12cbd684f32cc38771a8af654c33f2b42011dcd0c3ceacda85148b13c729efff7434400000003d810ba0d045302902eb168de3136cf43a37b58c109e4c17553637db4a28d8cc6c71231b7513cda0fb5f366f1c7f4db9a06f43fa0cff847535bfd57c908a4515	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
672	IEXPLORE.EXE
672	IEXPLORE.EXE
672	IEXPLORE.EXE
672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 672	1720	iexplore.exe	29
PID 1720 wrote to memory of 672	1720	iexplore.exe	29
PID 1720 wrote to memory of 672	1720	iexplore.exe	29
PID 1720 wrote to memory of 672	1720	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.apple.com/ca/ios/app-store/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2b5294acb938e458eb648ff5a09ef674

SHA1
149dcf1f1afc03213918b50cf78f42eff8a16cc9

SHA256
a0f1f72db1fe7ef711a9aec9b5d96536bc333bc81dad0cbaf892df28f195d800

SHA512
ff7ee44d06886741e1bd25de94a275005b58f66d2156c23e81d8ef31124f92414cb47a5abe5b2053e41e9c20dd1d06a1ad26354432f56df76fd7d5eefaf51d18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2f7972a3aec46992cc3c25d8f1d14b6a

SHA1
550ce354303c958d870fdaa20e9ea70beed8564a

SHA256
192b24d18aa1896510e6ecbc8d32102251b35a2e17ec3e93df29ef224f00ae30

SHA512
e9263700010ca7e92722eb3dc91d24d5bc7262157ce9d4714a518721935f2f4e6c15d1be7e73be0fead84b98f3434ae011c07469758cf3b714df810f20f99c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e0df0bcebffe43154223466be3c72745

SHA1
af0d771dca102c4174d5b35b62339aedc1cc0474

SHA256
4165865f9ba09f6054b52660c7fb9ed370efa07534ad01ee745b022d5b1274a8

SHA512
d9eb338486fa218562cada2e31a6a00352a0719f4cb828e33987538b35da5efc844ce25699f687720f547bb6d6c701ab7f7c0f3e1f58ec0baf9e2816ef9b058a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ede27e4b20178142c09fcd4a8e99d7f5

SHA1
495955360da0f8f727bb3ef6c004da63daa1412c

SHA256
316ccd78e0fc3de01d74cc55fe4b6bcff675789fb2dc4f21baf896bcceae3465

SHA512
62fa692472548cf009a35cb5d527a4cb704a7105d9f19b47d04aed411b3966a278f894a20838f6ac84d529746b6697628e9e8ead1a8551fa93907c27f7f8f3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3aceee521f5840672cd8d3d21d277a33

SHA1
61c4e8fd0058e5f1889e9f75a3b96ee693b6d491

SHA256
1b0cca142da0fc72478a2df5a24f48365912723ceb3bd15c5158ce72a1118a26

SHA512
4e4bd262c2cbceed4ac97d1c53a6af29c69f1e40bf668199e72260dc51b439c3ac488b19e31fa4d606cb4e69480d0dd6f6d2eaf740410a156e168adb58c2d8f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
433f1b3e96296ae508d2e26ac315af5c

SHA1
317a4bdc6f1a569de2439fe989fb068f3be25120

SHA256
3cfc0faaee96d4fc4779d8a4f7f1daf4ced185297e228dace3ce789e759e35e7

SHA512
d138e7a96e3710dfb3569998fcbf672b62adbb4167665955a247ec1d8166fca461bfed4f866d26ed1520d5d504bc31fe18f5802c1ee56b6cddee584a86f631f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
82779d826551ba9a5e996d55d849539b

SHA1
dee471f4ee7eba0b9f31d939a627b4df87d70001

SHA256
887c35b9604ee360444a678603d987e09e0c2e3afefdb5c8853a669c4c738a12

SHA512
fe20f9cfd014036c47446d868de959d7c7121e4e11333f2919abae37d821823fd22721ce61ab58ce6b58dc675c2654d47b79c9507ba5eaef2c05e37196e98382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d876982e58feda388ada56a9c60b661e

SHA1
920bb93a3a99a78bdf2028a523277b5953999973

SHA256
6445779f46d229a53fbd10bb39f14962ee16d754c08138d46899bb964cb2dd94

SHA512
8b54a223cd456b663c16b41d5f8da5f16393db5dbdd26d86a91872cfc5cd44fe1a83807828c066c4cf74cf80d4432ff53d8725766eda9b47ba16d519d737e790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7693eb536323e1863f52ed0034f7e421

SHA1
fbeea1f201ee98191d3abd0ca12bda513da5979b

SHA256
786517e8105b059f462004bb70f1effffa2c710814be797438f12db8915bf837

SHA512
2ed4a3d757324cd465b26fc8f0c90cf008c47757ea8c76f90f03fcde19e92f5b42f0bb0aac677e9439a80d07fc3630ee9c5860c0ed401124b489b2c8f1c35aa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
391ae48008e78303d6d097c8172cf01a

SHA1
67e316d300dce85eb0ea53de0e960326ffc7c64c

SHA256
181d402f619685a57270f50855011f2ae7e5731a9a8b789c1dc871278ebc7a9f

SHA512
e017e5a3feb0cea25c142149b0cfb718dc9d66caa25aeb64356aa46d5908feda249642bb0fb8379729628f487491bf0f46136ef3c71f499a452b55c2c215db8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\idyde9r\imagestore.dat

Filesize
26KB

MD5
3291a6cb12f5d8600c1e891586ac0dfe

SHA1
97902df735cf7ed25b9b3e34565f8e973969b641

SHA256
988234b4a45dfdb5095ae78595749b36605b2aab7c9afff3cb8ff88679549a6a

SHA512
3f8034e5f2f36fd2bca5e909f644e873753042bbecc5b44a288f5f8caa326ce6d7c69dcd05f0e3482fe8b37aca8e06ee73b959030c41a8f1101bd5fb407666a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIMPJA9E\appleicons_text[1].woff

Filesize
1KB

MD5
dbfb39700c2ae4be64e11f56f67b8800

SHA1
594a44bafbe3c796dcd000c8a8a6ebbdea553f6b

SHA256
b36e10199ae62e788fab5e154b2694409745e146f026219436b71d5bca185c69

SHA512
b22ae2a3127c972cd9249af89759c14b8d36e76a41b1d556be896e51f8c16deb22cc612ab02f92c200842269cbb2ee90f78ebdfe683a67adcf793c5bd7ca4a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\favicon[2].ico

Filesize
21KB

MD5
891e510219786f543ca998282ed99f45

SHA1
19fe2ff6a2418bcb44b02308b998cef84199ee08

SHA256
e4bdf72e2f803f7e19907c12f407ac7f7cd5f1f94bfd730b9be24b0d49191b48

SHA512
e6729e7e1ed1909297317e249adb7af6c230b2a7082ea792c7776fa5037c8ed8aaf02bcc4015334b6c439732f965ce19291ffe863126d0c20bed9a0c89c4a95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC2.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10CD.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\490E22WK.txt

Filesize
600B

MD5
05bd5632cd0c50d286292b721783f511

SHA1
a2d832f4c936d3fb4ae8fe7db52678eb95d699fe

SHA256
524a0625c7fab3946fdc74cf7f4572649bf42197eada9ac4d16aec765407ed7d

SHA512
7f228a34c62962b1be2ae47013b8c6cd0bb7c19188c7881eca44a980a9867e78dabf2bd8ebef223db7cd038d9bcfca5ff0f79f506dbed2d7b966c934e8639aad

Download Submit