hxxps://acarmex[.]com/cgi/ad/login/login[.]php

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2023 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://acarmex.com/cgi/ad/login/login.php

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028106"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31028106"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "652688886"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028106"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "593782999"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb827cf93ddd146af8365c0e3ca13020000000002000000000010660000000100002000000063143fd44cfec4c1f7ca08f5bb07fe377759ec0611cf3a36c5bf9f296c218641000000000e8000000002000020000000e453b273d0c2b887b63b7edc71b10062de32bb3a4634935f8d660db36f7be042200000004d34ca2be5aeff1e77fac42ea003562cb17b0f9180d90c76fe6a6cb8a2c4bca240000000e3168fe20eb20c7c90c6200157b697bf5fcc533bbc736c467f530a836559b900f9db7adbf1ee94b80cb01d7fa6628417b99bc11d27302939fbd46b6d78ddf19c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4E2C0305-DF7D-11ED-BDA1-6A8031F758F8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "593782999"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388761460"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108d3a278a73d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2384	sdiagnhost.exe
2384	sdiagnhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	sdiagnhost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3404	iexplore.exe
3872	msdt.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3404	iexplore.exe
3404	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 2448	3404	iexplore.exe	85
PID 3404 wrote to memory of 2448	3404	iexplore.exe	85
PID 3404 wrote to memory of 2448	3404	iexplore.exe	85
PID 2448 wrote to memory of 3872	2448	IEXPLORE.EXE	91
PID 2448 wrote to memory of 3872	2448	IEXPLORE.EXE	91
PID 2448 wrote to memory of 3872	2448	IEXPLORE.EXE	91

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://acarmex.com/cgi/ad/login/login.php
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3404 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\msdt.exe
    -modal "458848" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDF3A88.tmp" -ep "NetworkDiagnosticsWeb"
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3872

C:\Windows\SysWOW64\sdiagnhost.exe
C:\Windows\SysWOW64\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
b3190077c7c84e2cfa647d44e0d7babb

SHA1
da898c8fe5d577196138df0b9857402ff931902a

SHA256
ca611b5f7c0759d63dc8f7d2ad6040bbca506e6d3249d4deb6432a5c8fcb855b

SHA512
f64b904af24f47cfd7967fcbe65adeb4379ae137e8cee5833134edf80729977f417f71b70174da3ac0ee26d34567c072e9f988a687b7d1e3331341cd4911df24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
1c6f2bb0a34316e86bab028c29612607

SHA1
36de681009adc02219c7556dc9fa4b6937266e1b

SHA256
fe4f7c8175cd266ab1e00730da2d6f3b83b95ae9e69cd1328b0ef2a045115e41

SHA512
52dba20287695b3ff088b25be58ac7ebb171d536c5c28d2a4c0904d23db6f95af5eb7cf3d7b7340bc1578585597bedf07630a04d5b6323968e55e0a65b10ba04

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2023042013.000\NetworkDiagnostics.debugreport.xml

Filesize
3KB

MD5
e97c7ad70d7408f8cff2f40097d2c19b

SHA1
d14bab2180b1abfbef65d5ae9f20aa45dd67e2a5

SHA256
58fe1fda8c8af8d8fb9d5b2e6a03281a0ed259a51d5683df4dbc9cf69baa82cf

SHA512
e5a09d6d774288e681c33d372956841e8fb51d483bbde87096c9a7d2bf8d00466c6a6c64c1535d2dcd0e495e82066ce42c1d450569b38976736ad01cc5762e87

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2023042013.000\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BMP3ERH\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDF3A88.tmp

Filesize
3KB

MD5
be85cf208e8bed566c58045e1acc58ac

SHA1
2f2cc0e10616a804cdb1dcb121126eaa7caf6ff0

SHA256
8bbae0b59c8accd66fad26e06a3442b4f15e8314de8000ef08af1c85e1a2341e

SHA512
ce6ba393727302abaa2befc90a2080e1b8bf7b786d7ec94cb5323e462fb43681864d07a6f130fd9131a4c25adc8b9abaa599acf0a4537dc1593ff097222be8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxprdnun.pca.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\SDIAG_f6671fc3-2766-44eb-9284-2f8abd553791\DiagPackage.dll

Filesize
478KB

MD5
580dc3658fa3fe42c41c99c52a9ce6b0

SHA1
3c4be12c6e3679a6c2267f88363bbd0e6e00cac5

SHA256
5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2

SHA512
68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2

Download Submit
C:\Windows\Temp\SDIAG_f6671fc3-2766-44eb-9284-2f8abd553791\en-US\DiagPackage.dll.mui

Filesize
17KB

MD5
44c4385447d4fa46b407fc47c8a467d0

SHA1
41e4e0e83b74943f5c41648f263b832419c05256

SHA256
8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4

SHA512
191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005

Download Submit
memory/2384-515-0x0000000005340000-0x0000000005362000-memory.dmp

Filesize
136KB

Download
memory/2384-514-0x00000000053B0000-0x0000000005446000-memory.dmp

Filesize
600KB

Download
memory/2384-516-0x00000000054C0000-0x0000000005526000-memory.dmp

Filesize
408KB

Download
memory/2384-520-0x00000000069A0000-0x0000000006F44000-memory.dmp

Filesize
5.6MB

Download
memory/2384-521-0x0000000005480000-0x000000000549E000-memory.dmp

Filesize
120KB

Download
memory/2384-522-0x0000000005580000-0x00000000055CA000-memory.dmp

Filesize
296KB

Download
memory/2384-527-0x0000000006FC0000-0x0000000007026000-memory.dmp

Filesize
408KB

Download
memory/2384-528-0x00000000072A0000-0x00000000072C2000-memory.dmp

Filesize
136KB

Download
memory/2384-513-0x0000000006320000-0x000000000699A000-memory.dmp

Filesize
6.5MB

Download
memory/2384-512-0x00000000052D0000-0x0000000005306000-memory.dmp

Filesize
216KB

Download
memory/2384-511-0x0000000005270000-0x000000000528A000-memory.dmp

Filesize
104KB

Download
memory/2384-501-0x0000000005030000-0x0000000005040000-memory.dmp

Filesize
64KB

Download
memory/2384-500-0x0000000005670000-0x0000000005C98000-memory.dmp

Filesize
6.2MB

Download