hxxps://tria[.]ge/submit/230505-tn4wlabd77

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/submit/230505-tn4wlabd77

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\AskUser = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390076304"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31031167"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031167"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d6277c7f7fd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2179779895"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031167"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000675316f82fdac74aa8f3bd7995064a9700000000020000000000106600000001000020000000c5b6401c4138a6adebece22558e9680482731e5e7bde3eb0cbfa4545333b458d000000000e8000000002000020000000c5238ddc25415e56a9c3358f2952281fb2e0915e3cb8ac4cf44acf1594ac671e20000000e3f96562c4a4d54063d106b8ad1006ca89b2e4f1671e24da00ff347b07e534804000000055003ac8942a9401ab7019a3f9160a681ffec3f8ca3bd5828389dcfaca80a3d16ff715fba5a9ae81c8e34c37d0fd9087d15ca1d4fcafd6219a800d542b35cd4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AD89FC22-EB72-11ED-ABF7-C2E0088FA829} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2191031986"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2179779895"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1884	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1884	iexplore.exe
1884	iexplore.exe
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE
1884	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1128	1884	iexplore.exe	83
PID 1884 wrote to memory of 1128	1884	iexplore.exe	83
PID 1884 wrote to memory of 1128	1884	iexplore.exe	83

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://tria.ge/submit/230505-tn4wlabd77
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
1KB

MD5
f90537dca1371cbe35009465c61c8510

SHA1
beaf7f2d8f18b5add470e3c10b6c5f7c75d0446c

SHA256
464af60aa127a9b27b392ba40dc6d4e937a7858461b791f1d163c8ef1b9f4fb1

SHA512
40d2b36f1cd1eebd00ce173a480f069a0c3b34c31642fcd93b9dcd2df89970da59d52e499e5546e6d9f9288cd2e2c7e35155a64e5005d42dca0836a8648571d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
416B

MD5
5050209dc9fe8f3442f30487bab07354

SHA1
64dcfc5a74a493e3e04c1d8f492faf11ff73991e

SHA256
8ea9670bb63c89890471c1953c593f67ede34a34793b0bf0b92f19016b8218a9

SHA512
b256a32a86e02a7ce7c350fc3b2ead73fa3ab10b4efa457fc8d7c3c84378ba8af9747a2f9ab15bef083299b208689c8a49fa0190f0414c032d203e1c70fd2960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

Filesize
15KB

MD5
c2aff45deada43ce2ea8340d89074b68

SHA1
cb3671df79e1586756847bf0bb85dd0ad60c631b

SHA256
d5d9f2a6a28547e401039e5b8eb7eb2cd7ea77671a0b1cbe33bb380f049a2237

SHA512
9cbc53ac024ba1e55ac925ab484209b109e27be90ae0bd06320ba65b4698ebbeb15f399d80147cc9eadac3022e3ecaa9f05ae3e6e106d1b94fb6535680ed34ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

Filesize
19KB

MD5
b71c81a11f396f98e465062cd527c3c9

SHA1
a33314504385d70299bfee293accaa7fc5acb69a

SHA256
27e1ce38b71cc157291b91b619961c0461694bbae5e20534bf0f07ea7eb35f04

SHA512
b429c8d2fc45f49e99d6adbe62a8d76f7016b0808d6321b1b76e1b4e934db986a323e25b66730860d25eb036eb9893cf6c49123c537170448caeffe862d21d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\landing[1].css

Filesize
4KB

MD5
1ba5bf7b1d4c712beeaf06a4df6a5c0b

SHA1
31265154f1b7c35c5d54bea913df3165c68afc3a

SHA256
37ac79f27e1233e9f4782b03fbfaf05e5c3062d200a26bd227e8c429033f62ea

SHA512
ab13f5259f938d4f37229d87eda05e545164096978a61ea25432b65a0de968f2ae8daeebc2625a6fea7ca5f2c01ce9a23a171fd381f00339b60a7ee15e871afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\qsml[1].xml

Filesize
481B

MD5
c9539fddbf498f39b02082ec74fea1fc

SHA1
8ff4358ddbfc155bd9bbeadfd295a123969e0c5b

SHA256
4338e075f83d9eb0af593167908e721e968b99867a9d42d7ea9652decc4f7ba2

SHA512
f866f371299551347cebe29e940e983cb554ad044525e5f4ec411194e3ce4851898632fa88177f4d1e2aff362b6fea73a72c29af732e53d14a39822a6f384801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\favicon_triage[1].ico

Filesize
14KB

MD5
5fc2a75feebbdb454d523f27c453cde5

SHA1
1eb266f08c38483a79926d71c0941aa59fa75ee0

SHA256
2235d2487405bdb645954c9b6f28b770265f70d3f634783f63ef6e3159e2226e

SHA512
7d5100ce648fd61a2a63b355c3d1a8189c3e54eedca11417690a7cc1f24d64807a38502e3af8f198ee66edb0bb79b4381265d8b6e5874b4cfc1955e3a2045944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\qsml[1].xml

Filesize
466B

MD5
834205721d1e71d4fc2caa3421113721

SHA1
e95ccc0976549f7f81adac9f72340cdb9f856bb1

SHA256
c89ed6f55be7af98d1642af27b05a343f5269e0cb04e5e18491964f8ad92069e

SHA512
6311ecd78c0d51784fdf53ca23fc141de6576a83a7852309263c213444b251b654f6f32387d1bd0291fa7bf7d985af0b1aa8f9adc6867671a6fe7049b9de4e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\qsml[2].xml

Filesize
516B

MD5
a931e702841ff0fbf1e902041fe9efb3

SHA1
1aebab807c84444a1d0bfbb3f36b58a79b675c31

SHA256
c40d1071cd1ab3e284bf104fe445e678441088ef57e6bf1c7cde93dc8e6b9da6

SHA512
5036813143565fe77c78cf1e726acb3a2a568dfcbf49fd4e859f6ec30ddf3b528c8c0c846ee0cb6d158db7f26609892fbcf4c20aa564e1ad7e497654c9e827a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\favicon-trans-bg-blue-mg[1].ico

Filesize
4KB

MD5
30967b1b52cb6df18a8af8fcc04f83c9

SHA1
aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588

SHA256
439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e

SHA512
7cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\qsml[1].xml

Filesize
469B

MD5
f6b20245a843d0d4abcb8d9287a4c98a

SHA1
75798f35ba0b55f9195b5f30beb5523268d6502c

SHA256
b7c6a9e1d18d90bb8205e3780ff7f666143803fc98be2c083681b604418e1134

SHA512
59f2c782aeb8a95f624b29f8db02143662befc039153168cd96b05e1eb68e4184a150c4642e407449339c1503c8edeb09220f5cb31b5a211a238363b08b52fb3

Download Submit