hxxps://tria[.]ge/terms#offences

Resubmissions

27/11/2023, 17:27

231127-v1lffsba2z 1

29/08/2023, 16:34

230829-t3d9gsdg77 1

29/08/2023, 16:31

230829-t1lksadg62 6

24/05/2023, 12:55

230524-p58hwsce64 1

Analysis

max time kernel
35s
max time network
38s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
24/05/2023, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/terms#offences

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "711703237"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56063AC9-FA32-11ED-9346-FACD29011252} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31034943"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04a452d3f8ed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31034943"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31034943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003569765e45d82548ba62441b87e0be9500000000020000000000106600000001000020000000d1a0951f0fcf45f77aa5dfc3b2f616a63c716719a26de618aeb0b18ebe880535000000000e80000000020000200000007387283bfd3cb8d7466c7e6f223ccb06458d95c34dcc188d32b8df1ce73a5e9020000000cb8576ef19c4acaf7a77050ec5ded8f15b2b8f5db21268836084e4c1cd5f9e2e40000000d1fae5769f2f6068cba7e688d722b34db08d19539a054bc464c6557b4f80a4f95dc5256de3207ae346c832e84ef959c44d1c4aeb2bd296ee09dc17774a0f41a1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306f212d3f8ed901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003569765e45d82548ba62441b87e0be9500000000020000000000106600000001000020000000fb2a47fed389f742030ea0724452f8ba441ea27694106d7c46e15a3c46d4f683000000000e8000000002000020000000e4803bb3d429d8251784c61269ef8213a147861ae369439ae177e16bff870efb2000000035f5807760d050ce640fe983be28d17b5d9866c583ca763f93887b7425068e1440000000c7d761230ca06073abe1510d9c7097389f1f4281190c06c6e1d828a0406cff7ca2ddda8cd391a4ab7ce2fd4b5978a4d5aa551a44da9fab05792bd332e4694ea5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "711703237"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "724203189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
404	iexplore.exe
404	iexplore.exe
3348	IEXPLORE.EXE
3348	IEXPLORE.EXE
3348	IEXPLORE.EXE
3348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3348	404	iexplore.exe	66
PID 404 wrote to memory of 3348	404	iexplore.exe	66
PID 404 wrote to memory of 3348	404	iexplore.exe	66

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://tria.ge/terms#offences
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:404 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
3fbb8ee33354096d9f116c557a402d14

SHA1
f75756c42d45d1047eb04fa54bd7702f5560df4b

SHA256
13e2696561dd0955e1d61f7e18166c8bd7a02faf1dbfe04e738b5d68cc2ca57e

SHA512
cc21e56f9278282b3c15964b5618d42bdfda83b245d7bf01d12550aabd69a9747d1deaa5a9a9830e6d6a47465f580e21e0a7621cf992b56244ad4bee8779c338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D61F59A72925E123D9E2FAEE69729CBA

Filesize
503B

MD5
6944c71121aa0d61a5624d51b7a7281d

SHA1
26c14fae1d65e74f86e70c0f635e21de54f0d80f

SHA256
2c2f51c01e96cd929a700a26dd3e2c448e92d1c1bccaba4c7c16861f9eb69402

SHA512
a610e8d7ad903498d4341aff8deef246e74a20d860e7e3aaeb1e1fb7a0871386807f44857a3932a874e4a10c57b0213936dc14232a92fb3c860faf492212df2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
90686167317ad6e1fd96adc10c38cacc

SHA1
0b410d3e3c8d8763576b3ce540b70a3d4b209982

SHA256
98d7f996e459e28a1691de5794339d0ca75ad303917e6c5e4a99a8b807ed626a

SHA512
91196d53130a87fae6d79faed2c377cfe115ace0bc18849623150ae0b49e4e44e05053825b993ceab028e116ebce11b631b01636deb6a9fa78086388b895fc2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
ae652bc02570e24d1e33ea1de5ba632e

SHA1
f66bc76aa0bce63f0741bd30d554a3be72ec5aa9

SHA256
19e48b2f9d403a3d0b96751bafcf20034a99a2c0b4438b650d05e101a85c04e2

SHA512
49d097c2c43547e7ca8e33a2f815a5a7662d1c12d554feb6bcc9779852dbea9d0cbd8d59ad7db4e8bd903eb792a53385da24e9b3cc3d5d63346b2c03d921395a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D61F59A72925E123D9E2FAEE69729CBA

Filesize
548B

MD5
ab7e366b3ea39d16f8834ab8d05acc43

SHA1
94f5d31c47527b12305da6cf828b53f8999fede8

SHA256
8e370a7f2fbc1fb099fb624c1e7bbebcbf193e8de6369310668c8465a2d1e4c6

SHA512
90667018e69b6b42383b9eb1303803a8a14f872d4430ad34cee0e5db37fe07c87b311892ee0fee065903f05f73438b00ccf4896f7a72767d9da7b5333a871a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMT3HFX2\favicon_triage[1].ico

Filesize
14KB

MD5
5fc2a75feebbdb454d523f27c453cde5

SHA1
1eb266f08c38483a79926d71c0941aa59fa75ee0

SHA256
2235d2487405bdb645954c9b6f28b770265f70d3f634783f63ef6e3159e2226e

SHA512
7d5100ce648fd61a2a63b355c3d1a8189c3e54eedca11417690a7cc1f24d64807a38502e3af8f198ee66edb0bb79b4381265d8b6e5874b4cfc1955e3a2045944

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD2C091FFA8492E85.TMP

Filesize
16KB

MD5
8a6280d3bcf3575821a1ac2dae9a6c7b

SHA1
6e0004c441eb50495881882c74eb4987a352ab14

SHA256
3f952e4cfcc1c4e3575cd4e42cb885076be1c6dd80922d00b6c59e1400c0b021

SHA512
bd780f2416a46dbc248d2eef8d3f7772dea9596d4e1d2eb5c6b9d23e4b39edd1e7e3f007ab41b6b1e77c31bc4e66d02c74911f79b3f5d4be5e803ff4a3b25904

Download Submit