hxxps://https[.]secure-links[.]bloemlight[.]com/XTTJkcWJEaG9RVTVUV21vck1WVnRLM2xPTVhCR1MzbEhWWFJ4VVUxQmFGVkViM0JzTHpjclFsRmlVM1pTVEZWM1lTODVVRmRaU0hjd1JqWTBXVUl6VlRaTVNUbGxPVE53VEdsUWEzVjVMMjVDV1d4d01rcGxWVnBQYVV4R1NqRjFia012Y2tsRU9VSkNOMVpLZG04MFIyNXpNbk5EWjFoNWFEWm1NbW81V0daSk1UVkRPRGR0WmpSR2JUUnllVEpzY1dOVkx5dEZNRTFGWVhSQ1pIZ3JSMmh0WkVvcmRHUmlSblJuUFMwdFYyRXJWMHBaWTJjNFVGbENiWFZ0YVhkR1IySktRVDA5LS00M2E0MGFmODE2OTlhZTFhY2FiZWNkOWRjMTQ5MzI0MTc4ZTY5OWI3?cid=1139047951

Analysis

max time kernel
35s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2023 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://https.secure-links.bloemlight.com/XTTJkcWJEaG9RVTVUV21vck1WVnRLM2xPTVhCR1MzbEhWWFJ4VVUxQmFGVkViM0JzTHpjclFsRmlVM1pTVEZWM1lTODVVRmRaU0hjd1JqWTBXVUl6VlRaTVNUbGxPVE53VEdsUWEzVjVMMjVDV1d4d01rcGxWVnBQYVV4R1NqRjFia012Y2tsRU9VSkNOMVpLZG04MFIyNXpNbk5EWjFoNWFEWm1NbW81V0daSk1UVkRPRGR0WmpSR2JUUnllVEpzY1dOVkx5dEZNRTFGWVhSQ1pIZ3JSMmh0WkVvcmRHUmlSblJuUFMwdFYyRXJWMHBaWTJjNFVGbENiWFZ0YVhkR1IySktRVDA5LS00M2E0MGFmODE2OTlhZTFhY2FiZWNkOWRjMTQ5MzI0MTc4ZTY5OWI3?cid=1139047951

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\secured-login.net\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{80A7A852-FF40-11ED-B7D7-F6AC10968584} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\secured-login.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1461142221"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31036237"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\secured-login.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\secured-login.net\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1434889629"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\secured-login.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1434889629"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31036237"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31036237"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\secured-login.net\Total = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\secured-login.net\Total = "0"	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1013461898-3711306144-4198452673-1000\{C46A813E-D2F0-4E6A-85DF-AE2076B4B4B8}	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1692	iexplore.exe
1692	iexplore.exe
3264	IEXPLORE.EXE
3264	IEXPLORE.EXE
3264	IEXPLORE.EXE
3264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3264	1692	iexplore.exe	87
PID 1692 wrote to memory of 3264	1692	iexplore.exe	87
PID 1692 wrote to memory of 3264	1692	iexplore.exe	87

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://https.secure-links.bloemlight.com/XTTJkcWJEaG9RVTVUV21vck1WVnRLM2xPTVhCR1MzbEhWWFJ4VVUxQmFGVkViM0JzTHpjclFsRmlVM1pTVEZWM1lTODVVRmRaU0hjd1JqWTBXVUl6VlRaTVNUbGxPVE53VEdsUWEzVjVMMjVDV1d4d01rcGxWVnBQYVV4R1NqRjFia012Y2tsRU9VSkNOMVpLZG04MFIyNXpNbk5EWjFoNWFEWm1NbW81V0daSk1UVkRPRGR0WmpSR2JUUnllVEpzY1dOVkx5dEZNRTFGWVhSQ1pIZ3JSMmh0WkVvcmRHUmlSblJuUFMwdFYyRXJWMHBaWTJjNFVGbENiWFZ0YVhkR1IySktRVDA5LS00M2E0MGFmODE2OTlhZTFhY2FiZWNkOWRjMTQ5MzI0MTc4ZTY5OWI3?cid=1139047951
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
c21444748ba8f51ef6ef531f3b4e2f68

SHA1
af1907ff43ab2c03e0c05044017533cb6eafff5a

SHA256
9d80886561b2301975168964509698c1f96e0ec7515a553a34b6a78690065563

SHA512
bbb8f887d412ca48ea707315135687e5948bfd3f666b046a13a392aca9edb146d85c99516c4f8985c94e8ba777ca1b09a4fbea5358da72041424ed6334d2ed5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
54cad561ca7b1542f25c5106e9a41b17

SHA1
63322b5fb832ba2cf87af8edc759673988ad0eac

SHA256
e86795f041c083151b14bb16c304f37c66384ce2a9219b9652c187af9cf55a98

SHA512
cfc7c3954952c5a33453bfc5347f886c5e0d11cd4330a179d248bd63440bd5620666c7e8f9b0b50f567228c1909f3e1b9868380bb0b2f1e21be97df33093cd2b

Download Submit