hxxp://lodgemyatog0v-confirm[.]info

Analysis

max time kernel
136s
max time network
132s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
10/12/2023, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://lodgemyatog0v-confirm.info

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000cb3df86275a3affa5d7dbe9a6bae056627d2bbc75e4214fca674c3bc28878e75000000000e8000000002000020000000368534eb26a8dfc4d29b7ca0b8ee04c2753c90d757fd9d709ed564e9de090f3c90000000ad686374092ed12b096ae6aa29e063651ef93c4f7b9989ea9d5a0e3b631accc503bf4049a0f2aafdc01f03569eb8345a07e51dd20e6c2f5f0a35564b3b875f19221931a078bfbd40d79f3e587f8254a38abb23524b515692f43cb374828fb667f1e84971c75ef431c6b8a7ef865765dae29e9258dd04f54e59f99e6e51f4ec38bdda05ceedeb4a6ff1e32d98f7ca17bc4000000068ab4a22ed117fb9ea78007f6e74a845486572d22a571c8e414668cc21087023353b904c79f50e3864249c81f6e110959102e478575cde66bb011888901dcebb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A13CF31-97B8-11EE-87A6-C63A139B68A6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "408414643"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708160ffc42bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000ca7c0071fd3fdeaad21f742b96de454425d6d101e035d14d6eb265bce31c2769000000000e8000000002000020000000ae569747b69e61cf9d8e1a2b3e7b58f6023ff5fca704f5b5b78d073ef97b84d02000000049fc88728c6ddbacaa263465543b6800aff24a3f8f8ab24af2fcbf3aa09c67d5400000000a71cd563762729623ce338794eaa189bcfd41550977287a29035c36bf48735b2709f265858eff793fdc439ccf49fa607f6bd19e53ad31a6f6d6f84f96de0db6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2296	2508	iexplore.exe	28
PID 2508 wrote to memory of 2296	2508	iexplore.exe	28
PID 2508 wrote to memory of 2296	2508	iexplore.exe	28
PID 2508 wrote to memory of 2296	2508	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://lodgemyatog0v-confirm.info
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3889272ebb432e43c470b13839369c29

SHA1
08c1cbf2baaae8cd4f2531269a10ba95b6af1e28

SHA256
89c40c8e74814b10ee01e7f11649cce6aaa6cc46f943ddc2ecde9c0ba733b886

SHA512
47f35518564c1afdfdf7678f8e720c15840608ffac1cb2a81812e5505af16576db1afc3291dafac93856dda6dd09bbd0afb25aab0b4dc70030b1a44853ad4766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb37ffb3d59ad09502ea31106ce77b9a

SHA1
5b2d987b304f01bf90c51a91e7f9da62738b7b7a

SHA256
b78c4b86260091b7447d27be8b88a2d288771a7d04ca717ab2690f90e63f85a0

SHA512
91b32af6c1989c174a96e4565fc11167ec1dfa0a001540bb953353dbb97e840be5f3a92ad4410c04e27f779c1abe1dea1dd314bbdab0cf0895825683fa363a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63c738244ec0178356b36875ee25752d

SHA1
78bf374b7adfa6629df5ce24eac929648e5c511c

SHA256
0f1ef3cc8332e454b0f3014581ba23488ec53a7cf7021034d2b2ff38a38bb91a

SHA512
ee6b81f2b577c49572678885b60ffa9c32e5685e1f86e63068bc1a2e957d36e0a5299ddbabb52c76e2e18704b50ac88f34f97b4589d9cb3facfaa3554a7e783d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
887e959d40c12a341a04a3f5fc463697

SHA1
dd984bb8c38fe7cd9cdd5734a1e5bdb463eebbc9

SHA256
a2a2d05d377ec73845cf928065ecba38c4ed0a2d75751ddbdf8548c33f4cca13

SHA512
7e4e9cc022c49bf885fe5df2919570edbf88ef2996f08ad7eb28bcb95da2ae9c40ce8ed79826c269044df68300e5219427681a9210c5e33944305700e4f44bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cb52392dbfbd1838b94cd7e79c98d19

SHA1
dbeea7688e7d21c46ba84bb48d0cde6202189dad

SHA256
a5688e7e87ed39d3f8ca8bb6ad40d460d9fe13644d62a4786a47eca78bc2aab8

SHA512
1a84b7b48c2c91d76461dc7f1b8a2d7c01afb6520fe9b8e21ca19a3e6dde4af58bf1cd7bdc46ef4f25cfe00b8ef1d2f9af60445946c6ddcab2aad9d74da07ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e3c8b3a9f18736cbeecb07e35e62f7b

SHA1
30e6defc36857cb53641f71b1794a9c72ead7ed9

SHA256
93fabf49a2a27972c31462a1cf017103dba5482be2216db56a10079f199ec51e

SHA512
35fcee3a8bd6ae7421560bcf7164f4193f084a0c8793a20185b2a676baf3111837b70d979a3cf72a7619d57d1c89f8cbc0006a5c23d1edf81bf9f6c51880c033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ea9fb1aed0eb5521e28c22952a38e4e

SHA1
ca3df5d05ff3c46c4a04647291cd002384121fc1

SHA256
944706682c852bdfd751a9486a690ba0954536338d8b4352d52c7397c29bdcbb

SHA512
e4f560123f03f2dea12e31b535b752c4dddccc532a418c658bc949ddf5a715d83d628ee591e514a774b06de6dedb34653ff870fa70399b9d35f29379f1cd9984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17f2e50010fab0f650ace722f98afa65

SHA1
56c14ff7090624e3591134be37bedb250481bd23

SHA256
b55e55aeb88a4bc008e9aafbc9e37f96b24832ddbc17384dc1ea85ff0b504f20

SHA512
e167f3dcf403f793ac66ccef8244f684d91c29203830207dd4161b5705e0770d29d5b5adff6a0dc248b81d36f3e573424a01cfd77879369182ea3871f9d25e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
800e108e156be4371d1c431b04ee4fad

SHA1
e4dd4c521e54d4ae4d442e870bb7e39d2e8345c6

SHA256
dc5f288818a59f714f68c943e66c1ff2afba8993e2b4abf652f434e0458086d9

SHA512
2b8333fab6fbbda10432840f70bd994cf979132e2de79d8247b017f77c384c6e8b8cc1164ab059a9d8aac4ab1c24d2c307ecc3c95d3b542bf8ef31d02925df7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d675ca5968fb229bd9356867f95962

SHA1
a3af2410d24909649c11e581c7f2c22d3ee76118

SHA256
4be3fb488d4f2552130b6cb23d6c5877d15e41f706260fc2466220f498dba756

SHA512
4725d0bbbda55d1f0881229edaf6060632d8bba194985a3e81de4f1f956dc0dbc904a660a8cc3beeb412e4cad815780d8623ca3362527ac450527eeeb47a4469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35dfb759a7c8cea04025f4eb9d80d72b

SHA1
2640bc1a09703c7e1b96bb4be6c4da8c9244d981

SHA256
7cd43812570b269e438cb992992cadb73bd87a483895a75de6585416441de5e4

SHA512
5d533b467002b40aaa7540e02636faa5e152925294e53ae7022affd83b7b2b2e94781bb885889be2b0ed8fbca64936cc2653491ee2d271500c4a38691ddd9dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b738307af45bab84283a8d0ab05b1bdd

SHA1
2790e89a65cfa904972b0a6fb7a55639a8d8f06f

SHA256
1de98f2262f75178795c7f4063bb1273ff6d5da5b47de4837f3d174d32726aca

SHA512
e2a23feb9385081f5da6d5d9a7c9fe42ffc11d96f88a8f8d74af4f0a8f53aee10e6a59f11596f6056995ac0b244b7366d77cca6262dfa613764aa1c2a068a39b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d9542ca2651b15b89596a37ea895e5e

SHA1
0b8247b66c170d415f9c74dee13fb13ad0690dba

SHA256
a2494d995141fbf7e22a33d9499de572316872c1239570f2dc145f666300b19c

SHA512
aabe4ada685b3b18537e8df3f9894ac12a6631000d7d68e0b088800733e9ff0f060d6239e3ec57b0f8cbfbcec7b055a7b5e28f528eda306b13e52ae092578320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1076ea720fc9310c285c9b4060d2249d

SHA1
2777e8f9331b25685c9df414062423462659432c

SHA256
f26f198cf5bd14b24d2cb8f9463e616c628ef980ceaa238c1a805b32d4178965

SHA512
f3324e4f49bdd6ff323efe64e0b4f02c0a777f5dd4cf9465eac7060a74c5893ad18150723c4a0e5fa2165d5acc0d809bdd8b2da07e0db5cfd2a78974d625cb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04e2bbae9c4f480cd270445224f5be7b

SHA1
dfd7f3437452a2750a1e35ec1b781c88a541e0fa

SHA256
428a297379f8bbd8c7dde1d6b286ac6f32ffaa78970c1c64d8f6b1be16d2aaed

SHA512
e8dd0f6ea6061dd4d92239e8917f2456e3bde581c1700adb70aacc4d628e7b2b1aeeb3ec18827b4fe01e265ee4a3fd4a46606d8f6c05a2431640279ec6634a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DAB.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FD6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit