hxxps://keyone[.]jp/wp-content/

Analysis

max time kernel
143s
max time network
141s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/12/2023, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://keyone.jp/wp-content/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd5000000000200000000001066000000010000200000002a444869570913f3cb02ad2a61563e90e9f08ca3f945f1b83f405ca5d8f9f15f000000000e80000000020000200000003dfcf803a4c6c8d8ab8b2b1bee5caa72e65cb6717c0975ef9e1662a8ee0cb9db200000001430e2220b4177ede009a675c9485e8481f175270724d82aa0a5a9224d0a49ff4000000047fe0592b61e8d59e9115e1c1721aa00e894d8e57b181c5cf3ab4d640aaf58e657d19ad29fcdd74febf3223f9b834745d160f616b63035dd9721e7efe0881f51	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d2f76cd52bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd50000000002000000000010660000000100002000000061264c3e50f4e96e632adee69c061e5d573225b4ea1dab92cb202d77bd55ed0f000000000e8000000002000020000000a64ac7f180c16b62f7b4b551f160fec490a099a5e562fbd233c3fe94e9f16dd0900000000c91c4103eeb35ce34f3805c49995b57a46aee6b0e22f960b360e169fd4dba4dbb0ed6f8102d6c52d10faaaa0dd2013f6c5246f31b1ba7e22190ae35c4508d98c147d7bf36f3b054e9ebacb47091f6661bb5c4b23a90b494d397bf7e324114cdecaaeb25694a01b1d5e5dce2a63617d8fd17e53574f71fa0b370c0128f5abba0b082448d53abcb26f7dec979812141c740000000338fd82dadd4ab192639fd0cb40cd189fd8f855df15f379823a9511991dcfcee1834a6ecb1427d527b856a541e1b0005fd0f57c0091be2496763058e7744c17b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "408421699"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9419EB21-97C8-11EE-B336-565D0F0BCB21} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2232	1960	iexplore.exe	2
PID 1960 wrote to memory of 2232	1960	iexplore.exe	2
PID 1960 wrote to memory of 2232	1960	iexplore.exe	2
PID 1960 wrote to memory of 2232	1960	iexplore.exe	2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2232

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://keyone.jp/wp-content/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8c966da7045961b5db4faab612928926

SHA1
5f88f9d3e68903841d7163343ee368d637ffeae1

SHA256
97b005efdb7e7ea1824660f6b706d051a975c24c169af5c01ded13cb3ae21b6b

SHA512
11482be4fc52564ec12692c32d92d2571d40745882746dc47e7dc43c0d20f63a1306e1d2262ae0bb0c32dae570a9e6559d7ceb27ad3002f68d62278b1b1b9188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00b3b20d19b31725bde7824fc54f6368

SHA1
d64dd6778cf6783668c44c42a45bd8a851c81ab2

SHA256
3d8593a04c0c7a69f8a4ec88a83d1bc4e7bf1181cbdc1d1ac49d311f4a8e5ecc

SHA512
77918596735d2a80f5acba5e4ecc9cbf8f00ff2e5b7cf4621ea0a05266485905b6a470aee9de9b1325703e9e31f614c6b696b32ff7174356a5da99c9bc8804fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85b15a0992620a635b2a07bdd8104338

SHA1
30a9e5b923581c5f5d32778e27a314ba22f38195

SHA256
d432d14976727f3b9abcf481e55f9e69f9beb2be2937b8fd00415734fee60766

SHA512
a228b3dafdfe7faf9241481bd1bf2cb0f0ecfa618320e4b8bd406380f12e6b79fe84070180824b915a2e946c15a4c265fffd5406aa8357675ac72308045f0930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36c2085e9367f54e0c1ff282996563e1

SHA1
b90b77e6ea1c396f62bcca5563dd666bc1616217

SHA256
45e138819bafee9758ea96ae72ca9c6a5d35d7ed3422d32932f54317f5f8a2f6

SHA512
f7f3b8fb0616375f91eaeb76a78d1af8192a461e1b124f79e0d8f24166498f722660b619760f14106adfa8306e62a340805e0f7211d0e59af5c35f60eb0b43c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c029cd783fb4c834b8f8c9822917d159

SHA1
3346eed4feebe1e0e8c60d13b74678594845a124

SHA256
76b0da499a0bb784f50eb769ccc1d6014b83b11bf405072e4b1b9ffe1e3b7c57

SHA512
af578c02213e467ff446887f2efc00b316e1e9f030e04c2bd8222eb64760c5f80eadc2764fe558664f112ea6efda826033b83814975d0f84abaea493e4900084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cc9ca5c0771bc826edfe96a38296861

SHA1
c9d233051f00b0ee95dadd8abece2b1c57b980bf

SHA256
bea816511ed332e1096c8f3d214a5aedab4754de6f240aab1592713427955467

SHA512
9b496154728ce46f10aa80175677bc83b1eb6d322217ea7ec5a26e291dda525fc3a8259fdd5a67b1677cc0f8c326e5eba47e83f3cefab27679328a45a6e4ccd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6174c6d42e0025f064b6b4cd23bbb1d7

SHA1
ff53b08c1769d26b8db626fbd0515829dc1eba8c

SHA256
08575db5e90c32a290e95425690190e6de1d3fb6d3e0a1d9bd075dad27f9f8cf

SHA512
8770c5186b1fadec1e08207d3d33d394376c0c56ea928ce8312ca7c6124de8247691364e7af5af405ab1717007d94d1a997458f087343b89ee20cad74d0dc683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8effbbca7463c153dba2fccdbd29d46d

SHA1
7b8940b9784294bddb44488978932b975e313550

SHA256
7713f44c7d586c493bd1365c57a01e873a2fea21027928ea5d21c664b2080324

SHA512
fd2fd049e0604283897f343f054dc4294063f0144a6e2458dfa7bca1130d3ab8f5796feb6835e34d7788ab301583abdec0eebda99d1fe261a3615a899b1a7586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef5a0d09df7498a4948ecbb19449ba14

SHA1
8a1ac30fc7933b34f02424c1b5cae73705b8de99

SHA256
07a8077264598b937e51b83182038171b5b7afbf8a5aa640a4bafd98f685f342

SHA512
00289dd77e1f4c004cecc6b35fb449c623cc85b898b16fc908d2030864162eb9a39c9855e452238a9726d650149da1c98bbac4dc74169d23b966af3846e3647e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
975819c31b8a298628179cb3e89f6394

SHA1
be023d17da5c6596fc03fb67b0b0be7f9449bc78

SHA256
d3a4b37394910581339b3d7a72ac9da115d2c165d7020e1012e0d59dd657534b

SHA512
ea10ec525233017a9418079ede915f0cc067152732058d9b69d594bdaa07be56a6b7681114798c48a698b10be04eaa89032fb6e20c86559296596212f9a4cf33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5e3f9d89ad94f6df0cb6d863519cb45

SHA1
fa8470c2cf8e5914149e90bb328da2f7fbb0b2e3

SHA256
95433e7bea6da6fe193d3c59ae7fe76e6fae0f238beb484e4995267281e60b94

SHA512
ed93788a792594ec8278f43e7aad00bba5cfaa9466502f05991661f53cc58ab49d7e57db7435e5bd175ec6cbbc3116e6e97a7b2a4cb64f0039d25d3779a9d092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c8c7f3a3e7d335b62f159f5938467649

SHA1
a012abf66800f79d1bffc93416a0f107068c67e0

SHA256
df6f9e4e26cb6ac4165d7d40a5b11a0c06e6042b2a662d6b8e638e5ad8e73d2f

SHA512
2ce590e29a56847b61b2cf5915887a159a446a81b983a87bfeca834c0772ee3c66a88cef1bf3a056f88ff2b62d43f54362b11ca90730dc103cc678511e69991b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7594.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit