hxxp://2023-letter-of-amendment[.]info/inbox/

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://2023-letter-of-amendment.info/inbox/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c022b3f4de32da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000506b1c10933614d36b8830fb085b1ec718bbc21aa91bc61a14c24e749275ff85000000000e80000000020000200000003f2d14419e18f58e3be9b02fd0e0a78d495e514386f46bce8abef22df4740cf19000000068d122ecafb8db95bdb1b266a292afcf492c7e77aed8315a046f86df591e14c2141f6e318408735e242c8ebeb5f262046059151a4686021d2fe9bb1d6031a29be3c333599cc7d250b0dd493b4152bb230542735ffe350583835f11959e3a5dbe1c5fb5ac92146b4ce0165a09271854079b50a9e63a1baf4bcd1b2070ef0007e64a36e519f02119847838577bbbdaecfd400000002774cfb1e7e8ccc926d405942fc6bbb8bd2e419409114992e24c633ca17b5ba109158342612280a1da29f09164095142103d60ab404671d97166cbfd8fb1909c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EB018D1-9ED2-11EE-8568-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000b9d2118103c1ab9faa584e916431636289e69c114ba20619bfaa94ab2d63523000000000e8000000002000020000000723791c90ce23e506af4b9eee2270a359827623ecb97a9c2026b3e58c1e46228200000008184d4ebea6af24656e04203ab4722c5cbce87c2285b44c15037b044be64e7464000000010e8d5dbd474de24aaf2cd54315fca7403e7a90cde852cdf9824caa0cda38158412ff506c66f59fa2f31d7c5e9fdfa6100c66b840ea6523bc2b45de5a906aeda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409195447"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2380	2536	iexplore.exe	28
PID 2536 wrote to memory of 2380	2536	iexplore.exe	28
PID 2536 wrote to memory of 2380	2536	iexplore.exe	28
PID 2536 wrote to memory of 2380	2536	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://2023-letter-of-amendment.info/inbox/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40861c0bb5eb9ccefb62f6f2efa81f3d

SHA1
ba83921695b9088e6ae8071a68f31cfc5898ddd5

SHA256
7aa5b200a41d9ccbf357bda36f8e1f096d61eff93a7197cbaf49d8c3a674659a

SHA512
a0ffa4bf1f1fede801e11d7991d543c8afc5a4ff096c36f43d0e0b7354f88cd06e1e1a7254459ada6a3689aaec6a4a4745d83e88a12576f3c08e77dcad153903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a8ef43b796122e8edf1f300d0960d80

SHA1
8b2485435758360eb80e02824f76ff70564c2bd5

SHA256
489d10549997d35bcb288d83cd7a442cd9c514bb4fbda7b4b0b5df04d991c732

SHA512
9acdfcfa69ffab6eb3553ea96cf3e5625c6176d27fea642c6c35eb8c993506ce358217f9987ab99c8deb75be8aac36148d602a9e008165145c2bc61a773d3357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36502150bdd4b67bf155b6deeea786a9

SHA1
1a58fa51d4d8726126b223ccdeb5abab1447a16d

SHA256
444f99d449107ca65e257e74277982aef39dfb456f7ed1f5397b00a889538adb

SHA512
4816fe0f22261cd820d27b7d556a9d7ce20b2f51a7aec790ed45f2cb25a7352f24578fe4c7de4057cdb8b3c45d01390c83a26a11d8270d94bbd2bae0feb586b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1109dae8c3ce6123517d86c71bcb992

SHA1
04238cecd3103f788ea0bd0f014727a308929868

SHA256
7430c5e078f73e9d1b99aeae2ea34ef6fd97b1710ba40eddfc96905adf78be6d

SHA512
0c5b02a31cc5e68438ebdbc98c8efae97270815e7e08f1157f7c0d7f3ead793bf780acbae1e391a0736b8f45bab34ca33dd57810caa2eed3b827fe3270a54a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f44bb60870a0b31d506f2778db26d9f

SHA1
67450d6f8ef60c61544423543940a3df625958ea

SHA256
b8ade0bbed47f277ec5409ecbe3fb7694921266ca65124d1b1fdf33e68a43cb0

SHA512
8b8b4af5ef1f020538947f2696a7c4a03ebda5d7e1177b4382e6f6017de88f48bb48a48e250478ef87e12e68560e16ce7921ab165cf23cdb67cece143fde6b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fef4998fa2178170185e06e3daa1462d

SHA1
371bd64134b469c5f78eff38139f3383bccbba26

SHA256
1549bfb53491388091be220f13a8e3640b365100a833ef4efa7b263a97cefe24

SHA512
331cd0af1378f70336e2d389273f975b83618e73a2a36a46f19c6910cfec19c9c43de3c4331dd079ecf93dac77adcb8250b1d006fcb5aa64ea9856545c30b854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bffb12c55633ca93f456e991e97c0df

SHA1
01b2590294ca311178c46d6de817c3d2e3dc56b0

SHA256
00e59fde50a235edeb7bd30e5ffff4f9ab1016706e1c0ee2dacaa1057f15f5e0

SHA512
3d5cc3a52cc3ac8a09224bccf55a3c7f677e125505e3f4a65f130c00dc9e6497edee6e0806acec891f1a7a1d85c2c12b5d8d5bd91e49cff8f5544765c0c1ce81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e67c9a428a28f922dd6224e6a74a57b3

SHA1
074ee9637a09b0e7e9c4a838b765e6bceb647f18

SHA256
f5d19219e841be3a1402eb6836e586f2c277caa0a04031101607cd9d203a3a6e

SHA512
094308104c3eae2691b18f5bab01599054affd3dd1967ed29582c6e9c4da81da959b66185dac6f315d9f0449b5b4a12d10bb4fced41bf49180f17f9559304786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b402a2381530fcc528d1d0fb381e81

SHA1
ca3b931dbf8eea4c962dfd47837c174cbd6d831f

SHA256
3e16bd39126c73e9fae1df7550f4c8c5bf85aa4c6cdc2974ba384fd58df7f8e0

SHA512
e1ab122d2b373a1cf75ba1b185fc5415671177053dce51746ca14ead52cb7a0908cf73e8990d9b52a3c52879fb40cc93d8e2f50dfcc7d24426859abb48baf080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34ce3bf2bbc700c405d0df86bdbf2965

SHA1
b1d92dde1933344f83a526765186c817e5157f49

SHA256
beabb9cb582b5a5b79acf0a59466fd41e706dc1fddd3078e0d75170098f0cc39

SHA512
d4596506569eb5788e81bf3a61ce8765fab9354e663bc0109d9e8e0f25117c97469f9bc41ee617e55d885edd6620cc5c398a7965feb9076c1e9b9f74800e7a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
096e6ee0c4b6a4d78fe31e25cb40dc02

SHA1
c0733e9f87bda662d7abb8860366aec7bcac5078

SHA256
be25e4f0bbb129a7916868d7cc2c018b96df44db5bb8ca8aaa3d66f6acd7477c

SHA512
e726b23f267ef877cf80ffae69558e576bed2a58c031f43b48b8a48dfc9b9dc7b330b28fc51f1c797b23811509957a03233997ef80fe003a73417b7c739aa904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53079c7e14434ce02e1b0f5efc3f8401

SHA1
44738bf0053f03481b747dad798eba1332a91c04

SHA256
6b6f1b2f699816842803bd1f982856e88348da2466a38355076310977c061812

SHA512
3fd10dd42838b578e59471184a3a722908f03c62843c3db5c7da9bf49837bc10288d31c42db1ba14ad53cb0d61caebc9ab69569b85a5707c8109f98f3f57d184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9b4242b4990824cd60e2dd9f8641dbd

SHA1
d0d0bdec04afec891047aa730e1c03cd9cb4ce90

SHA256
48b9159f28501c80b082b8cd7ce14b558f7929c7c0ede253002c5128dfc64bef

SHA512
80083c9db209e94f8f2dcffb8d4ab81e66fa5e4d907221475a97269ed46b06bd376db4c1af9c8823b648d4e11ef5c8200244bf8a3b134b462bfa09dc3f4fc132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52e2a39203a49decf66914d6989ed78e

SHA1
8b2161a767c5b94663156387f7d1480cea81b7d8

SHA256
82f4ce56739dd05bbb7af1904268a4098f03b98368ab70699b741c650c8f9e6f

SHA512
3ebebc110eecc2011b298c34e48cb5a8c279097571ca1daf9190f74db726a19b49a63fc690cfadc1feca729ce549cd23b4d26f8508c52eddfe106ce24063cf77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cf94e98c2e07041633c7c3fd426b3a1

SHA1
702d14060fd35f2941a6ff1151a0764cd4c2eedb

SHA256
dd8332372ad8eae985afa55625dd809888b7bd1ea1b621916d9fa038f4ca63d5

SHA512
8845500aa09e3f90b422ec3d0b9cba0daef7f7999d503e6f67592bdcbc727f4ae2809d46eef426964a6d5f74659367df40f915d0d03810fe188158e1e719c24c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4878e20142d6f4ff42cfb7992f5a21c

SHA1
523d9d72274ed3dd26cde4eec60643cc3b5610c9

SHA256
04b1f674022c17a90759bd32c51a0e19ae935b6d03ee9bc5d09643ce46e97b1e

SHA512
f4ed7ba3528da09e22f589a8454ba5b7f879257a4644b2d802b83112cb75006df14720ae2ffa6ec331637904d9de6bd23ddee7f0991cc7ab34a4d72f31172151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
869824f1e5f5a3fbb8c95835cf915d29

SHA1
94a8e578c3f0d78c0c0fbf6c75f5131735a214d2

SHA256
cf506041d9750ae53e176738b0038cdac273aee768c6657ff71179985439ba3b

SHA512
20db6632198fca0ed178d6e865ed187373e6fd31d2bfd5dec66d0d0b7fb21ef54f21c614cb3078e583195b581d4387bc4df09aace9be88068a96edf57d52a801

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab79A4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A45.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit