hxxps://www[.]banrurall-app[.]line[.]pm/

Analysis

max time kernel
141s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.banrurall-app.line.pm/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94E0E5B1-A2B1-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1051a86bbe36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409621279"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000001ac3bb5ce45d4520feb1577c2935844c33c2df104ab73151f9c6b3ad8228f02000000000e8000000002000020000000e8ab7c25d43dbf79d2a38c51c21c5e5eb9790b8e50c471654d2f948c4f7e70a2200000006abbfed30fd9ccbb3d87d59cba579c67dfe2e6fc35b163d74e84e12db4bea22940000000beb52f03551a5c3181b89e6858a78b5d7c13e3b3c8fc9efb176151fdf9da70f01310be8cdbbb2bb77c90dac8db70a66e7409cf270cda781543a332e21c34a68f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000009f5c04f32ca8931ab523a9015364a1a8950e16fd0c5f09684a33c41d52fd612d000000000e8000000002000020000000f01197a68bd2e6b5df81641208546f982d239a3c75dccdb5a49b2601e35875e69000000007117fc67ee6c9be28d6af98a826739257cca80c95e050ad6f6a0a84391ce272a40dacca3b90e4615ab2f24519238f0e304de44181c66b21c89757c580efcaa01450faa61b0b311e47eee6215a379826022c64a806cb08ffac236841fcacad160a3dc2c1d0577aab6c058ca4a7a9fd1a374dd69469d1a997b3205324d5171ac87dd00d87a21fc59abe3f036cf05346ce40000000c25f07de6869c88ee862a88e41ade0e4a6f2ee5327bf8b6c17a5a9b238dcf0214125b2ad1aab94e8c539aae73d382e7ff69cea25257dabf5d181adb6b0661411	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3032	2224	iexplore.exe	16
PID 2224 wrote to memory of 3032	2224	iexplore.exe	16
PID 2224 wrote to memory of 3032	2224	iexplore.exe	16
PID 2224 wrote to memory of 3032	2224	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.banrurall-app.line.pm/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9885b994e951558bc521435f2fe4d047

SHA1
953032356a8501e5ef5baac19d5749466b614f89

SHA256
cda066a87b342f2096225f67a3dc93952cb1abd20cbdea3b2f0e0224e6ade673

SHA512
36c1825fc32dcd0fb91233e94bb1a2916bf7b1944cc7617d346f3605ac95866686968bfe83bedf523fc974b3c43ba3ffca34fb65617c904f28b446210082bfd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee474225e99fba3802b5faaa3e78d46

SHA1
7fd2d8650264c799a502f6b9830f07b576650a83

SHA256
b5fb55853a2083da5901cf7760bdb8fda32866beaff8039a24eddd711365dac4

SHA512
80613fc372d4c59035a1b14d59d09d5d4613c7ed397afacea384a9e5de6a1aefc5647b34564960fc6cf514fb71916a98c02e35e1ce62912900d8b7662d286d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f5461a2c7125a900ed55b9018408fc

SHA1
937a96552423c9f1571be8fc5ae640925b6cdfb5

SHA256
57b5f716cb597090e51ff845234829735d4a5a088f668a61881dae294410d078

SHA512
957ca272a4d1f74eb727877f6a43506174a1994abdabf294274e654e633b946d3b6540538a6d723029d283fcf3ab3eabe47e16dbca034a9ef3ed50fd78cd4859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc207b95563605c49ef67122248b2bf7

SHA1
b007180d6c03bcc65661fa750cac65d1eb7a1d62

SHA256
f12e518782e7083ddf69c4f6ef6bc88769876c345115d0992f31efcf362fc656

SHA512
723f17f444b47805a0a0f6bfffa8a1686f606d803bc137ee4706b71365a278b09df1155464584516a539b646f5bc4b418baa73a297e62da16147bb10dc548588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd1c5ba4950279d862e30168de9d240

SHA1
e794e5f4adbd9017c3db2ac9a3f486fc7705b77d

SHA256
2d623b4a68455fd6b1eece62eb41be235684238596f343be7c12e73ee98021ed

SHA512
a63958498b71c23c42dd74a2182ff4113deed36df24a54473a3cbdf6352ef3c2a9f069c5723bc17aa21637205ce8755bcd27a1b224ac6dfa90231480b4523d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b20c10972c912fc81d0fcf0eebd7e45

SHA1
f9171ddf61b2f088ddc9c5b284c589fff576c833

SHA256
44187908b4deeb8c9b2a6d447d852595fe4755b9beab747f289f79ad459787c2

SHA512
f734e03c886255a38a6de4c4a7aa008cbdabe83bfbd49004e97660823bcde4080c97158e7cec7385b9f6e05b28ea56c3c0018bc7075c175b71ac46b1186ccb81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30a226165d69d10c354f33c93f55ea95

SHA1
a24115e4e5132edeecab42609b1e2304e1da41fd

SHA256
2fed16198d9868dafccd638d4fe73d7e5b6bffb93f4f25209d773e7875e21f32

SHA512
3c88ff87589caad865bec05378323061dc05d02ba9810d2af62baf036eed19f032cfe7f65b9a164f983466b6bccd45c348abde435088f053571cc15d81d04d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8be398bbe06c3ba064a836cceaec0ed

SHA1
cbe590a232b0eef34d95a26a3688fb79396fdba8

SHA256
137517162a415294d514e1d0a3340921971fb6112f2c52b109070083829ccd03

SHA512
2f89da021d1eac30e27f9a7745657c6cb0312a19aca42dc4bc433ff225140ff107211b4a5e6dde8e6f0d577af8cfd6fef1ad369da0b485039b3dd9c9917584e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adca0f7ddf29fb636f76b1358c5d1035

SHA1
c2b10404f6e0f6542f5405fa1e3f9dcb52f7e690

SHA256
090a0b7b837a831613915d552011f5ee10f52d374b08844786db977a5565d5d7

SHA512
182264b34c4fad397a9b817b63886d7bb77e4206585c88ab1cd4fe83b9769d6d08c81dc5e54ad68d8e3e5ed9e3e37c484cfd25bf39b63b286cf0da43011a37a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad51b726e2e251b82215552d649cfe3e

SHA1
f86fc73b93461b59914046cd9f892b0a2def4d44

SHA256
305574751470dbedb181c9546b5470197c83a8000bedf4e5867bd2a29c5f0d42

SHA512
844a2eaae373b4750c0aca9d8abda888b80eb3b3f35993365c3790b44076597452de5c215a50083ef27c469f015e4a1c03a9cbaf08c7fa3034c849d557a3ae2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab45B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45EB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit