hxxp://amazdroom[.]com

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://amazdroom.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409765039"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000060d40493b786ab26d8f0d39096fb4fa443a0b53d20be78dc5e8f1b259f8c1f1a000000000e8000000002000020000000b0814c9525d30e4d6924d41094876792661186c004dbd252bcc23e6953e3de442000000093d583fd9064698d0b9bbe3dead249ea428db182a9b13e74cc09f2a71e8c5c1840000000282c89f3c80487c32babedb813a3887322617b3ccfe84e587404af37bc899d94e93abf27875c8416fb723139bf4b9aa72bd9c206e59f7e172ef89f939fa09498	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C902371-A400-11EE-8427-464D43A133DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013025e2dcdab40c6dd49a2b48e4b3c33e729ff03f3b5d254c7008ba96517c788000000000e800000000200002000000077e524e9b67c121afd7b8b42d73e755c8be2b126848d321948d69dc5986e41e990000000d7e21b40508df19dc35d6bcfe9b3ddd9b58663cc951ac6d7c6156fa0c3d1d2116b8b8da4ffc62b7c0971e8b42c55ba39a4def698b979d75b8990e6421ed8ceec1d044a364aa8db0d6521503e84da934ef99cb218aa9c29fccb41a056f83582ce0b6c35a8f9c14b524437f0586f89ddd19e083ceaf31b1709d45ae0d50fa59200a9ec0db205b2bd895b9e79e87a98981140000000d3950c14747683973523b40fdcc88cdd239e6608eed7ada3dab1f591802cf6a945ce9fc80b4d79bc2e12ab436ff630085f82dce64ed11748b547adaa22408568	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0773a250d38da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3068	1984	iexplore.exe	28
PID 1984 wrote to memory of 3068	1984	iexplore.exe	28
PID 1984 wrote to memory of 3068	1984	iexplore.exe	28
PID 1984 wrote to memory of 3068	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://amazdroom.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
576eca67bc90e0c6a3e83b323f07a94e

SHA1
ff610d9faeb4eb8cbd9cbce42b8d0954b85c264f

SHA256
8d0e7650a1603047064c7273ce9da5d065b669142ebcb798c218e48a8cf20886

SHA512
f21fa1a732a5b5393fc1cb85cf02ebc90aeafc3f322a3f3a8f2c374085f9ad4cc93eee4352086e44e89d3a9306969c358a5aa8c8132eb4d2a3a16c69eb9b9117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df0dd1bd863dd8b6159179fe4e10899e

SHA1
50f74c41a285378d0641611500960d4cd05408e8

SHA256
7ae409dd2c186fc8f9c4ef5173ff74bc28eb531c3ba897ed8af551c19e05c6dc

SHA512
57d674a56cebdf609c85bc689eb9d8282af41092d2e31334a1215c74ad349dc2f74e6ddf6ff247a912e9970c5ed47788a4f89429e61d421feea9557ef3e63739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
765b55d71b4ac13feaa2ba11c5be78c0

SHA1
9bbc2ef74413a94610d9cdadf0fa7e3ee8128c94

SHA256
6ea0c07b812dcb9d62bb42e033b0f5fe9de17d947d0c8d3553a4d09d6bf66b44

SHA512
bc05339e9d0d9cf5835ed1e6914a48f3c01a39ac98cc86960326fdb5b84992fc46e49de3c91a9610b1832c9ef571a764e7ce240b039115e7757a60ccd1bdb9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80a13002f85fca285ee48eaeff750ffa

SHA1
3a6abde313a0766b7b22801793e926b923525e73

SHA256
234850895f576e5810a6480d8b01e9f8ac8774221eec9ff15baa52de5e9af81a

SHA512
7d55a653b41307269ca0968d1f2aafa62e0dead98ff5f7844dded8209d2757c676207f0d9e99302e3357ec32c8276a227712808c0ddd970996f2109ae6a9ad4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540bbb1c8d32d507743a0d14853abb71

SHA1
765f6da7bb01556e79061bf2a5e49508313d643e

SHA256
c9717a213511ca2c323dee7681242e9b3df617bcbcfe8eefd3f6f1943266c86b

SHA512
eb619b663bd8bd1e17ee864e0e0058b4575ba13725bbf2c7f0ab6c7c09268e448a52acdb8c9465af3e753aacf67c11439eaa408ce677064af968720273cc7069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc27c7c9cfb7de1b02caeb54ed00cfe8

SHA1
da484aa2408076402895615478016e582937fa99

SHA256
5d466617e6a5a7ed1da7565e479bce90653d1c4428b5ce74fc7d1a213902ea51

SHA512
a584c23dcb6ca0cb06337d21c25c1c0b073cb45bc51a8e436787197548f3056dec7e7b962b923d4dfea7f36d26fd0fbf0227172daf393b6c57b1dde6310130c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18aa162546acf2213d04004042ee637d

SHA1
d30276b7d5b59613126d9c92d7c288fffb7aa110

SHA256
d63416ebb727fe01cb5f6f41d0f8e85ac892f8b658e95d4bbc4947eda4459aca

SHA512
176ccc92cd82e3d53834fafa224e403e9e9e066f69f3716de4a1ba86d1c17ce2f277a2f77740ed4674d9ebb38c22886b526fbefd175d83573c3cb8b2ceab74d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc31971e143772ee865d3b6b1e71309e

SHA1
e629f114d2522c0c7a500873ec73ad9b0b5ea250

SHA256
059fcea3bc4a4c96840c994691c9e8b2f0dc176b6a7d5755f200b3659e4faa8d

SHA512
8cfd71cfba6f734f935b2da483f6e497b868b73cbca9ee816f2be3a68a68fbc32e8cdaa23bbbc21d332d1a14cd2d0e07ac2f826fc42ea483c5b1106058f54914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46878d8a4c2e55c1038af62f04a3641

SHA1
7fd148f58bfe694cf214d528968707897cdadb19

SHA256
988900bead50ce3702e3f19483fae1ff39cfbaed551229d3ed9abd70f3a2a5a7

SHA512
b778d87f8e976e5cf01d91e2bccc71607f6f626d68e91f626c6fb15ad95498008deec8be82acbbdfc77952d26eb6d5f46495409e062aa946879af0ba1426a34f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1082e6e4c8e7a78eb9e8e2519d759769

SHA1
1d11b14c1da3d723a1478eeb2babe573bf453820

SHA256
8704cd433b74972e2d4f78ea76b3ec6195bf58c546ba211382110dbf8004f9fb

SHA512
9ebc2ca7bd56b689dc3bf440207ea40d64b66d089845685e97e6a86da4cbe9b9d3d623028154a9b7154f9bef0616ff46883d407b26f823a4dea60127e7d71ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a53b7eb8b9456a5feb6ada7e409ea1d

SHA1
7d02241ce5beba8e6605a841b30882502ea7e651

SHA256
50def759ba634504cbe4a64cf42700da472c182a838e4a01a57bb0ff0450c089

SHA512
16af05498d7b8e67ddc12596028e3ab9de2d8dde9d0fba3e883292f8be220bec4a1be04f6d416c8fcc4670b202026c55aa54539f7bf40ab52fabec945747c33c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06868050d31c335c552ba7b0ca037355

SHA1
acabfc4f6837259aba4a17cd4f4bbed82650f1c4

SHA256
740c5c1f75b9789b9571a68e6fc43562c93df96a0dec6040e76b20fb768a8c40

SHA512
30008df49962bc37b634e7368494435335112e7a893e7ffff8d5a2e29752c00dc8f9c578e556f5fc47b21a8e01217d352c5c3415e864e3cfc979e41b463f04f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87b4bfbee794e4b2c561687f94882a70

SHA1
2ff41ca09311776da969a3b81a574c067522b8f7

SHA256
66a92170cc0ae0f6bcb747b64655b1e7e7c95119842823b7e6cf9a2f9490867f

SHA512
40ec026076c029277bf64230590209a0b0206011a104f7f7e4a087bc6b181af9d46fb1efc6b0fd365cc764ec613a2745ad354b9c2a4a3b58e1836e5c3b721404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96b58461cacc26f8e6840e078fd9565a

SHA1
c880908486ed20158eeb64c466ff5c2c617f6c50

SHA256
cc465ec01a01f1e439b5881af2a30cc8e0246304fdf684206b0fec98b58e6b02

SHA512
ab17197194f10b7e28196c42ec1ab13fbb7ff7a5bde6ceba44c918fe3419ccb183730538a01300b604aaeb41bb3a422a1bf093feda0e1e9b420e66722b19d37c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC8BD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD56E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit