hxxps://trades-roblox[.]com/login?load=1703429080400_0[.]845003360428993

Analysis

max time kernel
36s
max time network
39s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://trades-roblox.com/login?load=1703429080400_0.845003360428993

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95EFE1B1-A5C0-11EE-AAEE-523091137F1B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DOMStorage\trades-roblox.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4079d26dcd39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002c5d97e5373c38c3a7164160885d25edb0d5482cfdfb652c56d1a552a4103092000000000e8000000002000020000000edc9f18659b3d265f63f15bf4dfde86d34da1e365c304ecd4a88388b30379e08200000001d0fd76ae1010fa3a686cde0a9681d77a6f3d51047af8ae690f479eb244dc78f40000000e3ba7be1286c1bf7e06bdc9b6b6e969b904e45e120f41caa931b937500022a92abeb7c2c6c9e0c5eb487cd06b34959659fb5a546b638edc3aff06a53c7a32472	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ef053d6ed049516375ec305bc7e5851ba5cf6d5d7ceba6324debd62db12e75e1000000000e800000000200002000000089a1009b98d9971f57d74353e2ad628968e7ce2b04e6258f83e62160cd5a66c290000000b7523496f04c1488be465628c80accaade0415c06c65c09973cc1ae8ee783f439a118619817ac331509aff05b71b391cd65d7b2c698fcd22d7ac7b26af60e07d72f0e9b49ce9e2e338df6455ad2597e90329f5d99a10f188d82fccf0c28bf814c492497dc2af98c32b4675a6bb162b35b892803aa5f4d90f930b43340c1ddbc603b592cd9eea1821cc3023e8afc0e68340000000a2fa8dfce33691b46ab0691a1c9dc1070b93fec7868e87aff7a2d74afa306fb0fe004ab5ae3762f94de285312801063021be0a7a55d1a9c6e52ed053550f04b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DOMStorage\trades-roblox.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2316 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2316 iexplore.exe
2316 iexplore.exe
812 IEXPLORE.EXE
812 IEXPLORE.EXE
812 IEXPLORE.EXE
812 IEXPLORE.EXE

pid	process
2316	iexplore.exe

pid	process
2316	iexplore.exe
2316	iexplore.exe
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2316 wrote to memory of 812	2316	iexplore.exe	IEXPLORE.EXE
PID 2316 wrote to memory of 812	2316	iexplore.exe	IEXPLORE.EXE
PID 2316 wrote to memory of 812	2316	iexplore.exe	IEXPLORE.EXE
PID 2316 wrote to memory of 812	2316	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://trades-roblox.com/login?load=1703429080400_0.845003360428993
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:812

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
a8b74f086807d0e02c3460e624e63369

SHA1
0c2be99f1b8266714b4cef3b8e4308d3508a195d

SHA256
e1c03956dd408fff364cb02d99cad843a67897c5101c45c8babdb888b776b6ca

SHA512
80eaee875c5d23659503857a8f692a0cb5b997e4c9ebf98af4b362f6430d909ce6560eda7121829a0e7151e250ceb1f5f1582d4c8fc35d7e1d90e0afeff69d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
284a9e6786496e68ba715f967203e37d

SHA1
06f84144d14f2ed5d7889c7a4c5cfd6b75caa366

SHA256
522d74b23d3035f9b2a4aef2fb6c863e4d50bdb2e7a769f4d310412e1e2ea095

SHA512
43f5d87ab8834f213b2262288558beaff272e4653d67cdcced9560854c49ccb44facfd22a4340a720418cd8d960a6c5a16aab19cfa999cc0e697a5214f995755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e05d9681b3cdbb040960a82503159ec3

SHA1
f4ad2d3018f457a48dd60ed17b492741b03b1c95

SHA256
576f8c22ecb38a3bf50072e201805cd2434c96f08b8ee0f90e1cd391a95eb4ab

SHA512
94402c1c37b257d13ce3ae8aca1a18d8229bfebeeb385985dda7210ee59add36c6265c35e4c862f72d12dd73192bd23ddf23838c6ec5d1269f59d58d93507950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bd4869664dfd49447ee475cb5813f16d

SHA1
927aead0283acafa9f50f549e3351aee5c4c544e

SHA256
adde531ae17e9fd9f5e222fcf0af5c1e2ac46d45ba632c4179025a75aac1db86

SHA512
421cb12cba460c749a5028890485e35623e6f9ea4e33eba654fb1dd5553f181917c166b034c4a16447fe902c528becb9706dfa28d78c009bc351adc767714719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f8e8953a357e9225d6feb07de026d591

SHA1
3a0062c077c021f1ea1eafc9a64a60d9f536ffd2

SHA256
45e86c28929ce166e8bf48ebc17bebb90233dd20050f4fc612c2b90d434013e4

SHA512
433401ecc4bf5300e8a14398d03dc5cca3424285f36d7f2c88b0abb7d192b7ee3de1a1ea3d35108bf28012f2bc498a10e2f2ffebd1c48413de39a864a8f82b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f7d9e7a661859ba7b82772708f39d5b6

SHA1
1603a6f1f71f1bddd3b4d139e76b62fec40a0fa3

SHA256
dba6dafbf76b7a781598abc45e58a4721aa161d6a3728623f1f57898ba329736

SHA512
8443654a9a624a4f129c0ea6c69a8421f3fae38bb2e7f8bc2a8231620ecb0a5bc0f2ee350ee6306b6f844d3a525b94d62e58183879cc6f8cffdb537b746aa782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6c2e54a3dae9c4c797c7e9df4a108008

SHA1
ba9dd954d31fb8fbd2a9fb495d0666903e626eb8

SHA256
d6d89c18e320ac1a449840b270823d3af215c27be271f48f9b00e1cc406ec884

SHA512
839f7118ca5be8d5f4fe1509fcee1d2568234e28f344bcd68000639702b66c25b51b85d083b5629ed28d177a124c8028e16a9d7aedf07be975d62b8492a9534e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7669b0394647ce0d4f2e16c7f2cb5e2a

SHA1
d2cc06797f1f79609851391671c9ed8a3263bdd6

SHA256
84ed9732161e730c28b93b097c1764355544f77d9d4955f4691ffb34b6263f75

SHA512
47537091daeb986c3a8e02b575c085ba3a35378ce68abb20974aa12d809884b1dfe0eb194a4af7abd56ae1fcfcd17ea2d91175498fc093da1e49f2cee1b8a0d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
04ff62d31c927141f2d14ab29b6ca2bc

SHA1
e77f3c092b8590bca8e17c60e6780f37afe785e9

SHA256
a5a9bd2596cb51cf9f1abf61b3dd44147cb25033e5bd4875f4233ca8e8be23e4

SHA512
a4934306a4b2c9f0f494295acd4ba1352c5cb28fb44e552fcdb38d0e6bd3f1c0bae2d385cac5fe135dc630218318d89a3c4b23454b83351a4c409bd6ff53f63c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
a4a0f1633a8ccac464c78240fb93dfba

SHA1
75997aed4363217e0b7a6b323d4a89159fb9d070

SHA256
ba15acb1a6b7ba940bc0ce9e4b06a0bfbd14429e5bf5db67a05f78c4094749ad

SHA512
c924d80ae5cdb4ab13659e25c18e20083b0e31df365f14f29008c31d1169e9fe95e3835944ac02a727e9cb4a2fe022159d8bcd36d3c0e51e42554fb1d81b3ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n7bgnbu\imagestore.dat
Filesize
24KB

MD5
ad97ccc2a9475aa2cf98464088a5c8d6

SHA1
158f66224c67d073fd924a8c7a7af6123ed3e86d

SHA256
337d401733265d6a8dd576e63e4e569549a22bf423a30199abd1ac3e6dbeb74d

SHA512
23d5857975db6ab95425e3ffee833eb0b4ae5e58b90131a78e2ca99174ac800c80cc3b8b601ffccaa9368cff571052538de2fa5776d99cea8ec40578a8d6e538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A6O9BC6V\ec2c34cadd4b5f4594415127380a85e6[1].ico
Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar148F.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit