hxxps://s3[.]us-east-2[.]amazonaws[.]com/metallicavycomposer/sjdc155jxy/Thunder-Hack-Recode_191082[.]html?utm_source=partner_consent

Analysis

max time kernel
136s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s3.us-east-2.amazonaws.com/metallicavycomposer/sjdc155jxy/Thunder-Hack-Recode_191082.html?utm_source=partner_consent

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60219d01233bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D588661-A716-11EE-A83A-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000002b0149b70940c67275b473dd0f06599b25958c8154176954a5f1a5c04bf48637000000000e80000000020000200000000aebb2ce5564585f423b4818e4a029d6d55dc055857bd574325d38d086ab7e402000000003989f4b0ec34fb6334d6059a719971867b85912e672e726297a1feae89605f940000000ad2a93a954bf7fdf0bd8f459b0d0a02c8f7ee35eafed948c7661614e344b889449a09e2f5e085b6df8fffb6d77226f1c46b0726150923377db7f6cee3763d038	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000008511a936d784bb2b98dcef9e0114b6aef8e739b7c9223355289de404b4e48305000000000e8000000002000020000000e85748e901f8a6ba4ab5211bda989c91a59b9e603221bb28f9b4bfa93548a97f900000009e67ba5b0b14476bc2b9a83f6805d77c805db36b1a6200da53783c55464fb8f28ed8238605f32bf2cb8083f67d08d55f29a239f351d61f805f71f066d5976ab73c6da1e9170df48b5f7269722f2b8a93514fe291a8ac2f986b3a7c37f8131b397eb86fa4f336cabe096955991c255ae9527bca9ad9cb327902d2ace3228d3b4b4d28eb61d010202e1898bf2bd0b19e3e40000000f96c6f111c0b82a66db7f548045f89d1e9cb1676a8972a5f82e54413a2003504e3f6d32946a072c76099bddf82a116d69c686b9eb2d84f2da68389b27f4c5c03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410104262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2624	2300	iexplore.exe	28
PID 2300 wrote to memory of 2624	2300	iexplore.exe	28
PID 2300 wrote to memory of 2624	2300	iexplore.exe	28
PID 2300 wrote to memory of 2624	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://s3.us-east-2.amazonaws.com/metallicavycomposer/sjdc155jxy/Thunder-Hack-Recode_191082.html?utm_source=partner_consent
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41437277f31a19d5b8e09a20a7f92a2e

SHA1
ad7c1c7e7a04d6a521cb0da3f5fa3df8da5ed630

SHA256
db6129cbb5d0a2c8ed02aa33c9bf43fbe6ea2b97f5f66da0169f6dc7b317d5a9

SHA512
87af22ebf38f0e367140e31ea10d0617522e6ace7aab4b10f64fd1448810ed87b3c4a3e2be3b81ec47de39dfd28c3c5885a4cf098a44d95b60f1c4cc2885e49e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a7e65bfe03813cbf1022f459185f95

SHA1
57b56290584dd2000edbc59075c205dc617693fb

SHA256
50cf32609124dfcad88c508fbd275380eb0fcf7a3055b6613c409e3794c6ec47

SHA512
51ac8cf92d559ac8dc30a1f7363c60c8bcd71a30ce90a7eaee640820d1ea84a9524742e4b00ea6758591c7d047c5b9a3500d9b3bc3653fac77442fe24b62a456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0638ff3cc5a57f953859148212e1f669

SHA1
a321f255eec7b831103c6a0789928af3960a0e40

SHA256
e31be94686bed0b310d79e466756b81d2e81132323390b39ce554e420db56c66

SHA512
d6c59c48a35dbc07cb29e4d9b59c80ee4e128eef8cc2d1fde440ad07c972a452c74fef42a2d94d1f202492c26160313661787dda35a14d8c301b7d9162de787f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66fdcf90942c44846c5e7fa0487d62fa

SHA1
622201fb12ed0a30768d3b7879cab7c584537fe3

SHA256
a7c3298ac37c53217c339f2b150ffd2816e3212b85d374b48b604d3bc282046c

SHA512
371a077634df161e13e8e84575274d69a59f41a93dbe34fc16e5fd5538c8c736d54f90c38c58f30f04f5b9fc79b95065cd86954d668413cde346bcf235ce0b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5489cc723f169aa309962ffef6c0fca1

SHA1
6b45cc23bbfda46ced5e0940c90e075fcb1fbbdf

SHA256
ba59b6fcc806f911b8a0230a9c5b8c40d250af1124530cfbaede80500e31de3a

SHA512
63d505a64a63465a4e4f71b95789c4bb7388605d36a0d5d9f7b735622a63e8652721e975faf57f9a6872d8ddaa86b946847908e442ed5170e6730f121510a474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c101f34d38417dfb825d9a07123d53a

SHA1
6fc2237fc0fd8c54c5b3e63d14a4cedb44998545

SHA256
2a94dde17e11c7a737a86f9351cf4b2b7cdb1cf76fdb08121c2f34c1e8e08d43

SHA512
48d673920b534a459b126a9b2551e11ff72882094b0ebaa682efd5d2da2bf4515f90a95150dfe140a5fc3986abe801222b41ab5250399d5c57a3c07ed79fd678

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2306a5b3e3149ec338e7f460beaa2c7

SHA1
453ef28608a6c5d6a105c20ee8d2521b7470d314

SHA256
5284c4a208895b8aeea74ee561c97f82c3ba5406791dd1e14a754cc7c2b2d11d

SHA512
a42a7d40f05f45cc777799168445dd734c58d1594c58ca2c6eaf59c6794f93dc1d824c7c163b068de66f4337a5f835458d8c6d8ec475cc07cf03df5b99cffd48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b42a045f3b91d477547fcddad60ae485

SHA1
4fa4dac954851c17258e6c92ef37743a945de606

SHA256
00facc08a06f9f79e8746d93dd0a141766968ea594e03f59eb29bb71bd2831f9

SHA512
0e004db875fc02cbf068eb363a3982106b35475fb8596736eabd73dc4413e855e0a6bc534d53b12baf5e2fb5decde4c467b6311de145c26c85d746115202457c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
902f6151e6a0d42a7438f2a49454d79a

SHA1
b15251842830e55fbbfa4c99f717c82a5c3d05f1

SHA256
692742fd00f931ad365b4f875c64ccd26e733ef4a972c2adacc6be7d0010546c

SHA512
920e48704001db98613205f5c80369db610abd99b200157f6d98f2fc72a90110c3d3021160505de323be5ed3b61dcf3f5f5bf04583ec005fd4983251bde5aa2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca4106cdb976543d830f5d0cd418fbd0

SHA1
241a3971e109d3cca268cb8847d0c5475ba35726

SHA256
88c3f510a937ee5b66bcc51053964c429cd64c045360252e132d27f3c23dba9e

SHA512
9cc747b5da6b317abdde1e72400923a9e22cb4b3ba3ff79508dcf2955669c48190723089f396150b8ef53d13cc4861d7c4c1b6f9452737561bff133e6baec4f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee32487e7c51a0642b0b64d4d4853e49

SHA1
3289ea3abd248b9e829b4c4f3ac55dddc8260e34

SHA256
b2581aeeefe35f0fc16231f66a732863042ba64616a7ebc627f35e393c96d793

SHA512
ca502d3b29d085c544ca6cb21a5080ecfb4b29ab10c9eb2ce5108185d0c96a09bc8e45b5679d0a68496cbb90f8b8a988eb6fdbb0c09be38379b45c972e1523b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
664360066daf41314b2ef0967d2e238e

SHA1
825fc9538fedf838521cddac4de5df0292f1b408

SHA256
5bdf8e27ce47cdd5a39c8ca40629300b1a235768249742e125236214acf4b341

SHA512
13c4386b9446b8b9111ed8904b4a6ae9c7e31f71583c5e007a806fde2def0cd6c8a3c77fceccc43e71e6fcb6643defceb7cd56d80fae6baa26f5a0b6389e2779

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA99A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9FA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit