hxxp://lego[.]com

Resubmissions

30/12/2023, 14:33

231230-rw6ztacce9 1

30/12/2023, 14:32

231230-rwrj5ahgcl 1

Analysis

max time kernel
151s
max time network
164s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://lego.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83F8C1F1-A720-11EE-A62B-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401d365f2d3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e45a5fb7e1662ea058c4c0aceed6104a18c6dbee9a1609b059b54483ed60d470000000000e8000000002000020000000d040a77926370959de49e1135105da01171765895d4dfa197d141d3ab12f7c39900000000888e3e344deedbf16445c80e2ca0d0541386aa3ed935749ca06be7337f4715b15f9f47a61753424ff517522b75c89d0ab4062779a77d2887e0bf02c71e3081881d4ed274103b26bc7fcee3062e5ae5ed88f20fbcace734ddb3c94e5787ac1d1e6f2cf7f70f2acbb867178d8b5c562b570f867557ab58b3ab97971e7e10cac340cf40ea5e908daadf2acfc0d7e4dbf4040000000b9cad7fc6f38945fdcfb6cae42a5804f0f608d826ca3cd3d71166f24b4bd20e7c5d8a266430a0182c9b3193da48dca6f1130f5637361c9d8ab5ecaf72cd59514	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410108737"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004d22703e63dfa183ec552c5d4cd1622c2f1aba5dedc0ba89a13b02fbd7a1a2e8000000000e80000000020000200000005d862066b0ddc795cf2d734fec4322383321d505bd62f8b55fa53dd6fecc94ce20000000e305c42b6ba4a65aa0ac52d5c90ca58cfb8803eecff33d155eb1ab051f4f49bd40000000ff4ea71a7705c4f07a36a8060874572085ce010e3b84abccc773223a4a83275de08365a4cbfc8e62671abc74a7698af4eedc2238aeec8575a46acaca29ca2ba8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2712	3012	iexplore.exe	28
PID 3012 wrote to memory of 2712	3012	iexplore.exe	28
PID 3012 wrote to memory of 2712	3012	iexplore.exe	28
PID 3012 wrote to memory of 2712	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://lego.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4e8f8410ce6d6367ce85708b9f9d1f5

SHA1
6edfa524898c1cce3703dbaddd7dc46142ab13c2

SHA256
f3399f554ee7387c965d60fc542e66308bb4d4fb7330c2b9ed47172f840b1264

SHA512
e23daab39e7b372ae35eadbd9070edcf78b7152840e6662ef0dcf7b1cc03d98600610546da0633e6dccf59ad61bdad10379cab4c234ee0b61e63a6ac1b5841fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acf1224b1494ad601b86e55ffe45b9d0

SHA1
9a0d0001990c54e38d52dbd436b3ee59e66c5ded

SHA256
3846cd4134f0aa7748de99472716403ae5cce33b826bec4ca62b305f9a127a2a

SHA512
e365c919ae11e333e44f2a2c55ec05c130a247e8d1cd65ff3444d0ca1f938b3b768472d62b52ed2d4cb79c7061d869b8070f65d8f5c19d4e52102939db83b94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f84727cc863c07f4476897e3313e8c

SHA1
7a29a3192b5cc3331d8267de52c85c510bb830b9

SHA256
609a6a711660a6135f1d73ac0cf5312e66eb1d0725a711a278115efc0bcb92e8

SHA512
3bbcd780ef60cff1f62556857ba552667627f6bb9dc79a46c85387ef93ec1bd2395cd107c67278b514e0c0ef2d6698008a151215350f56d7887db0eee796dce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07df27e82b4cfd512077aa6ba30be01f

SHA1
6473a1c881baeff2f45ba244b298b6340e05d654

SHA256
859dc4e732736574964d086108570d296aa425369f95f1561b354c28f11302be

SHA512
7e20c9a9f17ea48d10b52ae14a9141cd3ea1ece596bcbba3fac140539b895f394943c242f5ff10ebcd5cd07a5af738830cb4c7e3f9ea5e29cdf95cb0fb911c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6ea517965328bf84a603b3b0f8ff919

SHA1
e76c0da99e67c5e8f877085fffb6130211108e17

SHA256
bf87a81ca6084b3484ecb51f440bf5cf045de3e16672aff2348b342879f34aa5

SHA512
e84344a9cf0f4ace37aabc7a0dce6e021fbd0d47977ace33c4c2dbc7ab4adce561f7b16842774e831968be224db3286c009c1fb36b3bd9869735f473d63fcfb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b226e8de2cbe16128247b9c83489408

SHA1
d36a8eb2b85dbf09f49f4babc825f0718d896536

SHA256
31928c35a93f91ae210404532e15f2166d7bb2fb8f58523dcc51e8d021dbf899

SHA512
bef53b79a3ec882fa49b24b27366234c0835289d435eba76d25c1219925390f61bb538f1f42e1e24ccb50620b8999bce0a95a81a10bb6c574294ff92d88a589f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20360f0a576fa56960fa44bc6d90eb41

SHA1
5a80a92fdd99910403780e389c384db2e8323302

SHA256
b5372062cd25ad228b96d880b7a1985866216325eea7e3db3bf81dcab13cad4d

SHA512
b48f96681f64e45a2f1c20e7a40921266d86c86b9047236c3cd963f16a5b0c7799509638171805b2bc7af064ccf5765eb1dc5c355b59b9a933ac6e341081f059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
743891fbc4c07414a060bf9bd354e55d

SHA1
3a2d55197636b6f06140ef144e76a06157be02ca

SHA256
96bfee3f58612d22f25f6d1bb00e1f23d3abeb4813a2e64faa642045794bcc86

SHA512
3765ea004d24b3a3abda0887be24f3388516d1b35a73d2fd217eb35d85b08e4e34f86dd02b7365b3f2359e9cf6b203a69847ea814ec72487d86df56259f0e010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0126605a7de44ab10456fe6ae9f0dd6e

SHA1
f67fe50631b42a7b17bd276d738ec9a45a723da9

SHA256
b2641f08aa7c3c9befe811bd6fc540df9c0bab7d3f1db86097a731ded1d13151

SHA512
dc2d5527c6e2b6b4a51523d33d0492d69e8aa96c64386792a50fc61d8fd2153bbf2f0cdf8acac6c11d088b8888b7c7426b3ca30301b1fe290849a35714792733

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD771.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit