hxxps://toezichttafel[.]files[.]wordpress[.]com/2020/06/logo-cjib[.]jpg

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://toezichttafel.files.wordpress.com/2020/06/logo-cjib.jpg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70216526793dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d33a0d1598a0541ccc950b42245fcd38b6c5954e3f9702342c7306b7c53cd4ec000000000e80000000020000200000001990a9596475b597707fd6198fc2d296f941fe0ae95269d80d4e9c46e7b6e994200000006ae732394388ec33d1450d1ea886c1b60a39e2e6a29bf1fb10ed69ed2b5ef19d40000000623fc9808cb21d9b3dd2efe7ea445c8cf9d6732e0018775a540a8dd7b449f0061931c4c83302cfcf541064f88ef4ae6650fd89e63cb6dfa61d8e014aab1257b1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ffd510530d83f87f1d98c0f81c72d99f73144a21e75ca43a58de8244e190d270000000000e8000000002000020000000cf676fada2f11413cfba6bd7b1b4804aff97bbcb8f17fa6be6cbc04f5246b05c9000000092e4734d6c8008c7b81209e65ed60ae2e1a86f450d5951e606bddd404584ce26fbb1947153956202571e34417060149118a82e0a0ddd108a3305a0ecaa11d1f9af57d62596a335df7d1bd4b4de1f6ac407887bcdebb48aa4f50dfd8bacf9316826345b58743753e8aab6a2f4d14dff420471392d4e646873fc5e826c217220c7e5369b1188e036175570f9543f73852e4000000078478028eb1ba45be4f4411d3921fe33e4b2b7860995b4dc022c15b07827047aa09b01bcf687ec1254a855e6d9d683afd3ba546cf3b046081d581e4e930a5f20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410361203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F17C501-A96C-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://toezichttafel.files.wordpress.com/2020/06/logo-cjib.jpg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b396bd01b41b8308a584b24c884706dd

SHA1
206c85daceab535b708e01527cb561db6825e838

SHA256
a14583cc5f8a2efdc4f8c4f95cfaf65ae69d43e3867cd5b7bcc49a18eac2c0b4

SHA512
9066975a35d78542c73227e6b63c36c18000fe84c3e4ac08ed030f438dac98da7c2351f85d1d512dcda5e2a5b1f2aa42f5c9a4113ea136b1e3c40122ac777acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aae68c1753fa0e7073335ed56c91834

SHA1
9fc5a7630d37f0fa364611dc8af3178d466dab67

SHA256
e74da7b81bec7bfd6aeb9959252f86f3e0f50489ac19ad7a2258ae4d4fd73b9e

SHA512
49a0895b977b9f52fc60d1bfdcdde567f0df7b79e54683744524ad4d16411ea475c792bd1d7c0d678cb7d33bc2974b924ed0cec96d8669ebd66689752cb31bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e7c5b56f0b0f9c888c95a38c509614d

SHA1
0b2a0cf3c34ac976548b9236cc7f37dd9891f3ec

SHA256
000b35378246513381880692362bc690aff648b8ab553fcde2f28d16eadfc259

SHA512
3ff663e4441673bea466e5c9835a5b7fb33f2f2162acb41f6bffe72d48464c348e015e0cc089e383686bf93b4405617d6bbaf4619df498073a63ef5940beb458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeffaf73f9f85e069c3c6ccdc47039a0

SHA1
9c881ee1cbcba58c033a1a1e32dab8c576c5b9a6

SHA256
5a857c4a7e20bc88db7762555c4907bc0937df9063d0b3119446b0e754b4e3bc

SHA512
bf24e3f36d1da0f902291a820163234d681710eb1068e92d9433a1e24a80961ef3f1029060016a3412cb1bc824ee97050722ab0c969fdbbf1d673bbd2033a28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c2f15409e952b172badd4b14eafe18d

SHA1
3910d225147f674a29a7b38e5914e2c1d6b92bb7

SHA256
ca5debce401f05042c10223e3cc739794d84293605949adc9a1f0af888965ba6

SHA512
27a365cf67e61d3ec6704b07b7dbfc93b0324be7cb41d438cec19aa4bb7b4c9129c35c18f4d9b0049a2b2820a08492536698fb5ee0068a748754c306df7364e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ab628e4bddf3d0cab6ee2f68fd3102

SHA1
1d94f16e9fc778d1987b22c51ffccc5d0f465c16

SHA256
e5c5222a9bd1279b66b6c48a785c2afc4793efc5c1cda3e19ecabcfe4134b4a4

SHA512
3a4e10ec4f8a84bfcafd000b73282e98c40e00eb57beddce8a088118adcc3d823ced2d6a1ed5ed0a0453d2380232ecde3dbf4a3fba023985482f0c22f12c25f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a03595b93bc96e0911f58fc307d454a

SHA1
ef7b1f915a34e25d8b00a41f91e6061ef028c912

SHA256
d2156814248fc96521783b3a372c89b0d41da5e8bea845b350a3c41bd6db30ca

SHA512
5a707ec683311fbffac7f173a21fcf558fb06d6b127a82b0485c1ced8e8148d222fbdc471a762c164ceac91bbfeba39400aef2a882ccc20a7215a6d59ef656cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf91176e8172d9652ccd102a66e50234

SHA1
5bb1af24aa2ac8c92aee551d3e760db741b13814

SHA256
157ae06c102de7c43d0ce7d7da9ce5bca568025d7644b6710f01edc0f0bc3cbd

SHA512
842bf138e0a61c7f5326910f69af38e96da683a1e4d2c5ba7ab6ef1be140b504441182daab2c5654191e17d1619ebd919899950444ee1640b15580d70e488d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c816297b13b0df4c8acca67929562c23

SHA1
175a3523448cad0936390d1eaad4b9473a17d4eb

SHA256
198d8f9944953a113111c1d693c878ac60563e196e330b4a9b7614cecc07cd1d

SHA512
1b3083a395825ecf04fd91482fdc342f0cb009d96e6572ebf10ac3b8e0553a79cb0ed62f54652483c1f37094b15721fdd18665f084d129e0299fead91dc3544c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b222ef999bff0d71b57d0ea141a639

SHA1
62de374b627322bfd79c1fb4dfab910f3056d3fb

SHA256
d85972f94b124703bf3a702eb09b4bdcd2105ff6629656f6a737218673f1ac01

SHA512
3145608e9713042bd1867609a7eeea655b265e730c797b82c5f16d13fbf41b28d4148b791d3adee1baf81f9ffbf5c9606f6fb4c4960f6f482a0b584b42e27457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

Filesize
775B

MD5
c303a0edb349000a1bb178802d6dc0c7

SHA1
b14b41d3e9db62eab974e0c23cf41fa04ec8f7ba

SHA256
e9e5fd6e02c8fdc2f3cd7d013d874d4821f67a6509b0290bdb2b4b7acad83a2d

SHA512
711505a12ad66fe46077f2a275cdfd8f6fa6f3692b4c7de9cbb5ca8958b393938b8a4e22f630b3857120ccb2e6baa5d650d1a9bba0b6260573dedcaddbf0b150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\cropped-spionnetje-2-3[1].jpg

Filesize
623B

MD5
0395ec45222dcd15d5ee583e921d86cc

SHA1
d98bf76e1050f042b55abf64dc9f12db9b29b064

SHA256
14887267b147e10049190c06cad4c6d429fc7013eb9865aa037555218d0e6ba3

SHA512
b294c1ca2db482ef8e9d22f323eca6cb7dd08823503595a679124fa54132041af56f297ed8182a53dbfaf3db82da503a3c9fd6f81f177e8edf2513657a04d00a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6856.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar68A7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit