hxxp://sedoparking[.]com/frmpark/atlantichealth[.]com/skenzor7/park[.]js?reg_logo=netsol-logo[.]png&reg_href_text=This+Page+Is+Under+Construction+-+Coming+Soon!&reg_href_url=&reg_href_text_2=Why+am+I+seeing+this+'Under+Construction'+page?&reg_href_url_2=hxxp://atlantichealth[.]com/__media__/design/underconstructionnotice[.]php?d=atlantichealth[.]com

Analysis

max time kernel
0s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://sedoparking.com/frmpark/atlantichealth.com/skenzor7/park.js?reg_logo=netsol-logo.png&reg_href_text=This+Page+Is+Under+Construction+-+Coming+Soon!&reg_href_url=&reg_href_text_2=Why+am+I+seeing+this+'Under+Construction'+page?&reg_href_url_2=http://atlantichealth.com/__media__/design/underconstructionnotice.php?d=atlantichealth.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D384F51-A97E-11EE-B5B4-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1852	iexplore.exe
1852	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2476	1852	iexplore.exe	17
PID 1852 wrote to memory of 2476	1852	iexplore.exe	17
PID 1852 wrote to memory of 2476	1852	iexplore.exe	17
PID 1852 wrote to memory of 2476	1852	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://sedoparking.com/frmpark/atlantichealth.com/skenzor7/park.js?reg_logo=netsol-logo.png&reg_href_text=This+Page+Is+Under+Construction+-+Coming+Soon!&reg_href_url=&reg_href_text_2=Why+am+I+seeing+this+'Under+Construction'+page?&reg_href_url_2=http://atlantichealth.com/__media__/design/underconstructionnotice.php?d=atlantichealth.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
  2⤵
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
946043a2214b81fd2db1f5c8a25bc942

SHA1
44d4cd51fc21d1f4f6b985275a97c97b381bb9b7

SHA256
cca5150e95db73e64eeb614caf3aa15b8d3b664498c53017b16914bfa3c83079

SHA512
585c1ceb87a78cb5114e687e2cc443970c180f19048875d1408d86d0af3a6b6b5aa404fb4ea26ce7e3ad42074b006f6e574b27603dc9dfbf394b07275096ad65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbe02bae4d85c805a37ba40be582c311

SHA1
80aef6cabc4362a7d87d7b8f6fe0a30e567ca454

SHA256
8221e959d9fad92bd6f7befa894b283a321d327b102fc50ab19598e4d231bfe9

SHA512
c8607f1c0998e957e6eabcfd9b2d2020083e0e4cc6d8835ebe5e1a393278662d43f0b55ad85a0043e2d7da8729951a525ff574203c4ba4efead4ee46924c0698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6fa3ecf79d208306dc94a6bcfd5dbfb

SHA1
31f0eaae8c969ad10d788bc65cdd63e0f5769083

SHA256
1bf16797cd608ecf28a9602ee8030d95b49e86a31e57484776b343216acf28f4

SHA512
97b43b3451c928247c4ca641bf7324f9ef0e797a8e72cb2d60fd2ef10ed1c6f5bce767906c19e0f6b261897cc868764964dc2bcd59b83a48140d47d1b73967e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8efa87835e5d0ddcae511646bdbc354e

SHA1
61f10fc37b051d8344cb4cdce85a8bfdc9236b5c

SHA256
d1f771a3cf50930956d63c30f363bc1837b0599fa08d85c6f8f4db57e8666358

SHA512
f626e26049bda3edbdfc015fa7cd5c6b377ca9ca4919e1bb10c5aa2deb4592647d49917ccda564e1c4b38acd4aef9247020e69f1b1dc6ab1bd84f12f28b9378e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96be19b7d89fa8205b4891dcb789fd8f

SHA1
653909e0317780e65767595f1a183fd66ea3793c

SHA256
e9d4c1c4b2bc88f6303a3b4a38c6551188def03f33d7be8233099555f70e4fc1

SHA512
e4d85cff74d915e97541ddd0180010345d0475c345b6bbd7c87e815e3b73fa23d6ffb0382b805ddc252f5c51cf61f086a70d3165629f7328bad96864fb955918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6742009f00f954f4b78d6f3b1e90c47

SHA1
b873f1833e24295ba2adef245766dcf7d63cb46f

SHA256
69b1e1d3fc01ee318aebec1f981a6b250d69e37a2cc5e193c52da96fc707fe5a

SHA512
f7a58ededf38f977edbe7eae90f54a9010c319db5e96b958d3fdeef6a331cdb893bf78266a0cd96976d8751e766af875f422498b227364526e4171d5d3f33a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40340f95465d8f3f91daf4d20b4e0271

SHA1
bb48eaacb92d177525d8cda6481f5c780454850d

SHA256
e6e80103f71f089106504898096d0f1a6d5d3242bff45591268b884606d40090

SHA512
7eb85cbaebdc6abc7eeb5b1f313733e10d6061b2bb9e8a6913f3e7252cf7d8738ac242401d6b2caa651c70f252c29f34054816ba0561979f41301f4e29575fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b5af700685dc2cee3caa355188e39a

SHA1
de3ffbfbad32ba5a73766b579a1b656a48f03ccd

SHA256
f3980fbd2db599ae042ae4a221a9f067c5d2c7a6bca878112e347c211bf62fdf

SHA512
1f0df298c060080d3103735043c628dfa2bc5d66a3ef1fd922a0d25660c5c9bb1a00c40fef7d66fc25fbec1f5781455944510782fdc0a828fe0b946ec3cf0ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc47d209c957689e6dbfe58ecbb9bd0

SHA1
a642ad3be25020660041d73cc75fd365a5056612

SHA256
a0b091f1ffe905b3e30b3950d6effc4071c421ce47ea20e4b2a3099dba55f137

SHA512
667527e8e96e048076a2c271735c8500fd3e1a4e22797bb7a74a9a7a811871cfce26b3c882acf0904880d396b11277b442a5c8469ec04941e46a2acf2ad981e4

Download Submit