hxxps://annapolispiper[.]com/yuyityhg

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://annapolispiper.com/yuyityhg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000453564aab11e2b557777ddb6d52d8d6bb74654cf2018dd1127241c4b866024a4000000000e8000000002000020000000e29b8801aad40652c143ab5e7050ec7b10b22d99a07ed45406265b4d58ae16c920000000ab3afa9ad22cd1efe537d1726be977880e19233407e6eaa97d673ae0615846ed40000000695b4978ddfea55d2626a2d0d72c944860a7fc715b9347173551d2a4bec6fe5c8923e243195210b4754b95e703fa2bd8cc1ad9178228edf85bed5e06d6f2d752	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70889b28843dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53955CE1-A977-11EE-B092-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b984dc841bae3e2ac10c600822d0b6586177a0b3fcfe92286a25ea535adb0da7000000000e8000000002000020000000a64dae4307522785ec61bdb067c93a836ce78109ab8c095ec06d1a206991c4c69000000086d1af6243f00e14cf7cde4a559e01d52c001a9e08c3cfbbee772106b0f1ec6c840b32fa3858d7a7629ec30de873866c8c0bd39bf5da0b647ae0a9ad63ef017ad61bf26641601e8ce0db689c58b8a66b0318d38a4dfde74938d7c28047633b1efd2303611492c0fb8bcddbc9835e35037d7ab97e8b6c3e958ef94ed42d41e565b7ca074aeda3a92294bd998df135445c400000005eb38d38443f9d7b5706080b348eb7dd3103860bc1b8205dc076fccd7495c637495a2c0437ca2c4b00e063a27a48c27f5e95e87848c76eee9521874a00a49bad	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410365925"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2720	2100	iexplore.exe	28
PID 2100 wrote to memory of 2720	2100	iexplore.exe	28
PID 2100 wrote to memory of 2720	2100	iexplore.exe	28
PID 2100 wrote to memory of 2720	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://annapolispiper.com/yuyityhg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f28eeb26bd3762acc33a539e240ef669

SHA1
8c41916ebcd45f55c77412a9c136c0c469e6dd62

SHA256
cfa425431dbebe948b2a3f2b5d1b3a3ba2440b5ce7fc9c14ce61c57c53f20217

SHA512
cb9504ac3f217773f6cf8fa5fc1d22b56069937c4e38dfe18ee8f6a7b4fe8cb67ee37237f080f80076ea0fc6861d6c0ed5d528316091756e738449fad96cbfc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51a4a86a6d621e52220d5f366bdb0c00

SHA1
a815962742cd4e752de990d998e6b22c759531f1

SHA256
bbef9c7ccf3aeaee094a75047a940cc6ba5183c4b31b2562f5ba93618908a3a9

SHA512
a1ce033de736d756846ac7dbdd0a2be4e71a24ed9a30fd9dd6d4983ad8edc3b96a0433007d1ca6cbb778e068422c4c3828055faa498366d21da6d899af68cd94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
522952362d498f78934ba86e7fe782eb

SHA1
266746b04e5470efa5755a5b085bd3c6cb8bd7ea

SHA256
42df4d719ba2b40c7b4e779091a694b9a049076bfe0f951c804d3abf7f2fbc7c

SHA512
e506b2261e3c0fca731156cbc20f3da2384fa0f54baf946af9f6936c88b3261d7ae650c6a0025f6ebe2aa78a2d44c6bbe16e6113594fd7e0a253faa4b4ea4890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d80c423d54bb85b37918b5fa4fc729bf

SHA1
0971b403e34ffc02d0b191a52e259c9fcd7979d4

SHA256
5819b5f0d3801a01b1882ffe60d3dea3c00ebdf82533cd9519c98ecf6ecab502

SHA512
336c0c02bc46780739acec1dd5a01ef4e00fac266702c36899962e4d7be82d72a810d8722ea4f08dd02e0395ef75eb33e6be93c22ca6fce79057e422d609e476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5ec6bcd999b87013722b903a999522

SHA1
990de960b5c82d7ddada518055f691bc38c81a74

SHA256
e1d60c9fc1b31f2d0ffd41edbb4387c0f1aa7e57a22fffae358d908e4a3ce187

SHA512
003a52374d857fba167ed61096bd3ef5b3ffc64c36294436acb60b8265d95cba3156c7311f72f505d080914053744804b3d66c03482a77e6ba186b9037b4c9b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a161d99bea6d61d33456a05cc14757b3

SHA1
d3bd55322d473b8f39744366fc7587f432a60c60

SHA256
78ef8ff243c85b3e8ef869971c8514f463d90a3f0a1922186f52169e02cb3f64

SHA512
483bd395f23e680305e7992d1fc0ccd65da73050170760015f3ac5d55272dab2a049f111d94eeb18c2bf47ab2dcb2ea9cb8597a21933e620ec57b7c6140495b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d9decc3dce140a30912f36749dc781

SHA1
df7812e09719beace17106233ceebf0f7bfd85e8

SHA256
ca36e0ba0d022258c2452c60f4e137c699ea94d8f91535966763b6346bf0e769

SHA512
70b045631f020dba1bc57a04a40dcd3be31dd95333cd4b11bea1724dc59ac8ac33fb01d6e2a7988fd18542ee1f00dd6518b0d115ab57785742419f76ec64ce57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c37f0687f5b92eb9f25f4b09c3935459

SHA1
980e3323036a353b468afd85167f9514faa06c81

SHA256
01cdafc47acd79fb9babae765636a280e8c232fad884a064fa1317765700b2fe

SHA512
85e5e2a9cd159a59f83e2b07acca170deb20823e1bd9600f05c502e897918879df69f32a556b7300663aed1a968c114e66b24f56278bc5c10cabd74a6545b3e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d6e9e865612b5e729cea5ecc14f06d7

SHA1
077ef5f76fd23cb68941998d10799700d8f4c337

SHA256
01b8a52e6912bca587d659f717265dd19d4878b14a6337a7ffe53b7df663608f

SHA512
a5d3e80842c033ef21532d0006a1c7088f7d5bba7dc6c6c97f390637545d7a0504ec14852ff77fdd28388d3b5e0e43468b35e2c45c69e57ee5f68d41f756f613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
513676ee9596cfd1f731488f4678c5c7

SHA1
c93e3ba0abf6e1ef6b0d15fa25e2ccf5d7abd958

SHA256
c65bf768a017b81780b210150ff30c6e1af95f0cb4ffe44260bb3f08a3d48f4f

SHA512
ccb537bc3582e414174a0bfe9ef209f2cbe189f7db8cd052e2d37a06cf1a19dba68608d170d8e8e02847ae63380dbd5d8e5a4b551ef8d162d98b98aa965f78fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae720e6d2feaa11225da4b5958c47e05

SHA1
0a22ec8b271496f3ebe935c6ca32773783ca12f0

SHA256
6f2d2ed3246253e6d931206f2e3051ef7c5b57a580298e939cf60c6503efb3a1

SHA512
57fdd52f64261a55f3ad66d76e96ba11ef262cd3abca228ffbef604502c5a6c0d898c4ee8c051e93e7aef98075fabf89c1ca4cc8556110883d60f7e31aa3a486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19ca5003275bf86235449b7b2ddf2eaa

SHA1
fa8e9eed6b4b40f6a3ab4aa2a3285e5bfd751ac9

SHA256
99f428da5bc48675d4b72d6bf1a643de83d565831fac839639575d6dca7740ee

SHA512
1792347a754e25942dfd718eac4fc4f3afd6e689270a7d1c7121fb6fa6db87758e38453daf2e321e5e49802b1571f1d2a1f90ea5f4e08a18614927c0aeb7071f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637df1715decdd86d7b08557670c6404

SHA1
741e6707ef076ad5d9a54ffb1848f157bfbd2da9

SHA256
e78ccd9ed2a9fac86cd1552447fac004b97754b2f825dc914fc6ff58770594f8

SHA512
4477a49509d90826f99d11bcda11ddc305b5fb8a5e6d658c8e14320bba243fe13333b8283c869e6cf57d97d1b8cadb680c0c1e9bb8f3dc2a2e0d752f3c574e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae20db4b2fe1808bcbcc0f84956bdf9

SHA1
e6385959850d73da02978409f8a28dac1b0f3f76

SHA256
3e083398d6cd43f595715f47e6084073da2563ee4c15e38c951864c6ff5c956f

SHA512
9e7a91e007bb52c013b6836ed5f2a09b4a606973bc820ce43a732607e6a5e4f7b22897baf6eada378022d1785271723b973360eb8293beb783facd2a063b6a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab79D4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A73.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit