hxxps://djej43kdkepqkzd[.]blob[.]core[.]windows[.]net/djej43kdkepqkzd/unsb[.]html#un/8219_md/12/688/2075/415/136738

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://djej43kdkepqkzd.blob.core.windows.net/djej43kdkepqkzd/unsb.html#un/8219_md/12/688/2075/415/136738

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f198deae3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000778a3d1cac768d116b50a8c75d618261323d55827ab16193277ed9dc9fed30b2000000000e80000000020000200000007f4bb5df6d011e8eedff636035b4add07eae2a75ad9f7b33d21b22eaefadbf402000000063a523698cbb8ad1ebcd8e04745ba0b8742008305821369d31d2de1f6323f4c54000000078df46ed7fc5bad3cc86a0a33bfd52c1439908bddd429f853f6f9ed86fb8286716ca63d4547905740095b0c4ea06c12f49e3993865bb85de122118c378971aed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04A79641-A9A2-11EE-9610-464D43A133DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000039a7ccb43dc396c1ece1265c090db86d3e3d7da3e6510fea8af579e38451725a000000000e800000000200002000000054d8613440b1184bf99c9b51fdd8b8bd49f9b5bfce0901cf33de622dce8e094c9000000093c6f12e9700bfdd5509254ffca3161d3a32dd7466f69dd3f1951a9420a7c59c071138452ca931468b526a0067a4860e1af6df31060878e0752d5519ea8b0b1a5e3eec2557bef4623b64f4eeb49ea7941a8d15cac9d9b39c27a2a32b137dec905130650db224336a9887ce476584ecf1ba781f6a4ecf32ac8a54ce06106e952366021700d1bc84946c0be48fe24ec6fd40000000f376387476c8d42f28ece4f9ffaac781c7cd1dbf48f1a335d9c4ac4c225af6d734ef573895b0a2fea3da642499818c0c9b144a0eaffeb0b660ee30df390f86c1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410384255"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2004	1740	iexplore.exe	17
PID 1740 wrote to memory of 2004	1740	iexplore.exe	17
PID 1740 wrote to memory of 2004	1740	iexplore.exe	17
PID 1740 wrote to memory of 2004	1740	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://djej43kdkepqkzd.blob.core.windows.net/djej43kdkepqkzd/unsb.html#un/8219_md/12/688/2075/415/136738
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c52bd4c64db3624304f04f32765dad7

SHA1
838111bd15ac870ee57a0592692f5a890cd3ef9b

SHA256
69cf182deea29126c881b6fbd97cd4570c8d815343c2e3338cd79e2d5db34cf1

SHA512
9b12eaf31374f203566329353ce471a2e0576dcdae294e2c17d730a80d2a187262c3974fa16c1ce643ca7006756c34e4055cb4682d2dd2a2c5c740e5f601ef45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc47d8a061667a08200b12d94ae5051c

SHA1
1c826f5e582ed18f263bff3ad95461142274964f

SHA256
545deaf74898113be288528d0585089feaef06d1a599b754c96f8addde94cd55

SHA512
3943029974b4785e67f0f8dbd974a176fcd71b8df1a186a1c5868681f71f105e80be3f6359546b53b94c303f5663765cc40adf782433b31b48f879106fabb7ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baf16e39313f3f1fbac4e54898f8797d

SHA1
93b7bc49441b0342a2cc6c5abb532c01bf464fb7

SHA256
d4a81f1fdecee4fb8feb5d3783e2de4aefc997f1e79946f69fe237a453cd93d2

SHA512
ce55c55eae84b9a829eeec7029608a870ca32b5859cc7b04fbb8b6383ced4362e9c7e6ab1d88bef8f805b4897f3e6f7d8112ece53b2c7d3e1a40af3cf01c6847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5351f47f4cdfa1b21c78a8841ca8f5aa

SHA1
2a3a14488591151fffa4d1c4ae5865e2b3de6181

SHA256
81eba1b74dfa2c53275020eb512c1a955c0f6f1f9df420b737bb0ad7ae22fc05

SHA512
8109d622a5bec420bcd084bfcbf6e3124dea6df312ece9c89638b7b4e6ba005945ab68974ff82618f3df89f73829efd68ece100b1f5d8326fb05cab886ada2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc481a4a80c6aaaab6cb6c30a35dadd

SHA1
d7f08129909ba5b8cac3d02efd43aa7f9737313f

SHA256
0a6dbe6e5400169596708dd10ee594ab7c3ed50876b515c8514bec887a277294

SHA512
d7d20bec52af8e805cf63b520bca9365349421d0066181323bc9c989ae179aaf3171ef9dddf50526a51a9544b5957bd6ca93d0d785ae86caddf74da5d589c12f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4116e619c201fea5415935c1180c78d

SHA1
c33e269feaa7713399df875c4d6a42df63225746

SHA256
a42277dcd8cfb4142c5f1f1cca2297241278d7a006dab5058dbf5037c723cbcb

SHA512
b428b96a7a30e8d8eca010319767be2067110b00c4e7ed0cd7a739caf036df3f56ec14b906174a6c09ab80da8c99cdc37052c6e8bb69dcf7a7c4576a22d13fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e33c219cbdc8cffbab5418f40f059aef

SHA1
2173150e8d4ba0bb6f3f220d78f38290eb439af9

SHA256
6e266862fd40a0fa6a8252415947778bd9f6bf330f9ae81be556fc3f17c3201a

SHA512
3d14bec67d65688a4e4435613b6d2fc4d419a7d88a0d6097d4e66900956837eb05422aa5d7d0a87b1baae04f3fb065cf9a9b577c96a7826742fdf550b74c0b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45d9ce12b421e07c613e11636f5f06f2

SHA1
352bd7042aa6809943b7471b085d16c729152e8b

SHA256
61fb63608ba698125163b3e2924e0b819933b98fbd6e9240e620f38ed5e3c43d

SHA512
84fc38ba8aebd52ec08a1a84437687ace7bdf8fb2a779b2046b0b21999c94cd3743a7c7295d1fb9c69abd519c166bde9f9e3ed05bbfc2ede8fc30842b5a6ac6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AA9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit