hxxps://itctransco[.]com[:]2096/?goto_app=ContactInfo_Change

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://itctransco.com:2096/?goto_app=ContactInfo_Change

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410459647"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000917fe071ec5e7676531dd55e9c8b69dbef095f8afeed25dad7329124ee5bc003000000000e800000000200002000000017beffdcb5aa7518d6e1b9e5ef8c7093cd37a961b65c95b7f507935ca9f0032d90000000d21002fdf9d8b961ca23ce35e4358b5a4c9ca1dd26b38d703bd69e1e14d01d6df0c869165562d0947ce75ffd24bfe0652972d2dda5b712b2c4021fc3d11d83e23910c25f572ca9e4e280d0413a99281eed2170710574c5ded5d9d92940a27f2df51311211b0e3863531a5158f891ea797a139cbd763f0e3ccecb992b7d570933a6d094c3687ceac119f4917027c6518f400000001a54e3b4ad0b5b8249a4269184a94c664a03c9ea53f7b453394ac953973c85449743329e2cc3dda98b0e666e868b77fb640c093dff4cfff1c746886b92d77aa3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c928825e3eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E1546C1-AA51-11EE-A57F-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000074f77483970a5973ec29c30adf23f0d977a46a324b46da67ab27a6b66f7555c5000000000e8000000002000020000000bbfa9885ee850b1e3285c4bc5d09e92098d8446934fb048d784cb717ec4009ed2000000053bfadbd18eb35c5bc317c8b898d17b618906c38b02b410a81a903b4c632e5f34000000082561cbe1829d635d0c7e7ff8bdd0c13638f864e26b3a587ab7a2cba8983681c8f1a739a21cb758ee8a82616ae876e3c80cf3232320f844bd950a545fcab6bb0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
320	iexplore.exe
320	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2536	320	iexplore.exe	18
PID 320 wrote to memory of 2536	320	iexplore.exe	18
PID 320 wrote to memory of 2536	320	iexplore.exe	18
PID 320 wrote to memory of 2536	320	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://itctransco.com:2096/?goto_app=ContactInfo_Change
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a6871e2757a006119952cb6b71da785

SHA1
133d758d921406eef311a1e066ef021e6a84b02e

SHA256
d35d89616c32efdea632bf4984d5c0586b94cc7ca37012b13507fe7f1ee45f0d

SHA512
0e258b7aa78e986f85d9ae2b3076880d68d9d7bf9b96cd7905a38fcc43bc7852757ffda8fb4a5fcf0f85c851fcb3ef0cdf8b58d301e658242551e766dd5140bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f320bf106a0c3fffa6bfbd16ac3c779

SHA1
c61b9471bba352c13715f48baebcf696bb8cec2b

SHA256
68446132ebbe2a550ff278d14175f4f57120605d1daf150934dbef9e53df189f

SHA512
0b53ccc934cafba2fbcc70fd65b7ddf746a953263b07493bb34f3fe0e7f34a2df0e38062782af8f2123081f6069a7834462a89e49c82d4ab64d50dcc2c0865a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a778dadf26814a67b066bd219901ef80

SHA1
413f5ee3e29f79280184903f696b2800278117de

SHA256
03cabd927edf8dd388769f9cd748286505b060369bcc0e3e824c8f446f4510f8

SHA512
01e8a1c808b5ac8453d08268d35598b0843267d8cae87be5d6cb8aecb8b6ba80e6ce167f9e7dbd223e54c4eeafe13b81b995ca02b2023006cad5b4e3a005d282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0834f96587a18cce79d0d9654b4d3088

SHA1
7e29e6d6184e7dab46437b6aba4ccafc90082afe

SHA256
143aa8e635ec74656f3a897572925b5271f264abdb457c21c9a51c08bde0e03a

SHA512
a09357a29c8dba4d516d724899bf6d9b292bf9dd47229e92af208e5e21378cc6048b290fedb44867c09e81fffa6b37e74d0251b6dc8c0ca4054cd2be4a0ed7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3e36b050233b56214498b146ffa4ee6

SHA1
2dcacbe7134caeb61d46be19bd107bd2c9492f57

SHA256
72546197e03ebd34e609c3c3d314c89d76768fd6b04f336179a5493dc2721526

SHA512
cb9d7939da241788fa54e4601b4f355e3aa2b46f0dc365941063eacca9bfd174d3528a43ca26dfac8efac3a5dbb23290d18a6a975ff42da270a6479317cb648f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8efeffa88cad160cb39376b3308fed46

SHA1
1424bcdab2a24fb192b6e8ea879905d41f84b0fe

SHA256
8911ba13da1f5f51d8655a94ecca8451b11910ab633e3811eeb5cb543135211e

SHA512
d082ddebc07f6e31899cd7ebde4cffc035b7fad6354076e7d6221c5159b4f59c19469adc7e20b7d4c1f455e1a330919655b6a42680e02f315ff998c65d7decaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47b22ea36c711dbc117dc36d2799384c

SHA1
6e82edd4fac1558e0a3501e58ef98bb11a3dd338

SHA256
5eb8fb62b9fc3b1bd0d7ea08e92e4a008a3189a886892e78388f4bb2823f97a4

SHA512
8bcf3c2f7b22cc5b049ee4c87470eb4b70b43aaf340a2c8483be603ec80a6bc0c6fdd8e62646614e3e43daca2027859f2dfb963a12c8f81bf1c7a0de1e4a4276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dae4ea113bcaecaf62dd3dc381c873b

SHA1
f195e23bd4dc338f14ef0c2789fe8a3149fdb39a

SHA256
4bbb2201020965b5a0d2dc3d2b0f45fe10b48bee9fc2dd8facc7b45dc282b88e

SHA512
6477b8abb65f47bb6291645f779901941c3a7bab793a7dcd398f03f8bdccfe38728a52592d449e7d16e738944c7b4523b9b5a0bc8bb878b1e4684ad1244e65cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
887aa418b1301b7781296ecd452b5f58

SHA1
73b69a205cd8ec6cf1f20e6f9ee0d74c10b6bdb8

SHA256
49da0ac600de6cdaf440132f309560f446e4d65d844f3778c3524431906fa03d

SHA512
5fb57ac598dae67b803ff48a5e65fa04fd9ac5497309dbf108337236eb7192688caf7c175add473c98525526b416c9058d42dcd6f0436cb39da06cf31890a8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60054d0ae66a50cb7c7e78761ac9fce7

SHA1
c49543016b48d4535512aaa52eac07f9bf37cfdf

SHA256
b54674c4caa59d24c996be1df28602b32506023b36b0e3b57a82098ef6a8d371

SHA512
0ea7999d866901233c381d4f469d1d9dc7256091657764ffcfa15ae6b38cfd3353bbfcf182b3ace9c7699e54c0046462c38c232cfcc32a37f05ab24bc39e2679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e69d188cdb334dc9d9130f25a130139d

SHA1
5d9b46420da100364de144a81b7b0bb3dd5b031f

SHA256
f98d1f3b6d1d2bf19f47caccd61757856e11142422c61649ce73134e976ab3a0

SHA512
eff818948f88d4361a648d40c453d0bc95f4c7eb3d1f28fb31035f2c52fd1a91f30198b572e5ad29e9d9991f6c2a2113fe59fe847b302c68cb35d21e98403f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2371a9c655875f60dd964406e96001cf

SHA1
88ae3cbbf8d711133bbdc81a8abd80b08dcf93b4

SHA256
63376fb52288e61cc6dcf635f63c7f7539088ad57f91ddb36064debe6b3ac15b

SHA512
894c2be49d86f4158fa58e7c393a1cd38adbd1c7e8ab3d36cadce71c34d2bf5f64c90bfa168e52b272efad1c9555d5058be2cdfc49b2c0f0f18bf18000596172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3403a5a2f118e82887a0d934a1849b

SHA1
be761ec41efe01783db591d3cc65e15d35dc8e7c

SHA256
8218ea11403924b90cda6ccfefe4704b430a2ec240f2eb38e72645c8004445cc

SHA512
a3b2e5de050b3e66621ceb9b998c8b15cf871facd5b1246adfea7c4d60e420e1126ba09725d0a95537e2eb92fdeebe14cd4ba8ce4b46954b371c4aab8c8aee23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34BA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D54.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit