hxxps://dev-nosequeseaperobien[.]pantheonsite[.]io/

Resubmissions

03/01/2024, 19:08

240103-xtkaxsghhn 1

03/01/2024, 18:41

240103-xbzb5aghdk 10

03/01/2024, 18:37

240103-w9ws8aghcp 10

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dev-nosequeseaperobien.pantheonsite.io/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000107ce370958db531fd64bce5c5f5cf4518b84a2e36b7ae9481d84ea798461b74000000000e8000000002000020000000ad00c0928dcabcbeb319116831256529dbaeb495bdecddf18df6be22e0715375900000003368bd6c8a65e22d1604f07a1e6a0637b8b520b009e3821a9af3470012d00b3732363d023007a9f4c6a9bb3f573983053f10a3f7af2ad315b7b360eb1c4c7471cd6024d67320d86c4d432046f10896d841f748972cce198f19d0e930210ad15951a16bf981f62624f2d6b367f6271338697399a4ba4ffd2fdbb2af043fff80cfbfe506f45db74b499dcd629e49c8244b4000000013f81b642e012e765ad59e85b3e63199c34ee9308f8c55cf1ecae438e3c4e588b7a1b1b49a69f357382f4b9fbed73283cd2c8508dded918c909d3fa784a3f922	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87D6E471-AA6B-11EE-89A8-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006d0e66232c105e5429546d51d1c0f5d4ce62a5ff0b008dcc6f347ae7d58feba8000000000e80000000020000200000009bdd0c228f485701d82118b331c358a2ca1bf31b6633c1a7fba8173ca1f4542d2000000061d4c3ef1efaad762c8552b7b1faba9e73c3604fcb4d3219892218a3da9e1b4d4000000087b3803950d06990a7ca23a50e4b9279a620054fc8c694cf5cf82e18c597930271f10aac81faf1c554d4fe5c24361d8ea6eb2c31bd2f6a1f9f9f06e74b141c96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410470807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1065f872783eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1764	iexplore.exe
1764	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2976	1764	iexplore.exe	28
PID 1764 wrote to memory of 2976	1764	iexplore.exe	28
PID 1764 wrote to memory of 2976	1764	iexplore.exe	28
PID 1764 wrote to memory of 2976	1764	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://dev-nosequeseaperobien.pantheonsite.io/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58a7971a95ecfd2ea8ccdb75fc020025

SHA1
008e0d0c01e11e65570b5442b409817a35a9a238

SHA256
524972b388653f095870895b518a66a50ba4fc4e3adda228a50eb612d34c8468

SHA512
4651a52c88ed90af9aa30151f10d0e8bb9134b0bf686427c6c38408603b39b8c0f5e6e12e113e41a6ff70b42c33ee970020e9a6e7314ac6e0ac1cfd6988bf0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b899f42cb8a8e660aa8c78047d1a598

SHA1
19ab1eff3c2eac1932071f253be002d8d90a65b5

SHA256
97900b7de11efab8310b5ceb50f2742933cb7fdb88f1fdd6e8e25475ab819d05

SHA512
5d7a1c50babd02fac1b7df9457d629f992028303dc620224c46cee4c8eff18c1e89212801dd41230eab112be03af733b9f92a04efb576425c94da13af1a13f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5f9dbb4ced234f13d69556ac789ba5

SHA1
ebf00e01a77ed71d81ba290bf43f8e249d3384ef

SHA256
74faf5fbfd8ceade1e67f53d61c19f1f677afc517b17701f7381d3b64c4ea5f9

SHA512
e6033a22a5d2f6f3a824c293db77a37621240c8f6f1500db7939dfcdb87c4a208254dce5e97500f8306783c071d0812fdc89bd3d79c9a25cc10c41524cb065b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ff56f9f88c3bae3733aaeed8527ca18

SHA1
7d9376db95754675e656507224c91db649c978a8

SHA256
2b3db636c169643a25b780fffdb81d3b5eac6622d23fe31acd82df9eabf433a9

SHA512
63aa2cae14ffd0ddf752370dcbfd083f78082a2060eea2091bfb9fe8c5f0342befe8da0b70230eab582c212cad7c7187c3b96e86fbcded98f3a5b7a693943bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66019b7e1753aa07ab9cdc179724f667

SHA1
da875cadbd37fb1d51d69983e52a48317f4a7649

SHA256
109d275e3cd7da25e432e6896897018fc5b3e26ca1749f89c2e803302f93774f

SHA512
d575a85a7c83464429418ee59586c7028cc5487b7e38899d91465b3eb6888fb2de2146c55197e4b2a0de7855a103bc8d67866ba8a2377c9ed7c89b60e88f24f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb905527bebc9175946b6884b2ada17b

SHA1
9d71de26a23719aeb72a72cc67c2aa1292e8f491

SHA256
f8c164d853737c76cf0a409ae6b1a970365b601c6b3c93635d11b2fc05c04982

SHA512
f38b0b58034214962b6efd92abe8580def45352568063dd1b6567002a1382cc88350a00d8ff968e9cc15be7294a607868f4be307355c6b2113f8167d2bcdc1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e0e9b0e2c52f1c25a4ff797e21ecec2

SHA1
1de88d38c9dd3016992f05a27a550cafec96ef74

SHA256
7a990eea7ffc42d2fc74f8703a24a6364a1afd47d00000e9231faabb3dc817ce

SHA512
c11fb8e10b9dc3faa11754b8577f99c4064874660392ff88837eef092651c32133cf2ddfe920ca2442e783812f910bd3ab6daa9c3b4415c10ecfbb83d479390a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d635d1d1cdcfe6abed5c1b2d5d4ab8ad

SHA1
5a959b1c59d6b0e7bc2ffb6eab3c9a18e634bffa

SHA256
72735caca729d836752b92fbc4e8dc5c3ddfa070ba8240668ec91a1ca5ba0ac7

SHA512
099aacafc1feb521126e99052a13508b700de742f9726a87547e9612aeaf5adcad00b8d7e071e4d31efeabf1c1df1aa9bda6a2cb4f80120c8888d609b2150885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05794642ba6455275647c797f5ce9a6a

SHA1
a9847d32e3fec04bd59aad6c0f0577c849eb02b1

SHA256
c28825a14e712fa3f9fbfc3ad132803ca58829ff41d5a5d48fdaa115f4436149

SHA512
28609e26f065e97ae484a1d217b4c3e3cf0b27d3dc3e075a501f37203dcb24bcf24c327a8b8fd7a658e0f72b0f3214b319ee7520c6ee2570a92e65c85c21db0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cc88b922b20296b21a2439712997732

SHA1
bb5793251eb783755b1cd489cadf70cb03de8a68

SHA256
9b1b7bf6371c41b1f969feb87a1d43107ad2c3e2d7b2eac03a8b96b000f53b32

SHA512
12fcab93e4c6bb34654c4ded92c8d66f77f422754b875cb16b8edde4c387fe6ebed6fc8b9b7472600a61bf5a17453156d435a8f41b7608de8ef8e139b5499d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d39e687dfa602270f2bacb7b9c8710

SHA1
832f4463da40392457ef7b9b7185a63539615c21

SHA256
09f0eaab1f4ae5ce1294f799c462091d21897ff9d5b5f5a5c3150f184f120a35

SHA512
4e71f0e223740b8017cb4f929031e8095cf7879587c9a0bdeafbdea8d7bfc910a0762c93b3c411f8256d29454472cf00afe6f160e2e0d6cbcca6e1a193bf22e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8acb531ea965ea38e5987cb4c62eab21

SHA1
681cb2bcb4323653dbd1fde1a3ce652ed19100e2

SHA256
259a980acd51a777b36bcb3377b3f3b0bb72b7013f12b71992eff6511c3d1d59

SHA512
218eb5600d79f751abbdfb59feb16b45116602b5e78f3b36b3bcfb17117b046fe5f5df5a8ca6f761690190749d5169524b7d40cb954215b96d572b463625a93b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE247.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE315.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit