hxxps://bcl2s[.]r[.]a[.]d[.]sendibm1[.]com/mk/op/sh/SMJz09hnzmooCyXDvZU8mABkyDSQ/1t3KnLwWBxst

Analysis

max time kernel
161s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bcl2s.r.a.d.sendibm1.com/mk/op/sh/SMJz09hnzmooCyXDvZU8mABkyDSQ/1t3KnLwWBxst

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2728601-AAD2-11EE-BF28-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000edaaec42ae6f3061dcaee871eb0f1ca714731af06d1e6bfb2778e13e7ad42161000000000e800000000200002000000025c98e3a7dee4399ea6cfd7e30b7ae3e6c87d3e61981caa30351c92801398c2d9000000019c146bff8c019824411170307f79dce81f5654722582a38b8592487c371a7264d82b85be172911da08e84c7f48cf7fd512e41ffab9500941d6244c855fd9b6008e78c57948602bd91a867778e1461fd260d3cb5d4ae88ae53194aed032d84dcb40de9779f2c60c9c4a000e6f358d3b3d23e8aa8b1eca8b439bf2117de3d0d1bec11a66690735a999a688686cbd45eab40000000cc2cd2e293d24b2e80e8056b12f9e4341a6d751c44ff4930e11ae1b372ea2105771ca1957ce564813369b8d4c7adcf91308cee3f8659f6facf0ec57d368f13ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410515117"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000090e936defa86710d5ba9a791f8626a762c055d7da65cf996ac374a0bb7675824000000000e8000000002000020000000efa583ba65ab60a2b3630fd1934e214cf344393a6074662d6789c7b712bc30f320000000efe33efb2553305dd5698f807a728aa45028fb4d8068a3d82259ce34099903cb4000000063772289dbaa5877281095b3b383dd98c7f552aa2b8a8b9d7bdd5d25b9280c2e3115cab9d9bb78efc07dcbe8f5b3e7c3faf3adfa2721bfc2031470f8a7805bd5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c3f28cdf3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2776	2080	iexplore.exe	28
PID 2080 wrote to memory of 2776	2080	iexplore.exe	28
PID 2080 wrote to memory of 2776	2080	iexplore.exe	28
PID 2080 wrote to memory of 2776	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://bcl2s.r.a.d.sendibm1.com/mk/op/sh/SMJz09hnzmooCyXDvZU8mABkyDSQ/1t3KnLwWBxst
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b11b379f6879b3fc0c66ffbdb60cb85

SHA1
f6319bad388c53b1a934aaf42e456951c0e51846

SHA256
f3cee35d267ffe174022a361e65d7a5d6b0adfc0deda4586afea759eda731884

SHA512
9163b233639c304f665ee41bf239f14b80c66cba1897959682678c012236ba245882f2e4a52f7d4b4c58ef010a9540016f57d0f7a994ad57529cce96554ced42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964a696edd46a68add9b17e95312cff7

SHA1
ec9f2a38467b264ac65fb3f83e12a814b767c846

SHA256
5f126746f116eb0cbaf802b8ccd55b61b2d71afeddbe7c8ff1fffec11cc44ca8

SHA512
296f66f6547088c359ae329e25ff7df2fb99a762f2b2af7552df6e24590f6554c0268f111f4e2c409daed20befd7d354f9a697f1c7d3890fe4833a1fa13fc964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05fd556004a6ac87a16f02b16021d9e4

SHA1
e0c73b95a01962402b8428984e9c8f94c76b1b5f

SHA256
b4d9e819d891b284bacc70ba19bafe59272cc6d253f61223d1dd1bb4f1430a0a

SHA512
be2f751b810fee683a09f5f7120eee8ea17cc92b38520fdaa1e0e8ff617fb17ac31a63a8064e448347525ad5545fe2914df12a70ea50e8160a3889bf7670b952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef74a6350f6a1e1148381190655c0ca

SHA1
f89db785bce8ab4b634d83158e54047340c75403

SHA256
4944ee2bb78042b472c97c9c359596b4ed3bc500119cea5f91c527db187e89d5

SHA512
5b3e4fcd434dc81dd35f61a714fea9fe47a59f2fd2ffcdde7ce06ee16cf72b1379bbb337b70125910c38755deffdf3935b59e254fdca67ac3213c90189282620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d5f7f7c35f941e3db87e2e4fdd8fbc

SHA1
d99cd8edb377c4672cfa8854b96aeee90c1804bc

SHA256
77a2bfb1df55873824371dc520a6e10a511e94965eb51ddcbe85aa772bf4b76d

SHA512
4c6afcfb46470e340579cd727de634ed083ab3b80c9ca7703f18e3d25a7f15acb97f7600189cb3a7712cfe598905ca390e97b0fb435a99e99d4b9aa975966ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7753833e1419a1f162d6b163f9867de1

SHA1
35ebb265ec8c330b057f5a4fbba0528c9ce658ee

SHA256
9ce8d2a24e874c29f5576c18a9ee404ff39a685b30a34fe5cf9d1bf9369647ba

SHA512
2e1dc3e1326e567b9d546c2d9338eb0ef7755c9c169b170061f8df0c20ebd904b88b6cdfd68b2c34ddc209ed106e92f6ece095bde1cdd0044371ee543219980a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b81a2cfb1571eecbb7c5f75135f3e42

SHA1
060ef25c36da76f0b3567959f9146a17f993f27b

SHA256
59e8e9f28971eaace26cac498a4817fb00b0f609c00afe76bf2f5f32c8edfdea

SHA512
dd28053817205e21efa1ceea1fb2e9fa64593efe044284c87bee88bb3024cfee25e97fe8a867f338ddc9fdf00039cf8d29fa43e298590f78425cad4f8c28dbb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d042d26330846d41be394c6657c4aeb5

SHA1
e570cbec3a23f1931e283a02fb8ef8dc605f0559

SHA256
9277ab7f8f8119e63d6715b095115539ecdbef51534d1cab1efdfa54ebae3d05

SHA512
40f235830664f68e694de985e634a4384cda97da39ba6c450bdd950aead68320f2274ad61bb104142bb59fc20aa59e6925401c1e1cef82e852eda0c98f34215d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ef2a3a777eecf26268d7c490ca11b6f

SHA1
e2b123e8fb7b3d831599c1b3aee72e3f031ed8c4

SHA256
fc6f076bebab60d1bf0d6dc3b3f86fa4bf926cfea37a2d2c7af117f45b49687f

SHA512
c9a2dcc0291bce1ddf8b1dc538bb5c05495779e0399d8812b69d594af5177a6533bddfc412111f3ccadfeb9517d8e994db4b4599df5aafaf720e65dac7a49901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b345b936cc8f0756b128fd819beb1995

SHA1
1acfc732ef174f07063973e2b81cefc8f2b63450

SHA256
fa1efa6dc3981148283f0b40423958902917bf6f07912dc4a0213003a109a400

SHA512
ebb903c7b039df473d6073d6d96897634c805cdb294620e15ad0e8dea775f86fc1fe246bac83c511b4c9511eea3a2aa007d382c3c2a42d875cd72e4da5d644cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2a21b801f139702a3ea7be830a69c0e

SHA1
6789630b2044597a5cb28b2689bade13bfcfeae4

SHA256
79bbc623be916afba8d39341a1a9689f5da5b04a95ec11be1ae5718e19bde208

SHA512
67cd16cf98d7233428e2844bc3b15cf2d67353ed23af884096ad8ac93053fc3d23e6a8c90e0cb0a6383fd2807fd26c783fbf5e2a36c9020eb3bc06b538220369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef104a6c774e1d87b5eb3400385a9df

SHA1
5b3d40e4e477f4fd428d8a5ebef64abe37d4c871

SHA256
a3dc413858ef6a9ad2844bf67d1bb2bfa9679c03c69a2da56fabc746fe0ed9c5

SHA512
fffe76b33c39ab02cc0d4c32db3c070d9276c0bd6e2fc3a254a5fda5dffd07398b72b13dfb3cf2c73038a1783a058931b27897dfed364fa3f91c4797057aa3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c30ae2df3e24f98eee109e44443f28d

SHA1
3534daaf9ad8718443a3cf07a949cfe334fa9b80

SHA256
aa609c5a92a4540830a905040b19b18691203a0893437f5bd54e2d1bb8b4d6c3

SHA512
a1c52fb20f0b73731c536e2e300e54d27d725007444917310731a0ebd4a24c03304d0ddd1fb6864b451bcefc58a65fb3d622b15b94d332e7e6bfd1123a340032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a04473f5a317f8655a8aba8f4f5725ad

SHA1
caf97e3276a28717de25ea4f547ba3ddedfe4eb4

SHA256
da545ce9def41ba411716f9a8ebd44a300c885e02335c07f7a7b650ba3d4321b

SHA512
c22f0cc0e04db3ec66506ed299099b70622cca7223cd188fd6a7964502045d80a4c8e4c12be6f23ef9c9f3b30b19ac8499e8289fe200990eddf183901a9d617b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
744d9b869b8811f2754fb95d00a6b08d

SHA1
bc2d66120877d3bb53f010f99809d587f2da653f

SHA256
3c8559a00bf63bb296cfaec8ce01d3bf21e4555f0189b34ba62a29aa2a6061d6

SHA512
d4123635becdd2eb33599c427bd4a6b4c665e83b09c7f29a7e3c0bfc5f6f8290ca668d90e7d3a9d46e1584b7435e653a8ac3db362719e0e9a46ddbeeead14396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b32fb1a9ce03ac2161974e37cfee990

SHA1
6216f2c0c79bc470ba8ed1084126a7bfacf02bef

SHA256
34716633e09d9ca01fb4f83914033d8c5d63d3f83baee348df78741316f67c20

SHA512
b1956438306b5e121f66b9166d4bb65f5b3a6a5839792650e4178bdd11d327425c24a06f128e208b46a53bbab7107cbb62e9d982ecb6a964f6356a5d1e378031

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA63.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDDE6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit