hxxp://links[.]ei1[.]email[.]military[.]com/ctt?m=10434088&r=NTIwNjg2Mzk0OTYwS0&b=0&j=MTkwMDEwMDkwNAS2&k=NEWSLETTER&kx=1&kt=12&kd=https%3A%2F%2Fwww[.]military[.]com%2Foff-duty%2Fautos%2Fu-2-chase-car-spy-jets-best-friend[.]html%3FESRC%3Deb_240105[.]nl%26utm_medium%3Demail%26utm_source%3Deb%26utm_campaign%3D20240105

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://links.ei1.email.military.com/ctt?m=10434088&r=NTIwNjg2Mzk0OTYwS0&b=0&j=MTkwMDEwMDkwNAS2&k=NEWSLETTER&kx=1&kt=12&kd=https%3A%2F%2Fwww.military.com%2Foff-duty%2Fautos%2Fu-2-chase-car-spy-jets-best-friend.html%3FESRC%3Deb_240105.nl%26utm_medium%3Demail%26utm_source%3Deb%26utm_campaign%3D20240105

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d8b082fb3fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC18A331-ABEE-11EE-96AC-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c484f419be6fa38b35449b5c5d7760baceb06cc26d032dc7af9f29df05d4a4bf000000000e80000000020000200000007d6f1430477f3c258469f894aa09703be2dd357fdab708ec691e9793297705432000000005acbe9372df1c4bf8f289839e14ad19e40840f12be43a592763d04318bcedd0400000005f61781bac746d74e7d6ec82ee3b01f76a8f09606e0fa9f2a425f4abce7099264afb735e2842929aa53a1d18a62d7eed35af7e8b27b474c700f6de8c2a0f0288	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f3669337de45440037c5a3cb48f21f28084ada98c6a13544ae623f9160cc6379000000000e800000000200002000000049f14da3ed4aa7f08b2912762af641b42104773aa47343c8df3dbd5bebd0b37f900000006a0349ddab29b0a02ae980c78e327b94f47d1a16263df76f1b02be0a39f19ab97a3dfeee081626b7f262384c3392454d0875e14e6154334833907ff6d4c6e4e480106b2b4e55c83624ffe80e90ac2c13314803cc8744e46dd11514ce1674dc967076c65befd4db0c7ffec8659b49b3325bcec851843922d662ece9c0948e3923f89675bf5d7a070b9381a35f927ab0b0400000009fafc84c1d1c116ec0552ad7f979c54df566fa4cc5cc9a3ca920ba4b0b4ff49c4a255f15b07f66d57dae27841526803cd22404619cc38622f6c7f7db1390f074	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410637076"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2804	2844	iexplore.exe	16
PID 2844 wrote to memory of 2804	2844	iexplore.exe	16
PID 2844 wrote to memory of 2804	2844	iexplore.exe	16
PID 2844 wrote to memory of 2804	2844	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://links.ei1.email.military.com/ctt?m=10434088&r=NTIwNjg2Mzk0OTYwS0&b=0&j=MTkwMDEwMDkwNAS2&k=NEWSLETTER&kx=1&kt=12&kd=https%3A%2F%2Fwww.military.com%2Foff-duty%2Fautos%2Fu-2-chase-car-spy-jets-best-friend.html%3FESRC%3Deb_240105.nl%26utm_medium%3Demail%26utm_source%3Deb%26utm_campaign%3D20240105
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b207f45be4c2879565a068ad982394da

SHA1
67409b38809e5e71fcd181b4c5ed04763cf63850

SHA256
a60a5f69f27e84be387c6ee3d33fcfb0842cbd404f273844969d5d04a8acce25

SHA512
9e47e6115803b0c87cf7634b96140acd7532897d933e65a74e37024c2ec1f3ac0cca9aa654235b1b093fcfb02035bb88241660e6fad449d03a6b9a36b68a1ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b97aa0e778938981388eb38ae467ee

SHA1
69879676b50f58db855083999cfe33bedbd19408

SHA256
56ed36d58a1bf79c1fc4f10a6fb520dd68e620fe42a207dbe617d27dc03259c1

SHA512
2c9e1d374002994bb3af8de883884a314238ce6e11c5f6b5aed707af62040c229cc31e66f9ae2965c8d18f35ca89b1df766cff966d342b3f1c996e4f473af90e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc39d78b91012254f436966565df0289

SHA1
e1080fc73711939f700b87a5643feb12e2c64735

SHA256
06eb270a25a5e71881364f022270fa1dd992015c1bf321f078f56ae8152e864a

SHA512
823fc5682014925b39778fb8137cbc801e8f76982863c5349d64c8d85c69fb82d77c41fd9232b658fc016e0ac7a0264dda82c19df8862d5ce52b49d7738a2d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b68aab471eca4e461d5f3c512ae4e27

SHA1
990e69b8c8d7b58330cb50694591c98fe68650dd

SHA256
d058a876fe81b8042063c8382dccfb40493ea434cd36ceb4ed7c0b7705a852f1

SHA512
33b49a9ed405a9b77feec173b712b6430685be2004eb70ceaa6824f7c9e0905efc61bd200407e6cb3dba32fd435d461f51815530cd5ad0f25c3a4b7d3b1e8076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3a576cc144f73f707e09cfeb3719681

SHA1
1c8374d333d368447bd1d96f0ca1f52c23560653

SHA256
35b100f99d112bbdb3cdf89d40bd5e18f96ff624438e69d45a7114f22050dcd9

SHA512
9b2ac346f3f694c67f339d7d48cb1758ef9dc0984ceb2e15f57cae91fbb6a8df0b575827fb6ef13315a2230ab79bd40b632b7b3a9b8ac37d3210b460cf6843f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a428204969997357fd3af2ef832bf741

SHA1
95d038c68cc0b7cb0a65f1c5d1a4ef07b30f7f6c

SHA256
a726725d455345a90b942227f562379ef6cd7652e9abf56a0787c669006cc003

SHA512
87d8e3416fae353ab25773cf127dc58f99b173e75e6aadedcf895b997a96a4f9a306d9890468d30fa5d8f1b876ff33803678ca3ce09bc2dafa581cb0d43e24f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3debefa2fb1300c3f2a593502f4693fc

SHA1
8d17b471f2fdf00f9362af255a653ab097131e09

SHA256
70de86168b257b4ad43e4af5e00e8363568d9d7b6b7c6b0e403c37c8bf1762c9

SHA512
6bbfbbdb7865a659566ad5cb40e2d7ac6da4328d545d0acfa61d58028e3518fcb0e941afff8c19cb2e9ffffcccf4b12a700e09990cc6f5729e669d2b3e67e837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e347cd71bf5346a9ef0500d3de771989

SHA1
7cc1394e7b50e99d4ee754c17498d7f146dada84

SHA256
db615ac8cdb68f1e6e3da286d3ebdbc953911cec3a23a097d2c34669d7cc118d

SHA512
59c13935af2a33dd843df1d7356df902dd5c346aadd3092e73d8870befbb5c15f0db15d8ce2db5fe861ffdee7192c8a86812b85daca8712a41cee336dea22103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
793c83dedf10eb4a78c0abaab1d15369

SHA1
b1b0b5ee073db2e78328b0f2c0c72b328158c1ca

SHA256
b7772f5ef688f701f777f9d4ad073d636e32384e472a06d0a9839ae2501e429f

SHA512
5f6581637f40b6d1c4fcc18b065d3159e02635cee713214d19be978bb38c1a30bd1d721607450b4943a83f7df2abe2409f360704b5d9e906442c56ab0b8dc085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c38c00fba9d5099ffd8a2df0d2b9ed6

SHA1
48b3bcb6347d7042be727576dc5abcf552f3eafe

SHA256
98829efd2b4b4c760be5b0a353075abda36fdbcea13fd62814f57552b0199207

SHA512
fe75b07121aad97316d22d0a20d56bf349d5f2f94531eb61ce1324622c962397fc793bdf50dde2c3a3f2bd87770f742ecc48657592dd0b9ec5ae40651bded8da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5fdce18faec34103aef00ec99d6a504

SHA1
173d59ac79acf6df3a7a2a1f57840c404b9efc5e

SHA256
36c81c6bff51f92bd3cfb1373197596dec9250b8c32b28b6bd2e5a98677e1133

SHA512
19c9d44e7433e6da373966ff1234133861a364efc399be33b8f233ff159c07b5b96ec1aa740a739b98683cd5402f8c67163c63565d7017fdd2e1139d498af816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82bc536c8f3112ce4aefc46d405d0a31

SHA1
ea002cf9b9a8c9e75d33bc1a79a2995bed0ba923

SHA256
7285fc0721249a43b670109cbf25b32ca09cb6359fdc1c2c5c2197bfdb064cc9

SHA512
47b47a6bc0060e2aeee8f04a1214f4d54590091373d2d450564a81e6c45d685c085446f462232394e9add68291293c7cb8257d0e38c4ba97cc6746a3e8809caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
664381125fd432b34c2782c972c8e88a

SHA1
076958e10381c89c30be091a2b03430c1c995f27

SHA256
8b62d23bc68059df75107f6857960c5e0ac6724d2f30dde23a68a32dabe3f0dc

SHA512
29d32028c8ecadf7dac80a28fe3950a1f47a22b215db517eacc6f57385ebaa8ed8f2ad22aed1a99555c2ccf336e0d6043509e1753b9b70ee0fd087d9fafb6a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57e67fc35be867a4d9f78dedb9eb501a

SHA1
7aa6d9203218c5377470ee1340abc3e5baf5b020

SHA256
e4aafb6111b63633d9feafd4f74c85a55c99dea1f0ac9d346e4c73b61098d3bd

SHA512
e5bacc8bfd69edc5013b825832104763b047ec743854a461a37e30c0c1f8c13e80752af350e37fd0b3748155d645fbb3f24729bd9be8f72cd3337dfe71030efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a7be0dca06a0c6d8a556dd6624d7293

SHA1
64c4c36b6b2633f5d6f9cc821e8b6cebef26b33f

SHA256
bb1c8ef71d8b4372c137ef46e93315eebbe4f875d97eb63b19ac96420ca6012c

SHA512
7d91281ad3643ef46d32ee552e55f4c59c2739e5a426effe05fd7e6cbc8d97ee50bac997433eea99a53d9493bff7a65b04ff4c87ae074dc64649e89cb0f6fded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dac678569022a5c5eac2970fdb68f822

SHA1
06ac0b8e0bd0209da9248d1061933a0f2640d1c2

SHA256
60ba88833ff5429b82aae23e563d64466bdce014297e7ac5f5178fd2661cd1cd

SHA512
b4b296dfb20daed7c2a63c725710184acdbe3c1b603795673937f4242c553ed9ed670c481eaf94f710561284f4e52676cf475e617bc3fae083fc7ba7726ef448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5d70912a9680ad87d6107b9261f57b3

SHA1
ef1ebddaebb2da34eb2961f4f77721506e725d15

SHA256
31d563eb2c0b3d885301a1553dbce4e1b8ac603ca5f8813cd1762e68925211b7

SHA512
d461c4879835512e97a32bbaa6eb13bf36f301e8dc3a644f3b2d666b325b49dc346d01b2e7cd2ef310276e1744ca52381b82a1edfe616582f46478c2aaa79ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab44A1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46A7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit