hxxps://global-secure-platform-lkg8g[.]ampfibian[.]co[.]nz/ml/?domain=cityswitch[.]net[.]au&email=jack[.]blackwell%40melbourne[.]vic[.]gov[.]au

Analysis

max time kernel
121s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://global-secure-platform-lkg8g.ampfibian.co.nz/ml/?domain=cityswitch.net.au&email=jack.blackwell%40melbourne.vic.gov.au

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e3f11b8123a46a71141db27e05d666ac907410b1b4959553c395bbe0e7417e57000000000e8000000002000020000000cb7988870db050a3e7978b1607a4156138ae9347b9a47b644c86f4842a3e6f8290000000b9f24b2f3ac1587349c381bd579ba50f22655d820782da4e99e6eea6c57712b41d4bbf5ce38f9e2f6e1eb070cc146ebeb30b3e6d89e15d1d1205cbe19e4450566ab26d879146a1d6a82ea30019c561ab8a2383f9713b9073a84c7d37fe0ac7ed8f63a28abd866381298c79e1065677e5df8085b3f9b076f256d1f508e084a8af3bd4054eb73d30e5df2a12b7d55c080e40000000195aeda3e702ab90735066c1cde8567c47c6fb2169b178b114d72f3e88ce26e2364cb519156283136fdfe7aa55810731f5f9e5d17986b2cf4e2e5c11bcaa9458	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E3ED241-ADE5-11EE-8575-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0635b28f241da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f8d467238646bd441762afd6a4d30d029eccecf7c39aa65946c7257984eed4e6000000000e80000000020000200000006716e53cd0b7d5a69cb9af96d98fc7617d6b87a9f1cbd9dcfa3cf7c2c0d8442320000000126ec628bf5cc7ad9d1165f12bc9d8afcdd74edcec5e5c31ad940dbf8bf5d9e0400000000c49b1e5342e80e9636cfb23ff3760a85c3826c52386dcc9ba2519af2db1d7e4ed59c5c6b86f44d506aeca3505cc6b10ffb61b2d68820fe5729246e77644c2cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410852961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2844	2140	iexplore.exe	28
PID 2140 wrote to memory of 2844	2140	iexplore.exe	28
PID 2140 wrote to memory of 2844	2140	iexplore.exe	28
PID 2140 wrote to memory of 2844	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://global-secure-platform-lkg8g.ampfibian.co.nz/ml/?domain=cityswitch.net.au&email=jack.blackwell%40melbourne.vic.gov.au
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
123520047135e6e4c38f0b2e2fdfce6d

SHA1
d2f0f54ce9511772c6ff16b38d219c69ea31ce9c

SHA256
cf38a0a2deafd7ffc2ca8b298edaeef044c35ed66f10a7b6781009b4fbdf8694

SHA512
e9f94c324797f42b72c2f4fa7579fd8b978016a6a3f96d96a2047ca56838fff597d9582d1e8550e304d045f25e007abf60ee01f509ae6bbe6d9dd599aa3696b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25e52359440ccd22a23dcae3ce973248

SHA1
ec0db50e57490a86d53eb8226265b95b5a98c53e

SHA256
35d34c47b16db6fa74179e79195f4213758420e814c5282cec5e3c5d26be51dd

SHA512
c5fd4af1ebe990e71cfa661248de925bb91cb944f0b3072a4e5539cfa4d7c0e3ac1ce79fc487672727e71fca9b4a8e79840d192dc93cd2502bb657d7329ba2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e351424cf7c0cdb89ea15d4377153cd6

SHA1
771862c37fcfc9fbdd3e624c24e883e594d13161

SHA256
be7704e14aec5a25de67ae72d8819600ac26f507a2c20a0d3bedcddf7e096fda

SHA512
9998fb94bdf88a9a576c0e3f6c099a4296373a3725b24a326f5246f61e0a32a1bb682443e3d8ebf87180424fcc6a629a1d71da4e815ed2748ff93ee73ce98620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4f12f8e676cc47d1af5b0764401f593

SHA1
3234d434939a5da70bda90f78056fd6ed56ff829

SHA256
d820c45507eba35828c5c50c392fb0c824eba31486e7be449959509f29314bf7

SHA512
e871fcae66cf63bfcbd20f36689df32f6f735fbd8437630a69f5764238d445c0ab2570d4a7cc5b2d97b56ce93808d9c1b29f32fa509751625e8914637f5beef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cd6bb3b47a3893f93ddb93d859e5bfe

SHA1
a4a10af6f22d1e3acbad5dde0c28921abd750249

SHA256
1b63d2ba4f8e7a2e717063377b181790632268f2a6063f3091e9514eb7068807

SHA512
240fd379459c2c4e6bdb1be2414a56d3b428a1a32ecb181ca5cbf4e9d991c6e32a4bae0aa07aee5b3babac4b7e1b23a4ba61139e193b76b76ccba199ca0a2ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4fa36e16d512916c5d685194b229f0f

SHA1
c563f1dfff5383580cc797468f24dd2fcd8f81df

SHA256
381d0d0b517a47b3432af18232ab88c2d1e6fe03c3f67f2a998a8f914c4150b5

SHA512
dac2c5e18488d3b5af0e249538820b6547bad82c1abe269ed165e5ac77f33e9a386e52a5488534dab843278fbf1947132121fc735304fe5764cbdb52336ea89a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
364914cbc26c97f9caeb80643b7e46f9

SHA1
5534595ed4552b7a38d563859c1df77084beb8ae

SHA256
7a0a9091f740cc31185a101ec2f5d13a60628f86f6d2d2eef306dea7200cb7a6

SHA512
0cb7280722c6a5fecf233f281377fc37bca24f87132834c73a45c7e409095321ea3dc1d40be5c3f0c4a039c801d742fd075bb93d9406cc27a9e14a6ea138a20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d88c6dd7ea6f1235669affe68f06bf58

SHA1
d7b1548ad69fc2da00cb0e7f6b7aac472691bffe

SHA256
a5bd259949924d27d582154bf63cbde8a5065871259df6006a85e158f832fd31

SHA512
e2fc5b16a35761a2bbd303651f46ae200f4430c0dfd7fb281a9292e873addae6c1079ec38545eceeb15fa5ae402aa027c5b9e77a50ddd5256f3228b531ec6471

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA3E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA3F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit