hxxps://mx[.]neom-energy[.]com/

Analysis

max time kernel
314s
max time network
318s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://mx.neom-energy.com/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8001cde5fd41da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000278574f6d6208eb45dda548c4b762255c122bf4cffa36ba9f75d76cec7459529000000000e8000000002000020000000c701402fc5ea6766d8d78b4f31738d882fc562c87767625ba70f251060593b30900000001ba69b42b4b988fb6a9caa02833a83fa9578cffcaa3a431a7853a015bf33cd357850de5bdb40a5b2f2e7f9406c5744dd2408cbde36eb2f35aa8d4c4d8174048451ac012fc1fef1aedbcb0955b2ef1385693dab1db454cf96c50108e53389b714e94403984dd5045c88d308c8b96192bbbb40195c0bc353edf81224be066a40c16ef4cf13dc1b354ee2a92b30ceb0f47640000000e93d7bcb444df183b8b70072d317496fd1eb749cb4591d41803f0eec0c681173f260dc4d0c646732823b0d884502eff3f240ec54464b5369aeccabec6e61d02c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E4CC5A1-ADF1-11EE-88BA-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a793df5ba82c746160f10d491cbdd40bea50c2b4d43874e2bf9be75ade216bca000000000e8000000002000020000000040f631b869be10356cfb2788ffe30c78e4652bc4959a5f7bd407dcabc8e3db220000000056dc80a144cfcc8f03d60d8a22f9c50909920310efbc2f99848efe04f815d66400000005075d7278378bc234ee37a8ae308302654c132599eba7877867879418e4d3459f50883b8366c9eb9413d32cb262aa7a5b9737c19c6139ed3a02daa6b01c1dd0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410858006"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2320	2512	iexplore.exe	17
PID 2512 wrote to memory of 2320	2512	iexplore.exe	17
PID 2512 wrote to memory of 2320	2512	iexplore.exe	17
PID 2512 wrote to memory of 2320	2512	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://mx.neom-energy.com/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f0c1f921813d72521f3e3b51311ac40

SHA1
6fdfc0bb139e3b28fcaa8e10567adc606bfccb4f

SHA256
ef1fc61afa894f69a0560499e94b72b9668eb33c9eaaaa8a38f0b1d0dd882b90

SHA512
ebd5c6c04aac6e0cd9a61c6ba9a1a0247977e7cc427134d707b4e44214b2ab07c76ba2319982045a91202b49bec198317c68e1970399baf932711b46dfa0d96c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc0ce2fa7ca64ad82e3ab641418bccb3

SHA1
bfdfb54b5aa1e879dcaa6c6982f643e9910eabb0

SHA256
ee2829f63845257faa87a365c092fdb04f3cf832de0312bd59fc607bc15997b4

SHA512
f9ecdd432ef755cca1e44e98641398219f221695cccc1da1fedccd860c30636c2a3758c9a725947d75ff3ac04f098cda21ed36c22fea56096c67b6bbd4320946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2144ad08063217942a6702b61447f092

SHA1
ca2ba5a5f02f4c64ffca1085e96991d73f2ca5bc

SHA256
a16dbda642b527b8988a31b8ecd17dd77eb1b5db47d9bbaed79b6de190423060

SHA512
db50532d7e6404c2e3445edca2f561a6db29f859d613ba8764098196edf01e0e17bc07938cecbfae7eee79f6d6c4ff58f9f592f37adb23315ae2956c7a55ea03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
284236c54cef6bfed436f1493ded678a

SHA1
67097a011d9c6e16fdb33dd3ef5d3973a816b565

SHA256
a9787363ab5fee5147610b24a612af2b9c66a4ef2770a53cfb70663ee82eae82

SHA512
d9b47f10d39a66d6ac8fccb87ea4a6503f04a3329ae678c076b70cef04a14ce7745bcae303631146bd432a7893767767d6479f7f8f72c704748f27c172932ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ece74dfea627e5237ff09d06a05d422a

SHA1
aafe7020b4957633c01be00229f72ae1729ec138

SHA256
acfb64e729c5d1a8151dd01910a76cc2fbce30f33a9877cf8db20c78781f1e5e

SHA512
a18d1cf09d2194d21e36fe34cdb675e59dd9c332f93647d4ffb94c8206e60b20766ded6611d9bf5296b635b2feea66ee9088e8182354f12ed5324a7e10313bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afce575fafea000e1b394df0207f3f9e

SHA1
34c3a4133c31c164070d7643feea66f0b4a1780e

SHA256
2dc6660146a23bcad85a17201718c661d456f68223e18ebbb000677ff22a3abe

SHA512
727869ffcefd37a4d58fa29b64e9f9bbc1e5c1395bd716f2095876092b8e05560d214447dba03c04c0569d80024664fe872afd302a75b990493818a68aef5d36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e288197de80d372aaf81127f5cbfa3fc

SHA1
579aeb2802dcda03a32d97b5d4c504a6ad61bcde

SHA256
983271feccf5dd2b60bfe969d8888b4516de87d9ea0f34ce2e82720715a9d676

SHA512
a7f75cb1eb84ed484eb5e69eb63da74244d7678db86d43fd7553162845c50064a0f9e5b7304916c82b59f13ab466349c2064bc3bd4db3a5cdf5c6792686423d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
090a986ed09dd38f8ba8dcfde83c0996

SHA1
94d8a9fd4838ca2c38c5d912fffae6df08b1a425

SHA256
02676ab387c789e6ee99cfeee84ea8d3a953594f4567484b15f83cad1d78fe73

SHA512
f947fb8f0cfb5c5ed24b63fb5726a9b2d1e834ec8f77d6d0f5f266686b05b149d9c95959ce4c72d43ad38fbd9b6a815191c2796b935e9642f336819a261a3aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef4c6e1dc1ff97bde51b3431e821a5d

SHA1
ff0cabe4edeb39e44f66f44c3552b30b11814430

SHA256
939bc4cae4db793d3b241ba7efa4ddbd3725e5b8c68018de896fc26b290a9505

SHA512
6f2f43c5119274f284f99be89e064a736a3070e3ad6b82bf932f1f10bda1f0418f2e5a113eda6264af38b5585de5a647bc62488550c6d40b24f3fadb06d613c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92daffe59e293b813c5a90a843a24999

SHA1
eccf07a44bcb4fe79a2071733f38ab89853f381c

SHA256
be740c3b4f523acd49819dad8f7e3729b797ea74f80f1e71ea35dfd7feade45b

SHA512
4204c70e25ceda84e10cadb773d474a120eccec55c92052427de1e188b806a07e2176b5de4b22189b6e7be411cdfdb8ddaf0ec8371f968caa95319589935b96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e011bfaa94ba3293f063461e7e0785b9

SHA1
89a7157b523d17d171aeca680724d72b4ef3d251

SHA256
fe4b045a3695a0dd4653e9cc345dab50da3293cd800f44b2c8be203c25963023

SHA512
7d7b0e3e44e59a010007fd16ad960e23bb42aa903f86237603567c5c0abb1f768092ca2f5d20e6cbefc53f709bc13cb05b7dd4304910391ac90ce083b63b1144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c42f3b8e01f947430d6b342613d31982

SHA1
eedd948a699ba168ab382f0aff7697d5b325c0d5

SHA256
8dfc0b9552cc337a4907bbb3d7de68eba8be66f62a7f0d04b26977315ac23ee2

SHA512
a4af74cdb3118c8ed7bb80852fbd90f1e9e0199e3f03afa40a75b0054c50d049a4abb542ecae4e368806ce608ad8dcab55683d48edf0b45e4825d42baaee49f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41d4b398242af74fc6b950467ba1a02b

SHA1
7077bb5c55adc334a77d6625ad9930f8d0a449ad

SHA256
5c64f478f6798c5a0b0cb2763c9a627846e7e8c58672abd7d81b21c8f7b584d1

SHA512
fe385e74946bcfbdaf8dddaa9806a142981ab6aca741d22d6c8b4c7ea31e30f86540d48bbf259f4c34b286098d681ad01adae5f10f3dc28ec2b0cfd0990a0b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1238deef420ca51dbfde5e2d51179c94

SHA1
0e20c8bc5d39fc344f3b2b36b6fe0c44d328fb44

SHA256
4e6a9bafe609b32163a192c7c0876ec1e082d43a5d767966366bb4d28d979e8e

SHA512
f937df3ffe69f5689459982176160f9306605843cf925ccbe9dc35fd56e9620a9b1f5878fddfb1ac5d70e5b2a1a643945d761a6b1812e8c0d9510711430e0cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FC0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4040.tmp

Filesize
55KB

MD5
1731c32c9ce63bd8f831e648cf101152

SHA1
ab31643658dce8c684c3d7d1c2fee8298a552552

SHA256
635642dd45a76500dc447fa26d80d8ffc7ba8d8ab60efcdcad0ecc58da4f5ec8

SHA512
0841493bb556f02de3c7e63ba663451e307b3639915af4777959093fc7441b01f9688abc524885cf23896ea8fe778b461040795c9d1946860015f687c24889c7

Download Submit