hxxps://www[.]hopp[.]bio/receivefeedbackoncomplaints

General

Target

https://www.hopp.bio/receivefeedbackoncomplaints

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1BCC441-AE63-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2744	2544	iexplore.exe	18
PID 2544 wrote to memory of 2744	2544	iexplore.exe	18
PID 2544 wrote to memory of 2744	2544	iexplore.exe	18
PID 2544 wrote to memory of 2744	2544	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.hopp.bio/receivefeedbackoncomplaints
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47e674d5257a23c356a8c092641ccae7

SHA1
7b8c0475177fd8150cace47f308ff3e2da09a18a

SHA256
e6e7c060d70e4f43fef8fdc7561fb79fd616c5b19344f5faa7e3a3f77679c28d

SHA512
b55ed0b31e0fcb0d69098d868fb13174104660101e25ccc69da9315009d0151cc2be3cf807280137c13ab79f5506a38d2c2ba94011a30866528ace98ead302c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4676556feffc927ea6427f9d01e1bd26

SHA1
5508f568025f247fbf3e8bc727f94ee2201a9a2b

SHA256
947bef964e29f680f65337cae841dfd6fd8b115314438f7d3c172acf0a362d5b

SHA512
6ba4dc5028fb56fd1f8f844e8a619db5928dc14359e18113a589d09d8b642177e0173f9f521bc3dc90e2e9b5da6f9600bca5dd0d9fd2eb630f63577afbd6e8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t83hqs9\imagestore.dat

Filesize
30KB

MD5
b5d2218d542b2bc1d7551bb55294f5a6

SHA1
38e20870154ad05940423884399da1dfd251c742

SHA256
625146cd5db43ae4ffd68ec4d66f473eddfc16398af6bcc11c0be851c8840709

SHA512
6a16be0519eb80fb87b8a4b4433df8725c4b879f20e89f14f8c978898ba53484081c3b1679019bd9d07cf7c2c66b3c59af1abb49e91096cc883bd91c06f2165c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\dea07e_a5109ea852c64f6f8d2c045a986eba64~mv2[1].ico

Filesize
7KB

MD5
f0be65c6b5ca417c8ea837e22c17f03d

SHA1
9b39d749c34eef2e5433d28751ab2d74ddedc135

SHA256
f3901581d1c02675c48826c1ed389d5a618c7dbbb7676aed7f5525319ffd5d59

SHA512
448ed5c51521293ca005158385b74c5e221d50d7dd0007fdf79a02742bbfceff7276bea78934bf35dbda96d26b8dca639c5f0685e65240c77ce77df93437363e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab757F.tmp

Filesize
17KB

MD5
c571e09962b9acab3def2a60a8c15a52

SHA1
3fec98b4d3548b2a1eeb59476889068a05b7b88b

SHA256
bbf2ea4b0752ab32210b33bfa6ee179ec48f905c6b7a7474ab651d6e2c973e91

SHA512
329dc1d8dc475a81e92982d9323638a94b33ec7a51e6eacb0ab46b311bf1c60981a6da88ebd4a20a025659de45f0bc5ff08e69b026fbd2c3563bbcc107f1c2e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar763E.tmp

Filesize
5KB

MD5
791fecfd6f6da7ecf25e97b51b1e5e96

SHA1
73d7c5e8767c7b76c11f338af62fc47facc9de88

SHA256
22bcf468df24c5b9bb516b322ead20024fa9b7179c23af85368b293285f1ae61

SHA512
32df97c8cfcd4610ed3c017d10615fd4b5f2b6a871527ffa68590208ff02d8750ae80987097ff60c947d1dbfdff9d524e22279fc7d7a9d565c5f6cbb5d848eaa

Download Submit

Analysis

Sharing