hxxps://dev-gyt-cs0-cu-live-ru-t-y-biz[.]pantheonsite[.]io

Analysis

max time kernel
145s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dev-gyt-cs0-cu-live-ru-t-y-biz.pantheonsite.io

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000064448f90cc91eda487145724c1098995dc26db462dfa324c9dd70c19ed190dc7000000000e8000000002000020000000e5938ab3f93b42d1a5017affcb44e97931244f29f1c6ce1809642f5a5b7d2fdf90000000895c9dc4b960af87c6795758ac23ffa051010b7511e1681e7a908c8cd1e79a1d77c15e6fea9c2a264a304fdbaa63f35e8d578f4140eec579b2814b2ccb49c2254973e063af33bf0412f45664a01f40b9cd928e70b6dd589f881b2a07f7b67c5954316e0a262e4cbd2875fbbe7f22c05323c337a667ca0110b6673051228af9bc2be72922a01c04dfad598f3abbf4ed204000000035501a0b4a7f16a4616019ae37ba8c6bcfdd06466dcf785bbf934fca7855ce1a215ef8476c58e93b2d04eeea9fe373c5153944e80a0e03595a23f0a6223ef0fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BC4D161-AF37-11EE-A3E1-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000139b8463e69475dd12fcea11b7795c64ce6d2b890de9b8efdf961b5b683daa1b000000000e8000000002000020000000c670e46cb17e44909d05f45797d211606998caf044ef061fd9238df6ad6b18972000000032bd5d63ea1c39822c80ecae851bfe8a18e375d90014ba7ae47ee31da09b33404000000086f09b60377428b6a8ceb7975c119286fc0a5b6aa8c0b831a19577eca11163048fccc64bf3df627f28014bbbecb99aabc36862c23007fc5b34fbdfb5e395e01f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410998130"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05690234443da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1068	iexplore.exe
1068	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2884	1068	iexplore.exe	28
PID 1068 wrote to memory of 2884	1068	iexplore.exe	28
PID 1068 wrote to memory of 2884	1068	iexplore.exe	28
PID 1068 wrote to memory of 2884	1068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://dev-gyt-cs0-cu-live-ru-t-y-biz.pantheonsite.io
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc8a81de0b51cc78b5f443df2080f24

SHA1
587420fd4be71147b0c370d785fa1a140dfb3c95

SHA256
f57de4da5152454d5aa22f04e4fb58aee49adf67ef67d088bbf6b4dc541f937b

SHA512
52265b2b83d1c74006adfd6405aa0704ee94bae5b62a38bd1576a2f7c917dac05f946205d1c9575317cdec4a83dcb067a75be79b59a2526113a8329e8f4b066e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db5ea78e6e479be6ccfe7c50791b1b9

SHA1
35bb89f53523e70a6c22e66d536621c57a57235d

SHA256
112c7f9f0f8609b67e012746bebf2892238c4e22344d3a61d1d6bc50e14441d7

SHA512
81d11529407bb4a3ccbfd654f7ac8b209db830bd106ddda86e74c9bd3f67a872ede1c5a78a469538e0f04e228566139dbf9931e92cc030a24e2661f2d8b399c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e508a29645dd8d6f0c1ee50271cc75

SHA1
a0cbd2917d138f7a3c9704ed75edd201151011e0

SHA256
2096561b10597a9005f7f4ec6bbd11c73bd5d3cd5709d18a71299517c7fa217d

SHA512
89b24eaa6502b1f4c707ccb1148b17de440fe41ea09f2fe720e7ad6fded49493cd995878faceba9256b51aa9887f8542e1dc5822f50106af1c7a92d1ce9e7924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0992efab9f1b53102455e30c4065b2d

SHA1
fd5c50a7695a82b4757a87ca649a9e90ef5cf821

SHA256
9df3f08382d2f2a715bc0b8a5c09e511b8b05baaa071927f66736c59102cf628

SHA512
fe109c827dace1acb69de251d849c7f01f1053d35811c2566ca00721004f918f0b2ae0b2d1ad2ad915c5179516dd96d1afc098ed53ad686c507ba081194f19f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019e6656ffc140c36ddbaf363b70756e

SHA1
81554e68435080b3a139ad8e6c8116a65c437647

SHA256
af83f1fe2d51777b389ba91839723fb43df2b62e2854402e594e825fb286ed0c

SHA512
7bcd77dc729a5ef5cb5ed1b7f38839bd57f8d4c780959c3bef63764e6f4e8942a148b85f30de9e1dc6c04eacbfbc20fb6d73d35f0a445d43714233e895df09a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c93aab174cb5ec6bc83163d55254d87e

SHA1
1c4d44148ba1bff5c36b421b8ebffd2eb0bcb4c9

SHA256
b292267ded87369bfac717f3eb2ba268f8105e223e2c6ebe3f5a97a78b86b45f

SHA512
8de877855ec0296340837750d97ecea84e2acc09fbae4953c2d69a71250a1989370073f7583da34daed051a2a6c13fb382645858e791bd55e568978991e0ef13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d9177ced361aeaa5be2f2ef25d17a2

SHA1
46b443c78f0d4d55dbca054ee47d76dcabe6122b

SHA256
1740083d2ef2df7966a8d77664fe2bf770a171f798077cd05adb6ce5decf3433

SHA512
d08180fb66fa15bacdf60d6be5b2d727b0d7073c5540da6550b6703fc603817e7b04b5d46a57a6e627d1dbef7a8239f2022d4e6e133715b6a28fcbff5a26c506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37deaa7b0dc6b555d0643465a9b1d179

SHA1
16775e8211cc4482a4e3871ffb1b561276971e14

SHA256
1cbdc8d411ed291a42f92ca366d092e7c60fc2ccf9a17e4b345fa9b8a8787009

SHA512
3ee7fac6432b83860dd17edb545e1b4106511f50fa90294d05ae93b0f6973e873062df301b3e2a8006b0ebc34be08b8e42ae0c050e37fc308778edcc78f45ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A9D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9341.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit