hxxps://trustaged[.]trustaged[.]us/?Iqhus=8n1om

Analysis

max time kernel
39s
max time network
68s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://trustaged.trustaged.us/?Iqhus=8n1om

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007d3fae3911010f4800419c99ca2edfb822c538b7c7cdd512d565cca0a9845a86000000000e8000000002000020000000e5316ee4480fa6443c5c2794c127a4924b863dcd437eaef68484fc886e89a7122000000056f83ba932d75ba3f67beba4af3d74d64b9f14979b934c0d38d4bfd79608bc25400000009d8c5a75897fea3e22f28595a3c028b73abc16de6d1f811482bb17484e1e59bd567a37ce290ce2576ec15b403f564cb73b6496337f390ba16b6c9569ed574c78	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e933929132cb84a83ca3ceaa606c69a192258fdef531a04ad08316cc0f8d7420000000000e800000000200002000000008960a6ac9c32ee5672998720486cdc13f84979e6828fbaa61e487a5281a2e9250010000d024965cfedc202a7214d6d98c612667cfd78fbc7dcb9f57ba4bf4b181742a014290a8732b572dc5a9ec5a02fe389df2c5146b6cc821ca9f6fab449300de0d5f6217c47796c3fa1fd045bf803315e2bf5cbdcf6c4c843af6afd391ea7cf33d8181203f4afa8cd56d8f42b01c7f7955a04aa8cf0500aad4be8458fcd92d4d6de854ce7d108eb305b637d22b3e1d0c81da8a81073172d0e7890b87f8f3c76cc178e1afb11e736f46f2a9f9c0f2e1f9aa3702b7b271b8342d2a44f58011612c5e76b1eb51e82574c2d7933970652d59ee2b12100412abda2dbacc19a26098668ebface0aea813b5de2cdbb916a977b11c012ada4f776237c5a6def5556d3b1b05729859152e20d2635b9019184b89330699bbf97373617c201a28c7de0927f1c58482fa3f27f090f3bff314ae5745645e4992793766b68631cea72d1ffc2e6bb217f0eea529080310606471137dac47bc5240000000bb93dc1ed925c5510c567fa75c6d14c658e48da80d07eee78ce3150c685de59f23060454ec0a5dbcc1df228183b45f1d22bc107175f0289dd0a6abbd875ff8be	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B25EB1A1-AF43-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustaged.us	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7084a2805043da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009f00b065fbaed9e4b72905cc5416c6299e6f26d7bdbadacb0ef230483d0ad8b1000000000e8000000002000020000000298f795b9f0838a997c4efb324204e8369311b58ceaa1e2c7807a30b436a16ae50010000757e7980980da37d4aa6ba2de94de3a6ef0c8c9dda7b51acf0ad2644cec29ef9c0920d2baf93c7ba5401369da8e81d776866fe7d5006cab0433a35148a9cd784b12b9e268c0ba109f051a64735153d9b5595f80b57b99a379857d822ae765a4afe074f9512e3b8b6de0a4954e5844da897135e286f738392bacad26d741fe9799998e699f95a77c27839aa263e60e3b425da53dfc02da944c5136b2bcc20961d9e72ecfff5f13d4c41b6078e2fffd0313a34794418b1b58c9dd911d962ab8e45604ae718d2e211c812121f95441cb75034bb9a240fa05337060cc9e6c1e389a92f5d4db48ab0b255f74ee446b4cecc5d0dafe170e4711e1835c04937a0dc44a0349019551689e4239819a6343550f86a5d388c7bd52ed2de69ff96fca3ddaa9531b9f1681dfe37dc0f34d3e3c7835b9c5c0acf6a8406a54474f11bcbfda1cc378774fa350faaed8da3857896971cdf8640000000f95dab6c15bcfe04bbb57bdb0b2e68bb7f3a8a23260e406c8170d3a35b2f0c5cb1b390b36c07abbd4aef9b54d69ca17794c1d21ad4225a228b5c4cf4355a98fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustaged.us\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28
PID 2844 wrote to memory of 2284	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://trustaged.trustaged.us/?Iqhus=8n1om
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019c3b5685437e35d6bb6d5258bd38dc

SHA1
bfe0b297cd2807728e04843beabd9b88329743c2

SHA256
9f431ddaa87433e77d098d99f728d42d1e6b4040a6692c87bbec537adb23945a

SHA512
854636c2ca02b4d1edf1d3c5971be6e43e4e90146f780e2e8ef66361695e7504807d9432f27db2f7b929587418ec86e6fde2dd5ea576924eca1a28cec60624f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d14f881f554387031f88a95934bda0d

SHA1
e3106fdec2b9a30e22dc6a1541ddddcf4875ddb8

SHA256
35453d3f3d4262fb9cc7657616e764262c9d97d6ead993583cf7570a162cc0ef

SHA512
8ea53071a5105b4f0ba1070e80fd6c4290fa86895a6ea100d757990d6493da1bdf16d671c721591c31e814a7a652b078720586b71bf78b6f5ee483b2abfb1f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4994ca70a49a9030dff68b21f7f9aa40

SHA1
9da9ea96c66474139c29fa56a83f505e861533b2

SHA256
d3b5264409eb1d39d521a50f6954b2e7db5538b3ad8a03f92ad45b1d07da9fc3

SHA512
04a727f8b1da69c5224da5518b1daf8ae10d3c280bccbb3468f8395520d2bf5a9e9dd294f41d651c6813557e93143658dc2f2ccd3bf64e5c310094c624e7ed63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
113bdb74b78a2b62df57edc0e21fce02

SHA1
5383e0e4f57c63a00b8d5e3b0f9020a5d63d5f06

SHA256
75986f349675fc763276d88ca92ea8e39948f0eabe64b6ca53ac1a8226b06dd7

SHA512
1168b3bc8da21994e25b4792041045750a760ca88185e3b6493697f74231c3734427d59f78dae7fb374dcf0a6582c0c1d2164a2a9b5654d6a7579782a879b459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9af0b7c0ad969b0e2c44d0f27c8829c4

SHA1
8b8eb321e29b96a36099f1d5c7ce87dced154c06

SHA256
1a9edc3d9b75232be476501819ca24e8ae02240b960ac067668640868194fa36

SHA512
a61655df8f9aeb4a057ba59eb76fbab831ef3b6346f237b0637ebc4969098585b3d08f2a0293d201b04e65f72aa02130a3e6e6694d8d76ff58b62322b577a413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49c1f8fec34c41d191bb32c0ed6e0bc2

SHA1
f3bb392fed9279bae9d9c2ea7c0fadac403a1121

SHA256
a92541a83c553b09cb678b549217e53c7d2dbbe3097534d727c40cad136b5881

SHA512
733f2e9c08d190561384458e92912c75ac9129376cc5ec3ab3e211e29d01d92622af9f7d42d26121771a528a48d7d2e7723b16616c097e846d4940760555f3ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ad8dab9e5052dbcb54bf5baaf846a52

SHA1
44aaef20b92ce8ecdd974873253c09a4d332ab54

SHA256
ba0de4ff6c4838bc4c2f815e23824ae77df9c537eeedb9a7788ea7e0451c9bd5

SHA512
270d0298b138db1e25b17fa1413da3f8918f73cebfb7addefabe2ca6df05c15c0608458254e5052637dd93103ef0243466be45e95d41652e4628dadc3a1cd5bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b7e6e6f6e9ee5dcb06cfd3c7b207df6

SHA1
7cba4bd93108dd5b40793ec4b9be41bd4c6c935d

SHA256
bd6988e8d240caedd1abfbd5672cda8f45a2113be67f36c781d3d3455c3f2527

SHA512
89051a14dfe2089c270568846083f0768a723c6af006ea95905dd38137536e6d901dcaa61856b8c9d51ef4208fa2dcf7c54bc4f56c7b0b583b2ba4383adc20be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39f47e5e263e4b861716ffd10a5fda61

SHA1
8824098cb84b05ee131da50fe8eab2135801967d

SHA256
55ee65a212f8bcccf79763fcb9576c23f055301cecd1bdd001f2ee597e8dc8b8

SHA512
ff0b5f7632398baf95d833d162596e4c9d8f1fefa8d546ad6a26d11fcf5aafe78891fdfbf5aa46fc6fd1fbbe64b9c16a1a016c9f81a2c786ed8bbb0d5d219046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33d7aebf7c3050df3af8c8b10eb3039f

SHA1
c85dbef126c7cd8051c1b53df4327f9a352362e7

SHA256
18eb3001b4a67b67d6c0148e1723738242ac4f3991d4ac3afaafd94f84a9e972

SHA512
e034effe9e27273edbaaed6090d8bc8cc75ac24f40601f108888fd4740ce678564ad3a092ea0cd7693c53dd927d5b672f5fe0e5b656e1a7f5f8fb3aaa3c1f06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2s0hu3f\imagestore.dat

Filesize
3KB

MD5
3394b9a7e5c512cb82f1c71991e313af

SHA1
02b654b07ad2161e519dc231af105c164fafa8c6

SHA256
b50f6555d03d0d2bd81f1e558768ca2f0dce8dd32b27cc2ed425fb338eb66792

SHA512
bd71d69acd3c712aef4eabcd97ddaee7233c044ea877ce5fee8c2221dc23ece54f6374c56232201f11e8de6934a06e68d0bd851d5624d2264265e279d25e800b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico

Filesize
2KB

MD5
7e0d59593f3377b72c29435c4b43954a

SHA1
b4c5c39a6dfb460bbd2eacceb09ec8079fb6a8e2

SHA256
62d706019a0d80173113ef70fbbee12f286e8e221534be788448aada4b14c8e8

SHA512
397416a6a96a39f46f22e906a60e56067e5b7b11fb0597a733f862fc077c88d5ed31f51a82709a56f6082fb1f2f72f9a0fe0849e3dd493bb4240c265b546aad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F3B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4FE9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit