hxxps://192[.]168[.]0[.]1/

Analysis

max time kernel
118s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://192.168.0.1/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005758b85d6f05011f0d8926c7e53d575040fd09d59c2bed3f2119a9c15dce237c000000000e8000000002000020000000a3cffcd6056de120d3d87f7bcae1770a0d8863cbc12db07b85231e5e49153fc6900000007b65acfef053ebeb4580488791d3aa484c6061de5be8ecae10843f50ecad131788f0111923de32bf0b1fde1b52771517998c026f7a8ea0f0ee5432268e807a914f9877341dd061fb9f8ac70a3eb8ffcb50b544b9aa7b6dedd3d2270b826cc2d25c7b301dd1782ee7f47526966753ff9e7dc4c1eac8ae03931798ccf389a2337b8f8572ead065b4742949922065992c044000000061658c67413f75595da5131f0fe0509f547864b3d530aa7e8cda379f1570a5945e56ab6f0e27a2c659d069d9459a7701dcd14560f45e76c1b847a262a40011f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000254f6bc045c873f027eaae792cfa692c4e2005e3370250a04bae7d9553138954000000000e8000000002000020000000e96c99242fa0a8f68910bae0afb0f1569b094da7216baa8821d54d828ec6b1092000000086dcbcdf83f7e5859e0f137f52132d2a289b6ad671a91bb82020e982fdeb1cd440000000dd87d13cb87dec66d64d844222642b83f88758c99c46b76ff914298bb939d967497c22b5d7d15c534cfdbfd475626fd66f6768299a44a7e556d33d5a710ddc4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a085b7712343da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410984055"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{832BA141-AF16-11EE-9843-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://192.168.0.1/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2feadff65df8b3bea4968436b61841c7

SHA1
3b1c76e1d9afed0f0ba819103921e5fd0f8629f1

SHA256
974dad6ec52c97650f93715021f57f01a15014c7ebdac0b7fd707fb5757dcc6e

SHA512
59151147e766207a5eba10418ad0211f93d2765b92b73effd00db44b078d26a274521a04cd1816f6efc06f1db4b354e00530a11717335f2148a2b2128c5fb1de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d44ead7689ae824951935c0fc9bc1a

SHA1
54b888dc01bcbe6a593627b20fa6ced7df3ac0a1

SHA256
faceecf3aa51841fa2e847d9d63140e38f3c704bfc06d82b665ae292cfc2fd22

SHA512
e67c512f808b6568571fc277f36e5331461b53a893ca49683431625ba8efaeb4b1c568641f8099e67b2619ad8f30599fdbdc21857416bb8e41fcc760a37ffa1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f289a454d836b9b0001e4c09a72a7ef

SHA1
602f0a8548c210362ef5722ef9e2a5d27b53bcc7

SHA256
729217310257f3835953a7d3a8a461a9cda5e082d3ec619f6e1aadde51a30992

SHA512
6a69b86c81ecb1a084db53409814d3bc1ce14fa86fcab3298aa12fdc8206ab9a158477803ad80748f83874cd5c15c37421e336ad10468c75a3c0a82de332a369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68a5eafbc82ffc48849d0f10b77b195

SHA1
012d7639c286c0167413d536717f28bf495ac7a9

SHA256
6cb341fd3986c274b270a4bd2a39505e53c46db1bb490b7d772138f192907834

SHA512
c722a36e05dd3b87f1498db541b8640fcaa3c2797b685b05e18cf067b59b443155bdd25ef122aaf21776f8577700944efcbfdafbafbe2562f424fb9f8ffcf0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54c124b549af9d339e621a0d8eb50d8d

SHA1
d36125bdcf3b4212ba0de35aee6519e74df6d309

SHA256
b8efde00b7ef4dec402f11070b54330de9476be5082c2a5e8a184c14396f40c0

SHA512
f4dcab94de5049555b06bc362e1029cfba27dddc3649459221c29e68c76246d2ebf2b334fdefa3fa6c1a2f0c6953e31dd32efdb26b15fc913e743831eb5601a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c269092d9d983f5014028a73071570da

SHA1
ccbac93cfc91285fd1edaf52db85849736cbaf00

SHA256
ee91bbb3324a175f19b54af7b6b2a000dd95b8ad1558e78d4cb9a0fca9b0884a

SHA512
4d5c237b5f59e3ce22053c9e27c21405a1a8f946bec07abdf99e05944f168cacbe3a74117f8dca77267a44eec8f5d4029c75e85d4fc36561caff7894d1c7d379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ace86ae2209aea4e3349d7ccc1e4c20e

SHA1
fd715e6ef0304fdb4293be3be23c94a69148a350

SHA256
a8b9b8200d305fae45c6d3e19a4c4287d649ca578ecef1f4208643affdae4953

SHA512
94a91a2554422e78161ddb2a7b7a983e83dc2a2b12ce979ca510aff5001a267e7c5718d1de61e56a23d1cf00cba9eddb4bad85925ad155ad40742c367fc09bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d2937385f1bb58c6f7d5c83fc1f4f6

SHA1
2e8c87dd6787dc0f5842e4994a2e19ac59f7628f

SHA256
5030943801e5f7c86fff3817a66c956a6b033e8b1b4cdcf188ea5e16a9522b82

SHA512
e962d52103a4c0ff4e0862f616c31920c3cf9646912c40c1c932048abadbec8e0a7d63c627f60cbc5aaa08730f427329994ea9f1eb3dba4d521e6ab39f2a712c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab343B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar352A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit