hxxp://141[.]8[.]195[.]124

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://141.8.195.124

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f1cfee9a9e5ab9c3e0373f533ad614da83122facc5e0b95e41f0bb73ebd0525a000000000e800000000200002000000055fb99929aa14fdfaadeda6051342b26fe260313371e18a421263f0aa822cce320000000a69f436d0675067a75a36ef5b1d73f57b94cb374effdef01144cb5eb670da18940000000e8acf113b326991a660218194471a3681a03952260f3e41bfe499abd81176b0873a95ced057e6c6ea136ea544f6a59e48d8231104ec0c6c1885a9ee079a3ab11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35F5B0D1-B08F-11EE-80FA-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108d3b0b9c44da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411145832"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001f1c97b00ba2e4a1c7c7859f95a0bad3e319bc8b464d03d31cb82e59f6e642a2000000000e80000000020000200000006a2aa2c19e53dd577e2f2a4ddd476d17b1bc95069e14509e7bb4178c3bc61e02900000007965724897d069c01e2fe5a7f40dd74a9e15781c8034b175372e9ccc4de7f46db846238d16f27632573ba56bbb338e76a977d090c11612b05cc31beccdfc56a8df8504d96bc33b347cfe5494406862d261d867b8fc089b51f68d1140422d7962583892cc72cb9a7d50eda35d5c30c513ae41b04a5c7b34d2c87fe68784bbf968c17b0e48363d1c5ef4eab5f7e03df6594000000088542c68cee85b04b751c340869e132a3b2f21061f99f6c1efca9f44e8055e54b11ece9257938004d1ad889f3d3c149105bf80f5e0c2902d8bd23392fd416dae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
240	iexplore.exe
240	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 2656	240	iexplore.exe	28
PID 240 wrote to memory of 2656	240	iexplore.exe	28
PID 240 wrote to memory of 2656	240	iexplore.exe	28
PID 240 wrote to memory of 2656	240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://141.8.195.124
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99d79bc0aa77a3837788cf98caf23cf8

SHA1
c9dd72f86f7a9aa9dafe1bc6bdedfb12e70cbff1

SHA256
f0847fb66e5e5ebc289fb19e33bb8fc5bbf81d836be54ccb4e8ab7a99301428a

SHA512
8d6ecc72737820a7bc807b3a22cde9ed6e17b5852480ccb230d009e9a67718d05165e7d498407d62f99341daadfd131ded1c2597998f42cbfb06a542ad46c750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f00881aa49cd31756ecfa1cf2e93b974

SHA1
15bbc55bc414bacb85322c8bdee63d6e4c742c1e

SHA256
1e4a67c2da82e5f24c1bc5645d038fd9f708f6747c2731c5fc0fc91ec5950c5a

SHA512
26661fc26aea014468653a55620728960a855a6a2bd20a305a66b81a6d668c4d51e83b3a03444c58b737b0bc4fbe9c69c1bf2832a1c3c79d5902af66d2b72226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
624c176abf360d8d47da8f9e39a4e556

SHA1
fd94cf695e8893aba4f9966939c5f749275f8792

SHA256
397dee27b79421575c67de066005fe34441ab3a832a0fba1e95e88279b99b64c

SHA512
5f5fbea8399d0281047520a17b109de6dc8c34c666105452694f95338f3c5fffc09b622034654af256450de78f57c05631f5f59b6b5b7efe6216cc39e352e8bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e03509a0bbb75297e252826269b629b4

SHA1
becb6c152df8a62e6119e420b8028f60cd5c2072

SHA256
380b0089c548fb47b0399179acf382c7bfc13bf9d6c460a85536efee53803549

SHA512
08d1d7c05ab8a651e983b0941f5545e7909073037a3558b7bd96ec39aafcb42ff57d757307fa26b6a5f59d24d6f4c8b7db5c2e7fa34006f10a75736657367d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c8b5fea4a9d09ba5c2fc5ed96e59bad

SHA1
e579716c5f4c70f625c37d17b377bf255f2039c3

SHA256
e0ccbd940c070b6a59989710989d1197bdcfe338b0781e7d5cf62b66f2d9fb28

SHA512
1e30ced195ce06988979c95b12dcca1e5df1de7229876ff28ad09cb1a559e87cc24378ea9bb4465a9ea3bf6bc6fd70a44c4e9bc75e39325d8987848eeedb76b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec33d30e5556b83a8b48ecdd7a5f0c7

SHA1
f750c74a23cdf2caa5cdc152e12b1628d9744c2c

SHA256
31bac81942dc7f2e1d7fd61119882bfab775cb88c0de7bf560cf31b8e764abf9

SHA512
82c3f8602d2b7f9b33ef0e53fd28aabbd3aee5d0e8c155ddbb8bbcdf3701273e5d1097dcbe1a4c8ccb3149563e7174fabeb95a50f32e37bb2db7a779acf53036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5119fdf485d780527a2fbeb761a89c9

SHA1
d558a2f6eb6ede0354078b759cb0746d14424316

SHA256
5daf28661744dc4429333e0611d6f6de326d14f2a789e03e547bb655b5ae3d14

SHA512
f252bc6c016b623a0624eb25fe5c184cd02fa0ab6aef3be00d26ff21b5dd57749dfcca1a0d067ccc19f102ce69e1bd37b9fa36222ea1778be159f790980d7c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4f314519dd02ccc11ec91806eebd326

SHA1
8bcf2a7b5598cd13975ec856490fcdc2d16fc8a8

SHA256
d9bdcd4a82ea5d5d84e0aefb8dd3418eaf31ba24e8430f92c29001bdc70fc174

SHA512
897639b526975bb919c5ecd2f7c14dcc5b5001f58f4fd230b88bfe8cca82bb28d9638bdb88c62b58dea00b87d0a8b430a680263371e72e14fd0858ed56c89ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ead7964273c6c594c921868313f25d

SHA1
519720c529c9283bb5b7a4fb2dd9a0693e491163

SHA256
2fe9bc97c6912234d0c060ea37e45aafd078f96bb9068ef3e778f04bb6d7a008

SHA512
e0359e06d8d448e0be1378ba7dbda83a7fb01a4b83fec3303b5b8501f84cc5314b0da8576cd84130b9e68c248ee811bc601c09f0a5fff7f6ea57f00d2ad628b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34dd3d6c0d92da41d56c685d40d5252e

SHA1
96ac80f112fd754fe16186324f9d40154292f6cc

SHA256
f08e2b56cfce0e368fa588cfdb89a7299a7312fc682fd5bda6bfc19212cd2a75

SHA512
6cb1a77f2550cf2846ef66a0dedfeddf085b8c665fc5d8d44f24ec56bd48d2b3a7adacfac0588fafe2b5cdbef5c098cca7372cc9f0886727a897506b3e418a43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5235256bac0944f7bd6b1377bba0870e

SHA1
71b65c7de7d79e5429235faf3ef2d5f333f2deed

SHA256
be84a546a5f0495a9e6f2df5e8161c81bc177c24e8973e01ce0e92608e84bc47

SHA512
b18baf129ad20bbde5abb71f28d3ba7a52b822048e28c7028674b1eabf4d679ec00cd62fb54b9e23d12e90abff221ea2e229bd189d52842313b32962414a8e31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06e7aed9b2dc5b9e3e13a2f26f9e9e63

SHA1
dc5fe8e66bc544eead0969392a011f3ea26b3aa2

SHA256
7ba55efb38f372cabdc9e83b268d4cff551cd7d80f67976516ad9d21c960403e

SHA512
a1162f783054cadb08b592152cb6801cc08cd0c1259812896c4a27034a07c1ebd09f26c42da81136d0acd648c5817536d46b402e534a0f0cb671a677d170c139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b650c96e5ee360dd54836d8863f69d

SHA1
e0f30fb96a1bb99d7aa7f5fdef644e4fba8b6ced

SHA256
042ad1c9ebf5574ca2bbfc4c9109a259e71a40736fe1adbbdd6c8c97b70bcbb8

SHA512
f19dbc06021724925f3e68cc11ea5e05042da8c1f84f9c64213e9e4a32183573196c517d5409c88612e997864eaf8b9667d09cd9c00681431ca61e4bec420a78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2c6f72255e8cc2b2935668c71449d35

SHA1
c1646fb6ebb2f351cef464ff2fcd6aefbb270169

SHA256
c9d85656403491371a715d3e65ef3cdfd02b089123d349168ef3b640f219f725

SHA512
432a1cfd190d909f5705ba357d2ca1365659f3d29683ec30df3eac9fb6b269e6b1be04782dbdf0df35d93fea88d315026faf882924b4d5dad4127ea262fa2d13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daccda9a745e0a1b085b2c6ca14e08a9

SHA1
460f7b2edd879a3c1d9e60a02556dadabb11fd15

SHA256
893f2bef2df582c2b2180862d7efd3f2ebf90f4d8ada0e07edeca12741cd97b8

SHA512
1c6d33a3cb8143f17ada0fb169aa3fa4159b2c53ed21a8a0646e7054f0fe6b396b1bc2f42677f4f6e1105d350329745d7f8d53747744beb14ce403710fed2c99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab651C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar659C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit