hxxps://stearncomminuty[.]ru/tradeofer/new/?partmer=1121309284&tokem-qQqdoxL

Analysis

max time kernel
141s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://stearncomminuty.ru/tradeofer/new/?partmer=1121309284&tokem-qQqdoxL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f328912286453f9c167e16e1a1a3e1de56694d310374cb994916164b9bbe5103000000000e800000000200002000000054e186781659e9d67b45e2bbd52967ce9b473ed7822e8c1e8916b14ed7b9df0020000000618bd2d11bcf58c27092b2a32c3dbed911d849cc2cc0477e2f390473f097ec6b40000000d1c011c60ba66d6edc1ed3bad33ad8f9cccad7e6a997ac98add4217d8d7394fd4a240bdcec99c46c244a14fc3275c2fcad4de553b50a92802f9fbfbf5d853e50	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411444100"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007778f468d0e6b00cb2e0a0816610d77cbb47b89f2ffe2d6c7b41dbda8b983b68000000000e80000000020000200000000bc00de77ba5f4e8df784fed6ba52bda2ba3431714689f5f0a2b7bb12cebfed4900000009ada683ba65c65138add04b135d2a254f9dec6c858fd60bcadfacfda0828a27a28915df61c8ffb11a193cf70e55f6e6d189acbb3a9a4e01182ff04864f0f562cb8189d8253e6f01d3e03e519fe10dc08b8efb4e918ab33e4875338b1a608413ac16c5111a7ef6b0f1ffc5d98b23f1846e86e983a9154c1d9c01effc877276a78ea78f2b12bd9515a800bcceea890eb8240000000b80c04d0f973d46e493c1b6587d86896c8d598067cd3c09c05f5694ad37aa428b312f82d453790b64b6500c4477cbeeef441fa5f6ea621083901cbc8b96163b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20652c7e5247da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8D62D61-B345-11EE-9324-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2652	2496	iexplore.exe	28
PID 2496 wrote to memory of 2652	2496	iexplore.exe	28
PID 2496 wrote to memory of 2652	2496	iexplore.exe	28
PID 2496 wrote to memory of 2652	2496	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://stearncomminuty.ru/tradeofer/new/?partmer=1121309284&tokem-qQqdoxL
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec6931e273073d5c64a70683c7117fd1

SHA1
715c921bd7477cf4f789c4062406e65a3b9796d3

SHA256
e951aca3a31c0c79d007e605b2bd6fd12e01d48b1b0d0ef9203dc5e7c3d4a499

SHA512
a0ca5cd7183addf8e1045961d8b6689f05e3b118dccaf20e05fc1f3be85da491b38ef544ad229c5ee7727f7d9b76397b0deeedb46e8109ff746c94412822b031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aa0aa18bbda1bd49de16dd1df3a7b33

SHA1
a239410a3b444ff486cc084fa3cae092bc5d3445

SHA256
3f7322bbcef5979605223a96b5420eb9ac7e2856b1a1fb4525d6060f82105020

SHA512
289b3405970f18a6d66d527667ed3575ac89714f2bf0454d3136aca7652fc5606415c3ffb4cab80f9eaddec576d124a559b085d8b0ad1e2e17c0e51301b8d14b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f7fa64ab5f635150e42dcf6dbc91589

SHA1
dfeb24dac54630fc094a41f20886ca15ac052cb2

SHA256
5ad9e6310a6c391a745a0c57b58a947b87164da4732e2730e6a5cdfdb5b28f67

SHA512
a27c8dd05ea6baaacb3ebed86e5c0c99488f4d71673f6dc58b805d1ef809e6ab1d51194862744515a2d1735eb6566986535731f7502c0bf78115de8b5ebe9807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c67eb143262808c640ef75083b0a9831

SHA1
364b84de7940d777b414f195957fab4a4fa17086

SHA256
a88ba60b76b9721a345c41c67081ed8ce21a8404ae81eacc804862f7943ea1c5

SHA512
9f0ca66ad2d11f4fc10a8681deaae46b5278740dc01e4b5ecb17601ddad7c051070978cbf12f8890dccd22ba8fc2cf16fc3ddb30518e5fd573c0c7cd12995354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54611eaba82dcf576d5868dc191ab25a

SHA1
678d543283f9f147b49414a1239918766a2e3a4f

SHA256
cc666c0e81d939f9ebb7d18e2cbde1ffec8afbc81cb1a2889bbcbe7cc2c355e2

SHA512
a48798f6530ca6029c623a268ee8ecac8e9e19f7ef3626d2f83b499fb644a2af2779c663783f182129daeb1a8a29dc99ec712db7297c71178f3d502c9638567a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e30e6f8b9853bb8785f70152a2e698f

SHA1
241a0cd5b35ce5f0bb3a82546132a6d925c46c3a

SHA256
93a4bc9555ba2aecbb1aa22b5637b4772e5c848a85f9c8b1def337d6eabe6eb1

SHA512
23681e42e7ae9fbb8ca97f072de2d657873e6447432ccbf574b82718d84adf4a3fc3a000001d5646f0de08d66df22bd369b31d7578227585f82ecf9eaacb61a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b646d0cb7b896663d3650c808e5a0e85

SHA1
5c58cc260ba3611281a52c3c47246395d413317d

SHA256
d343231b3e0a65427f9e30f06315a8f9d0a408bf957cc5ccd0b5c9c83bd10434

SHA512
1a29a32c9936afc11f5137e3fdd0017c144097532956afaa5d0e3542b3ce5b5a0242c1140421d27d860496f5a8a517cbeac06cbbfb54a5c0c730c66901b96ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4260e9b903ab4576ac6712aae49f54bf

SHA1
d1104773832afc09f361130767b7f49546e1c403

SHA256
7a6e267e1b3789ecf14f6eb82dfbfb8a7d884b235f47ef431acbe4403a25b478

SHA512
768e52a98cc569a817732d03388a41e79d95ccdcfd892ca2653d088e2bf8ab3173400a434e236f2369c80da638dc30bcfc58aeeeda465aee1116d1168c0edbd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21334578349fb374803e934dfd22cf8f

SHA1
0257ee849026318795c40d2e6fa59aba2d9ae624

SHA256
8640afa47049fcf6479404a049d4ba052c94747ce639898a1d7da93eea89b77b

SHA512
3f9b84301a3287faa9e4fc5bab84f675801d46016db735e3bd19dd839914d677f24d0a99eb79ae08a0f7f459dd87b8e463075fe92c7d2e8bb1023e4d559ca19b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4fe00fbdd5804a02a8b0009aa0c149

SHA1
3b0675fdc46a2c37bf269c9b3393326e6a05d7bd

SHA256
e9d662a5012f3a50b0266c9685557bcb0f44dd8cf26d66a9fa80c8959b53ff89

SHA512
b168ece8591743467accf338852e697c3d507635f6d225e2444225a3733aeb22d3cd23a6e644a0054962054fa5b959c9f2923cdcb9f1a88937c1486bd850cfa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a728fd3cbfd0c5a382fd6fd8fc49a329

SHA1
e3e475ec1ba559b31a873bb82648cb7bd1abda27

SHA256
45ae8be39c87744dcd07bee8ce56e4efcd70dbebed6eb7ce6decbecb343cb7a6

SHA512
15eb6ea3dc83126e5280c074a05f4037e747b44d3d1d435e0cec4b16da8d225004ced86c7e2a16fb1771c3098510c1140b5bf22730244d296bc3ea72baf1a060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8417b82d98b127181f1a42c8c345c100

SHA1
1ee771026f9971f1978f963d4011d060907b4fb9

SHA256
27e8a36b76c0d81b41e1e4bd83be3f351d16c1006be812dbda713ae1734f2880

SHA512
f3bf2f9e70328d06cd9afdc5702bc9780c5e8a7858869887718de2c670434983c345ddd474d6a8848be21aaad29971c893b5e2dc60abcd47879b976ce8735012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c2df2b71fb01e73e7aeac241a0d16d

SHA1
4eb0dbae0a32ee13709e64b924a68877083e3671

SHA256
547dcfd903e0cfd59a15ddf6625af8b68bd0364fefd17ddf4457c6181835c666

SHA512
67eec9e3484bf2b87c85a94e29ef8247ba6d0e94f6b61bea7ecc49421002ae7e92770d11ed61adaef0fae7a9e49174cb6f52363fef7a75297e79dfa907b3dafb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8db52c0c25e69bcac21195c5f0f9418a

SHA1
1f623bbe703a48fe2c18694c0a267287493db7b1

SHA256
857ad56ebc797f3cd729ca9b55332e0600af22fb25e60cdd05c7902cbf550743

SHA512
a81074409d7186754bd4908c611885379ff5a6b773417aaf11bfac14121ac7f786a27c5c12be6d18b4120716030281f19c504d2ea36bc68f154134ce3af38355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96ec4cb0acaaa60e90beea0fcf5841c9

SHA1
247691f0d29ef3edbc888e4a1788d0368ad8cb1e

SHA256
532c1470f951d0d7cbeb43a0b9d8d783d908a0106df7d56f28e940150604c184

SHA512
903a26427963c22c6f7072977189acd421272bebb984dab2f93cfc56aae8288e222c4f0673183e8d2bff4c5e978e432eda3a8e679181047ae550a1b6727185b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17694b582b149e04f53466b7187836a7

SHA1
ea732d422d5f8554375f28ca9a6278b9038671fe

SHA256
ba9238d16ca7f6431021b8ecfd20dcfdae6830d969cd749bda0d1780713ca532

SHA512
1b4e8d2486a6ad5d372eb2b15a04b4872b7bfd993d6589e11fb602568d14660ab6d14077bee5a68e9ea08082ace0093abaa7817ab9527012008e771a7fd824f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cad2d8ca8808997dbe83bfa53303381

SHA1
0b3d88cd05c1c7092288d89eca077252b3fa67b8

SHA256
dcc6979a6358665679e3f42c60aaa9a6fc349cce8370d8a1162d32358f901238

SHA512
976a4de25e1f4d2262400ac796e65d0d15c79cf3a5a91ca34a241d29a0813fe14c0f2da5c72de0a3dda96f7270f81195670da947004e6704a980877095eb42ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
628a28fed0f9c3bf8fcc352efc550683

SHA1
34a4a4962f35ce4a9827dd766e2b24c4824a57dc

SHA256
0bb0e94f1a5770ca29795e8c28c63e4322941e8e78400b6b962b0cc2bb0cdda2

SHA512
0e7edde934679227fb8dd7c71170f007a530a122d9b97175c219b15730d6b4cda9e87f70c87e14aacfe43aae065917de06cd0fb8e4c15708fea2874a4abcabd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e750ddd790e19f3b5a40141490b382

SHA1
7467b679eb77836e0db863c858fd8e290e242313

SHA256
2204730b7441213695b945674d37de192864ceaeb50f11ce3ab294a04b3fb2d8

SHA512
ef6c7860a0c93484b1e262198e98ac5019a1a404a08fd0054ba11c9ded50aab5e682c936f70fb0de5973d0e70764bad05cbfeeadadb184b678998af3f3550efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63A6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6455.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit