hxxps://interceramic-test[.]coupahost[.]com/requisition_headers/493

Analysis

max time kernel
70s
max time network
79s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://interceramic-test.coupahost.com/requisition_headers/493

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411779284"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1415B321-B652-11EE-9840-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004c50293f20064feaaa2107d3e0e02ed76f2e68454e7fe905b20dd8ca83396968000000000e80000000020000200000009d144948d4b42696b72dfb42fdbe114492f685996895719d79fa8c889baf46b2200000001723390ae21f0ef611506c07e05c75c9c4bd4962a6dfb4083d48eb1d80bd1ec240000000f5563cc7781609785a3c1df8f758b19050121a8e1daa7c06636a5d21599af2ab743a23cdd066fc33d320e4549777d72f4ad071bf7f79f7e27d185dfb13abc6a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000077a853fae23d44eb44dfc7360aa6998381d7f7fd294c59008d0c47e1eeaa93a6000000000e8000000002000020000000b54f690da7484e7b6dd9901f0b9f143c424f285a0190c115304378b1c8a8c9d990000000da5fb16eb2ee24be7374a4764091f2f8f6fc955be7e1825443daf262d2105c3c67c3e7f3481919018fb15cf3fba4823f2440b2f52420ec17fce9cde737cc46b436ca85317c0eaaf9150bf80fe306b6182a8eb256d833594cc7ae0df2badb198b1e4d992540342f0ef923919a9db6d9cd48076d6363c1d26b8370d5bddacc8a3d9a16de2a9790127b5a65fae068d3a7f54000000015f46a8ff53735808aee906531eea7121ffeb5a4e7667edd810ae218ff7caefdb46bb64cb9dd925ba9bd3ff1428b317b711e5b18f0eb25a4308c10c2676f0423	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901e0aef5e4ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2664	2720	iexplore.exe	28
PID 2720 wrote to memory of 2664	2720	iexplore.exe	28
PID 2720 wrote to memory of 2664	2720	iexplore.exe	28
PID 2720 wrote to memory of 2664	2720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://interceramic-test.coupahost.com/requisition_headers/493
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28847b95e31a86bcc4c908a7106f8aa1

SHA1
b1394cc99b7138e56a4191d074a1badde296b90f

SHA256
6e5473376a2832be6175efe839f6868d36e3428a87c0e25d7bd91eed83fc8215

SHA512
5ee0d67f09f61b9b616d8110fd5630b59b85e4691963ed0371c189508a2d3efb3f284522d7d594411bc51d09b6e705a5fc02b407a8e40ceab1c70d6322b4cfff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2de39cd1e7253c045132431f0045f75b

SHA1
c8de1ec574f4e1d4d356368e419bc9c10bcd9e3b

SHA256
88e3673fbc134352de748c9d07757ee11673bcc4ac490c6663da22ffca11ec3b

SHA512
efb735dccca57dcc03726af516df601cdc2752c2058cbdff436535980f6fbcd56353ec93816a936c0c3edbfa2906adc6e4dcc55040ceab6e6b7713a7f2ecb572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a335ec3be92d1eb53f0a4936b107892

SHA1
506461572e0208a5847404e35e785a4a5e707bcb

SHA256
54791da3cb4090f9d9f0f654c9d4d70b97153701fdd3457c45cb0e888874dbf8

SHA512
9c2d4fe9ae5651c6c3a5b92b408da551a405100e27c72283361f6401260c5e8b9e42d14c5eec527d2487973e023926b368e04b2cca454123dbae5b86345fec06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1f443860e103d8d60f6f73c75faa6b6

SHA1
aef2cbbe3ebcd80b0125a6d7d4600bdfb98c2789

SHA256
a52934e20f18fd2bc9fb0b43d09f5a434444fc5294703280c228e395b77041ee

SHA512
a9652fbf748903361423b59ad8d11921e6924a817933aab4225619056fa44f0d5f58f2cb1450371acf6673b612ee08121c42963b5f19507056ca550fdcf37f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad9dfcff1fc7d8549fd7db94e34c348a

SHA1
892aefaed3986376e8c6cd36130d7e0690222fd1

SHA256
8dea83a829e52c1b58c391188fdc60e8773a687bfb5814f11f82137d3070fcf3

SHA512
72c6d1e4015759cc9287771bcb134ca6cc1f8a968de7c2cddff1ba800df4a1e10a359257cab6dbf69b9ac3f1dcdda5b8792c6b2b1bb44419804160b84181d8f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea8a5226c231c8aaf000344150350a82

SHA1
a71d29ed879769de83543a4b03ecb91a1fb83bad

SHA256
4648896a7047959c2cf33b038fe3edb9a9c75f728655f2c5d46a34f430a7b0c5

SHA512
839e9a6a01341757102659669483a476335fb53d08499c840ccba8a97e29264cfe6a98568fb9cb736144d5190218884d7f293c635a1cf8942cf4f73f5dc54998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a07fb086e501b011dab67d86cded28c

SHA1
d570308bc54c4aea2a654d516ffe7b8b1d9700b5

SHA256
b1ab940faced39887199469611e10bc351a89ea5a01123d1f15583f47d549081

SHA512
044253860bba5dad5fb70890ca58587bbc81d814cf05f6428428a91dac758309882d94583fb51618e212530b9f49e311f1fb48a401a12f4828314aa36c5a2b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
370193323effa0e497e6d29959c005b7

SHA1
7e5e6ceab40224c9add5371f356bc7ea941af16e

SHA256
23682c54b17e35abe7ba3efb674011caca19748456b0f8544bdb06616cc11624

SHA512
a42a703facfa724c3d9539e1c042aad776ff2e7e70cd86e6679d06c881b88cd7e2df1172f5a4bc4ed2d46a679273c6fc9275d832feb8da392992e7265a65c906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92e33c32740d71cda982592f0ed815e9

SHA1
1af094c2d533d3bec1d186bd0b0e7f5936e2ae86

SHA256
d5d9c31987714a768e06746beab0eeedfce88a644b74df63d8a6b8435e46b837

SHA512
5fb311e1e64646398c8bf6cbd9989e5842e803e2585e0b553b10b95baadbaa57e1373af598763f4bc1e466c9a14be735a3d8aac1645672d0a3588993bbe43de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf18367fcc74bb06d857374fddeb6a7e

SHA1
68fc8bb8fe91b404e9b63c493dbae2f23d5c0f53

SHA256
ca24dcac2b0f171ffbae3993d62639bfede2493fe88f86c4d26023f0059f4f1c

SHA512
04a1092300d0f01fcd57360ae95ab56476a62ef91ace64781cd451d051d3b66f28e8041c63f5e599c172219a953659b00e350391143ac1a27c6d74e7fd9d727f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c839cce0b2a1f7475ac33eb3042dd048

SHA1
d608047f0939e7b16f27412c0046386b66d3b146

SHA256
ec4fee586fa260072e207cf812f747f76ea6397eeb31515cda50934dbefa7554

SHA512
db82181a3a4e99c6ac004e7401fe9832b717270c9967b621e53a49ed99f4c3e8326785b2c122c742ec97cc82b22ba5df04be95c41fd835b9a44c424879bf704e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6719ce74e265e54c306837238071ecb7

SHA1
4a1b207882bdc350bab9cfe7c79aca60768ce738

SHA256
b29aa59b12f2e6d0f044cc10644a2d756d026eb4aa31c4761788f32d60392ae9

SHA512
fce30ddcf64c40062a92c04b6e3b375abe22fcfe0dbf9b992337280584cff84dda1fd088e90c4551f3577875ff01f6ebd20b14274f1be49a4db4e50be53ae93b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
608a519d2ae96f462a4a6c6ad9a5ddde

SHA1
1b99d831e0872c56db553290b1e1624d81dafb11

SHA256
495b8b90af245953d63b43139ad9556ea1f1571c5e8c36148eda1904d1e93950

SHA512
26afa3eb0b0a36b20bc8db14eef308a0f3f21d7aa59f22ebf1621834f6cc7b09f5d96b889f4c29a29831850aec97d55c2ea2a0823b4b53ff94d9dfee0c458248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4c019d50cbbe1b951fb6009faa65798

SHA1
32b4b4d0eb318203f9b16f53b1a7ae6f4a673b29

SHA256
ebf3440aad7d8b7affb26bb042c4c6c3a1f9eba490c082c0cc563c70703ff03a

SHA512
014c1a4b921de253c10d66b5d77746cc596904ac818614ccb9667d07fd29be07777e22536baf354deb79f398572fdd1a541500f9a74035538e9203b1c3c8deeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e4dd54df7c07ca97c9c6e81ffac5791

SHA1
6ccbbfcb3c48b19cdb5342a5e3854c13c0a6d9a0

SHA256
5fae05d006a05abccb78000a621b108579ba01ff52301d97bc238abce48963ec

SHA512
c10b21172ade857dcc21aa65bbd1d2f60f5d4367243d9bc3de9e352caa1dc56893f2c4bbb7652e601ddad2eca403796b2e65e3a4a60d6456944081129a4a1e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05370400926fbc0f5ec191d2222cda4a

SHA1
8bb433107eec5ba7b3331c7dceeed21cab489575

SHA256
3fc720dfab1102df6fb868f10b342adb2852c2c194a5c29e431f77cc4bc31aec

SHA512
8afca9cc66f543a0462096d159d91e6c5149ccd0724afe42b3da0c7f65088cbd3f924642524ced1e90ae73746a47d574679d04caca7aa0dbd5bb98e5ddde076c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c395e2ad6fe29d1e6962c35e477b6d34

SHA1
b6dc980245d3b0159d62ffadbee5f595d7c60c70

SHA256
456bcbf2c6f72bbf73987215573e1cdf2cc661dd71e4edc91625dc585136979c

SHA512
a1aa961284e44b2fb0c5c6c080cfa4cae9a9e7efd95c25dd25247b0f6a24b70b9f8d22eb85f0fa04090fea1be779a19f3ff6a5290fbedb0b65b490d8ce4cc474

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab841E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8645.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit