hxxps://jawaratataperkakas[.]com/wp-includes/rst/

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://jawaratataperkakas.com/wp-includes/rst/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411785366"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3031ca2c6d4ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EE68351-B660-11EE-832E-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000796813c0273e8705e5198aeed76bb641b0bb06e51dde4c601569a6ddbd90bbec000000000e80000000020000200000002caa0db6b52f0473656d6f56e7b2b498c69e2266170e5e39d22cfe491fcd595d200000008999003522b83068694c85debf167796ef1cd34cf8fd32e7b7b621c4ef53c892400000007eb95892e4aafea143cfe17b5853f90cfa523696a298b986b906ec28fd0e01a07ab2480a89e3fe038b00f4b9fc454b9ffe7237a2e69ee6e8dcf131215398643e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000007ba73b586d067232b742c1131bfca151729587699760063cf9950691cc225945000000000e8000000002000020000000ba9e58d889483c9722152357d2977cc409a1e544ee18d8fa21b7712f433781969000000012eba3eb35f765c4d017c4f7892a739ef5d85af0ec0c9b6e34391050a3d0b0a4153d5bc77fa7a58d25be027a04bb61138355325bb49e6f76d16a9a50f81b28aa6589150b70c40790a4d2a1908d96c936642540d0eed8290773d182511284bd3f875d311e9981725c7e759f4286483be40977915bb3e830fcc004a250a3dbdb28fa343d1e4954c360db86957d7dda02714000000058f2303f6b0976c3ab5ac361829bf30c22488e82b2be2001a09fc37cccde90df6be3d685732368085f8e90523c27f80dd14fcdd3604a393a84dad93104aeecaf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2704	2184	iexplore.exe	28
PID 2184 wrote to memory of 2704	2184	iexplore.exe	28
PID 2184 wrote to memory of 2704	2184	iexplore.exe	28
PID 2184 wrote to memory of 2704	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://jawaratataperkakas.com/wp-includes/rst/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af04e1c600ae8e3deb1c8a1dfde1272c

SHA1
2cdc8b9bac0921fa87e61e7d686785658f134c21

SHA256
b9c7de4a90fcccdfe89a630fbf828e49efe1905833d36d480039e7dac8a49b86

SHA512
41d0381583c5f7a5af46efacd8f45cfdc7942cc6916a1effe6bd7b077afe0951610ca7785022a40c4591312f7559ecb7b5fd0429fc67ccb708ad6eb621c08be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88add6fb8d9810c0d58c9ca7471ccfd8

SHA1
6f98c89df7691ce75f61c8d68f5087f5ac0bbcad

SHA256
4dc2e2ba2a087b9b54dbfb96cbb54b62fc07f2e3012e293dd6577712a1738c2b

SHA512
4f1c489b7409c543af7ee2ae3322e3989a967581043b5df416f982752cbbccfba17322cfd4cd736ca12affe610bd0fc61528757ec520ac1df78fc5477998c8e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a9d1c39665b766aae476d8ee22cf5a5

SHA1
3b09909dd151613fad76531c145e88228281df24

SHA256
56f104b8a1961b403ab2a422ad3e898ce476b2d039e1aa4ba4c85d87b564a05c

SHA512
32c451fa452fe07a4a7eb6fe01894465e2957d98156ab51e7a4c89ba33bc72ee3536d06542199077156ec6ebe2c1599f3eaa6b7c50ad9b67cfc9adc8f5b62683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e6c9cc263bc3b2b5cfd64b9eb3464cb

SHA1
1ee16bc3b38d2bd005252e90a6ade060c9a54a56

SHA256
3c0689a7c2845348ef4b1374953fa228a35010a335b687233dd584190c9f87a3

SHA512
724478723d610e953e77d63d0eb901fcabcc97c307b55419794e78774e35ba5bb3ffdedd3df001401b4b281956848677bf2d552b78137bb264835a0ac87d36db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2fee0468c742046a6219dd04cc3497d

SHA1
b2f0dde9d2da707cc5d894c980f9f4d0f3d9655a

SHA256
ea0e4333f139437026baf38f6295f704b447c74005b42fa474bd53198610bc62

SHA512
4213d5f1033dd77035ef24ee34cc6e4bb0cd68b853ded55ac8577bbf10f4de81ab8e58a6148b7c83a03d07568d97523a1339aed41189b763dacce63c29218310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f591dca486c76f53f7980de9f829f6ee

SHA1
a6d2f753f6859d8d53f4df7682be7d0f66b62d14

SHA256
fb4505a09b4e4f2311acaac7af9e88aba3d92d434e8e86749b64d128d7090805

SHA512
6c0812348411d150cd58d747d60f9fdfdf75be40e05c2c4a49404c300b233f3d07865b5e8e51d413da1ef8894081a35953e0d67a339f5c53a0bcf74e52193564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c83a9205646c15328df7a62a441b6c1

SHA1
55af090ea1369369de7483febad88298eeb8ba48

SHA256
e9714043f23d541d6c65fb358cf0d19ff2b67df6a7423b143c65ddd2c9d4985f

SHA512
ebca0473c798f00af7e5c51786ec78ac9d528dfd4f6d42504e5c0ea5f846e6b2e11b27d1fef9ea19f5a2e900dc447c4d7baf14e2653744090ae9ef473f84d9a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be640db81f4e954d0a0997adca015b47

SHA1
c07ed6b64b603d98cd8e754fbf3a6e442d90a4d5

SHA256
02b7c92e4ada87464fde491ea405ff49a838521b67533271ff3fd4c79bdb7ba1

SHA512
ad3e6d6a8f0985f463034c33cc1882f0e74e4b78b3b95caa9f4eed79680666ee6afb3b61acfb9d63e4760d886511a6b805bafb3833db518e9af7b2d72cee8da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c36a05d3eac095dfec9124d885c7228

SHA1
4081520ee4ecd9667185b740600e0604774fca33

SHA256
f3e95574ecbc648963d04f8716ebe2529b88f4de3c17c98a27c20eb701237e46

SHA512
3dc9f968cf7c85383e5f260e0fdb28f5186477fffbd9f59c468f35c9c9f34ca6aa1c7a2b64f924c62ff0de2139f04aeab2f182d226161519915ee173136f9f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c06a3677153460757a38424553818b3

SHA1
d6ee97a37c82a8ecee8509452d532a432dd46833

SHA256
a381ae4549948a2129c10bb715040a8add8df0b3303b8d6ea59d43ca81a06ad7

SHA512
a6e5a3051b028cfe1564271d963f521a6a21e1a80f77a1f7918114693630c2b7ecf9b0504d8c34a111591698dc08096b6556ec404dd23f610156043ddf2e3350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d53f7ab007402e813436a1bc01b60b2

SHA1
c6c564efff013dafc9e01316a440ae672e2cfaca

SHA256
d9f705e747638990a362017c2061e5d3f3a73490400bdf256cfe4daa1d8b0fff

SHA512
949edd2f9d40d2771ba098ebff31b0eb8f77a1d8fc0a5bccda93c322fa69d9d902047ea9fa11024696e03574193379b606dd92e1e17c7c09a71c5846b75e64ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2fa6eee93a58d5279d2675f41790c82

SHA1
e38ee438bd49c6365dc85b7abed37eb3c4826436

SHA256
2a025ca9b577bf3ad26a74ba3bc3f5708a4a833244475584baab594568adf374

SHA512
d93a664ec6a0e8b0f4cf5e9814d16b5424ed8dbdfdcca231843cdf30ea37723baace88b4f6dfab40cca8d660300f09cc162c95b3139872669c62565ec89787be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cdd24d96a41b181fd7a3b0be348941d

SHA1
9a1a8c163ac88a3fd8c77d45a225b1e6fd17778b

SHA256
0a14add4b2c79e111e29797af2bb08e1bfb40e05a3a27f25e2529a8656464759

SHA512
d66ddd50a4482a74e90b8f894bbb8395622dcd52fdb58f8db367d91096eb07eb612ff828e6d18cb52ae8a9e9830091a0538c7bd52c516c7776b540b256b277c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e563edf5649f61af4fed61b37781af

SHA1
f7521ea1608ad772766f8ffacc8a6136b703d068

SHA256
c5b91f3bda9d886ee175c2b9924be998aafb5bac2905272937952a0bafeb9e60

SHA512
3db4a239aa9d0f8d9cf1e7cc6b09d60f78efd00f21c1cc98d1a37b9482243ad867c958a9dfad929ffea0766ff029b7a22c98751d8e9c8b4990d4b88f850f9a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eedef8ca01a8fdd61a40756da17632d

SHA1
f2c54fc8ec7badf39969b0c4b6545c21e15284bc

SHA256
b3a93369e086f7c23b896f4cad64f027f7147d7cb3aeb786fbdb1e6f0c577fa3

SHA512
94ebe0784fc77e5435e83709f4d8dd94834b42e6e787be60e6f3edbc9b6e54c07c395ebf5936055e39d3649032c39bb5bfd2e4c12461d24f2508e7aeeae2da17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f091f38a8250f2f42b549f8d9eb8cbdc

SHA1
1e4bb6616817b423e920d21fcf70561a99208d64

SHA256
295a145ce96da56d97bc14c25a6ad1b4e025ad810b492b24ebabba5b020d3322

SHA512
f948d4682ea6dbb8f4e682ff81ad6d10682e0cbed4376da116d72cc8ca0dee33c43aac56896f66fa6fdfaadb8d0cac75b3492e4f712938c5413cb41e056b2dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b0185f0507d67d504f2506e265e6881

SHA1
d2dc6326f1a7d67dc1f75a283ae4653fe64f446b

SHA256
4816d71319324f0111f941d2d0e45095e2e0c5de0deecf33daa4a1a612099458

SHA512
00ae0ff5cd4a0022d4388536c9129f300e1d9af7cdc5c54951348f0e97a0aed87b975573b57cff28f23716f1f6ec9fb738d1eda8c00d4c378d7edd107af172c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA6D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit