hxxps://dev-banrural-gts[.]pantheonsite[.]io/1/

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dev-banrural-gts.pantheonsite.io/1/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001d95b4ff1b0a21145493abf2c9e4ec4538868e3c1695e083d02d6aa4361e6e66000000000e8000000002000020000000092becb7e9f4a5cb23e09990a57546fb8dff5e3f6d772c628470a920c45a50e2200000007154c87be372ea1a8976bf6a0767d0488db2052d2bfd73913928fee968c3edc040000000dd937562754e39c5b1733821cc5a111e2ddbc167e4c560baeecb9056d221f81c7a5b113ee990b26b25cf70aff8c5006ac320c9f989a90706eb07683a5bf1474f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e08a17a94dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000dd6ff83fa08b90d7fb46fc142859df94cf363e050b4e649c6f60d98b9be36a5d000000000e8000000002000020000000fb7213dfbb378d586b3399acff59be8654ffc7c621b902c2125265035d7a1e5e90000000420631bc85231ef8c4544b9b348d61fa10b846c14586fe5aacc381b136a9bea926ee3f9accbb6faef664f8691b0aeffce530c2a9a97811a93a6f00a2d73fd93ce0e6d0c60ee72288dbd7f6a557b2f992533f4d0fe62f03df8f2d3f94c88a358fef72982d0db9ffc967475407a3907bf574e71572cd3439abeb990ecbb3cdb8dac8848977efe314ecfb788a0d49f3699f400000002591d2a1d77e33828988243f29ff0958b7c5f21c1f2402f578d2aed0160fe4d4e5037b68dec87a436406e6eb74e4112a92fe2b7b7e3d8a7bc5eeddeaef650668	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42D81C01-B99C-11EE-AE81-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412140995"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2600	2444	iexplore.exe	28
PID 2444 wrote to memory of 2600	2444	iexplore.exe	28
PID 2444 wrote to memory of 2600	2444	iexplore.exe	28
PID 2444 wrote to memory of 2600	2444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://dev-banrural-gts.pantheonsite.io/1/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ff7fb30f4e2717374098dc0e4df84bb

SHA1
45456e7071e3ecc3b31266d55b0fb7b95e93f900

SHA256
b1b328ab99739aad8a6f31fbcf9b5b0b59dae3b0657583c62648f15e45c5ac28

SHA512
2652230ae3656de8de350ef64422237eba42ca27d5794b732359955b6688492f43b9308f0070aba8c8653ff60a395a4b8d8b9e4d5dc2c40805cfc4ff240fd8ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1276b005bf48379dd5ad40ec83337bf5

SHA1
700d798b177a1759a0b9584b61cac3a977207f80

SHA256
2873441c2ad37562c7e794e992a4a30e6afc79205fe932dd134b3063f3885e4c

SHA512
f16e8c257f27770e8fd7e2b83a9316e9ba1379f9ec711646ac4fa48d99438014ca290fc44fb6d56e66bfec6be50d170014b40c2b41cef9465055391e33c36b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f186de8280175048e7919b3fabfb5891

SHA1
58bb08ee565c934274ffcc3d6b011fc13e4a3215

SHA256
66f1063998ae4bb52daa134c30bedf8ef5019413c2dd42d97810fa4905e8082c

SHA512
dbf111516f40daf4edac2ac52ebd09ac2a1a5f456bde4f937fa4e6c161a6c2719be0a3b937c170e675b47a2d997140ea9c55a314cfcb028b342904c1a43ebfb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56acba6b7618b420981dcdf197fc0e7e

SHA1
d61131cebaaaa9b0359a28a45a0d24b5d88409f3

SHA256
6073fa4dd897b7695b5bc486f40bd3f3dc0093d9fc9a28401ba3273bdbb5159d

SHA512
a68697550a501b56715d2de5df5a49f0b03f2ca0317127f92eaf90a86785f71d0da5a45df05a9c4e67a745f3637ac8737c6171370acb414fd94e658aeed0234b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f33745033ab95d3ebdd1b2376ea62d65

SHA1
5e6b159c74f25a2e1db145385d558e87a516015b

SHA256
af56369d64abd315f9bc08e42dd5f71b63cf0622995fa70af9343d0c0398025b

SHA512
529b9ef9c1d634851f2dfa8759caaab083d51b3f1d4cfd43feddd6191ab24738b2febb92035228aba43940c5e1119e7d0ea7b5431835b5006b6cb605e87faf78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a62b25bbbc2fe36d9e561e959990ec7

SHA1
d271e8561456bfe321ae003a15c961330aa97a72

SHA256
0dd6953bc559ec78f4317bf36d52472e279ca8025830061d63ba33edb0c57e4b

SHA512
80a3c600d3273bd14c9424a6f42ef8f9cdc46ea15baaeabc610066ab91bf5839542ae38932d1b6c34a2d2e3c91c93868b183d6487955b7c60afe691128f6fe40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fefe34c520b43b7d0e805caefaec8b2c

SHA1
9f54149ef68bb53bae32ffbbc045c1bc109a0a46

SHA256
bd5d11828e9cad8ed8210df2abc1c62c4b5a93423b424b884870a6b66bab6122

SHA512
cec7303c2164d6d21315a2ef73dd66e63b0eab6d47ed7948e1f93d7b4527e2a3aeccf03e79f260aaae09afeacc3c82dbd84f6c804c1fec3cfa211205d9cf9e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a99a7d01dba2462b14167dcaf41fd99f

SHA1
b738d0ee41e01e2873d30f8877a937799a675aa1

SHA256
6a9eb7449acc3601ad51d801b78a3697f7c5432813a0de1f2097427ae30eecbb

SHA512
7240cb36137e104d8e1d74a9029b1e613c307cf25fffbf9984b18f3d40b4a3366a77b8bdcffb9177a6c89d843967d9e2571ff182d7bd98395e2d171fc24cc210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f0c847bab853fe6117e0c2c3e062507

SHA1
3e32796910e1b40a7567f38132cd9b515b656ce9

SHA256
449da5000e8f5c0613eb223d3b1ceca5f8341ddb0cb6d1e7fbd403944a5cdb66

SHA512
f86439cf139f1d4ca875170d7c9674409b56a9ca8b78584bdb3e6febc2221eab065509a6f6d881369d183c5a00e863ca5dc0d4eefadcf0e33d176d2a26eb70ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f064af867246a4b017103eca0c3bd82

SHA1
2ba33b1d065241dcc72cc25877fc27dafaacf123

SHA256
e359be0d4111860ef3c063ea9c9d2979dd6ff2ea2e23e37141ef880334401dbe

SHA512
4476d010c4b6adf81b9c91d8ad8e87c093da6df564931216251cc6aadcf4d561d55d78848f855c2518934848fcee69db36884dff0ee86cde65c4e01481096f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bab818339ccff348844fa4c9bfff8c9

SHA1
602116ad4f60c43da9fb0ca9e814b6433626cd97

SHA256
b8acbb5789161e920f44f306c4d2b02eec98f5bc46ad9a139b819fa2e7d48f86

SHA512
d40fcbeab21ccc979883c0a2d9027e087d6dba0e28ee46b9752c900ed305ce72311d188b83dc6726451e4f702a1685652cfc7a4bd8d76d0a16b5a25b64e99f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4b458305c2497dbc465a0117fa97760

SHA1
2a3aa9835dfb7b4d6d7b063acb8dd354b1b78af9

SHA256
7fafe58ca4397aa922e45a2d9b4793f96474495cf244a9c24fd638452f20c832

SHA512
77db33898ed840155fa5e9f6a43f5d684edc5b0bcf68bab34b0fae57c57195746e8ff1513960e38097fff48865b48b081423d8c23b467203a1cabe81fe55c464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5750fbfb0f90f9058a8d9ad57e023fca

SHA1
17a82814f36a682a6813ab0e7dcb23758a069f77

SHA256
b98e1ab09ea1bf067fa74908c040b60b0a66ce334ccb9c9dbdece1c6aaeb0de5

SHA512
fd4976565f2874be5bd7eba045c2d82604f0b56b4a16f6633cbb665fee48cdb58f43ace900cf58add9db2366c54f2d9085878f2e2827cc113363c26b566e04e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93946cae7c3ed5db042966ef540d2958

SHA1
15a8eb9d3f49663adb6842a00a9320b17ff3d9f4

SHA256
946bc47c8101057a12f421b1e7150165db1933362312fbe5daac9189a26242cf

SHA512
01a340f3aa2ace31324fc7c6e02b577481891a68482cb25f5e71c7c9ce9d607dd14c17aa071cf9a8b938824771d884775bb486410df4637a08e575a54826cefe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
605214fa7b4e1df638ffb369e21df3f6

SHA1
70b95e7d8ca25aff6fd011d68002f7df1f9d6a02

SHA256
d914ef7fcbbca7825788dba547c0e3e7eec67660a25ea89bdc5f442ba19948d3

SHA512
33e1b69b5bf1a6d67f21a7780461802dea6e0d727ad5c262861425bac7bc52f13fc84d0e0f5dc96f2a78c16d4177024e8c740d861ebcf03a8ee3b2766c83739a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
510fc1200d173764d31215a24183308e

SHA1
eb8b729a2cc865a84deebb764477561fad4ec396

SHA256
a386ec7f4c6869294d06524b8d58fd4c962cb3a922f60d9a232eef9851df8084

SHA512
7142e694a86b25dc5a00f4faa629fb84517ab11872b15a15a7678b859a85c957a2876392713fe34e922bd5d659ec91bf90908ed12092f65327d5e5446dcd0aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a2568695a668f174ccecac990ac04b3

SHA1
83ab119151987fbd5e193ac2457c33e433186469

SHA256
898264740bf324b861af895add90d5f361834c58b123f7517327018798bfea49

SHA512
c67db301b6d28a56d677bc078a574267849dbf9763c2e63847a9ee2103eabd154b93d6bb90af4e48f22487a103999bf4438a58b6ad78c593519474487bd6fec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13ce793901f77fdda68f276b0784f7cc

SHA1
c183c9a62ab627d35ceae56292e24f6af405ead5

SHA256
bf85d473fc025f4222c046b86fcc4beee5c93176f09c19b24484979672b3f87e

SHA512
8a0bd57467dcf34f2a38cf0bf5e87a8dbaf84bc77ff593fc524dee40eebd34b6c568aab441ac8afb234f7f031eedfdf761c74a178a1168175b2b2cae22625fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A9B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B2C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit