hxxps://wvvwbanc0promericaonlinegt[.]axedemqx[.]sa[.]com/

Analysis

max time kernel
136s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wvvwbanc0promericaonlinegt.axedemqx.sa.com/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000042f2c765f600d698019aeb1460e666693520a6b7c711c7e4ae246cbf8a72c291000000000e800000000200002000000049d2adfafe6448b771571c7a2df92cd74f38f64efbcb6d119c18d6649a45cbef90000000ab25e79919995ed65983ae3020596ceaa07d44633ebe9f1d8f0d193d2f4ccd16282aaf5a64d28ed84b67e791ccc77ef33a44d87fb4de29f491ac24f72f5944258f546e28be7792e6ae85c2195eb756e3cc00f4bcd58d963e14a9c82c2d506ba2e530e263a903d695e7df6312f9b14fd1588c7a71e7bf9e58f26bc8fc9e0c11cf56e9a99a24f423bb135e9013196593f740000000777d12f434e6bd2e356f353763571c0c587608f00cfd3fe821c5577437a6b970cf3d970c51e96c915e3ff6153f6a91634862368ea11f74c6b26c3747bc72cccc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5017af14094fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000585105c236d15c86aaaad06072034fb6790a24c1ccbb7884bd4c2f9cf9039137000000000e80000000020000200000002c86660a5cdd2bafcd8541226b3d19e608f346599ffb80c2a33200d503ccd79e20000000208ee5c1b9bf82e5a7cd4b2ddde477c450a60d3524635f771e248d62d2597ca840000000e254aa5ba8a7a0ccf1d84f1aece0d9d8fd4f386fd019f8085d9da136428d3812e5e872b293b766169062a2d85ffdb1620369d7bef604771fad78ad9e6ad50f54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412292175"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FF5DB11-BAFC-11EE-B578-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2144	2312	iexplore.exe	28
PID 2312 wrote to memory of 2144	2312	iexplore.exe	28
PID 2312 wrote to memory of 2144	2312	iexplore.exe	28
PID 2312 wrote to memory of 2144	2312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://wvvwbanc0promericaonlinegt.axedemqx.sa.com/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee8b1a5ce5abbf2811c7572d2f92fe30

SHA1
01041bfd27a27ad09607a5496b5840d7fd235671

SHA256
daa5a273cae1298e20a5a59d17475f721965b52939859859f661181490317ef3

SHA512
28790ba0069e6e9eab56649708fd937db30ecb918ad54a3e06d39604eaa78ddbb3e28388e838a0e65428b7781940f8c784115ed0340b11821e7ff307c4b84a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b84785025421775281c78de0d38c9e

SHA1
580f4f22f48473ededf1a86ab24b227a78b1f73c

SHA256
d955f6d35eab9a7cedc5638916ced82d15632d4c9218a4feab20adbe9181f076

SHA512
56279a3c7f1c64881926601d75ea5abc18bb2d6cdc2cd8c59c9e7f8484f591a5b620aefdbe366ec07f0ba804f80e4675e07f527941986bd243c112618b6803a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5e133dc69ad3da531889fdbb0a0c625

SHA1
e0164100950b4ea6a8f73b967bd8bd978cfe74f4

SHA256
d985c787e2c5c14424f4c78dd4bc66237856e1a693746a887e295fd588a62757

SHA512
e5095ace3a334a8e071189c3a07b02dbb0e848be1c837e732bf275ddfc7b1de45079b33c0075d65569f7ae97c9079d5b73b1563cb91443de8ed07fda6e0631fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51e9528a387964033e73e6ab3a7fa41

SHA1
186892f6a6893cf6db5444983017974a6eb53a91

SHA256
c2a281c87798fb731758a7d4cdf77d9d7035d53b74e74a9d60704c1d575e4f3d

SHA512
e2ebb59e01a823fbf5e8b198a9b12f12b839512a1e7e1c5ba2d0f41eb12743800e3e4857a2da37dc7652fef7a456037aaeade0bb1df8907c7d89bdd189d8d9f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6adbac6b88f5b4f14f0642fb125f2607

SHA1
b50e4a1de164a87963eb4007a9e62017b4f87c9b

SHA256
4d27da15ef79f873e025e65595e809e32f006f4d6644842b4b07430c770df392

SHA512
ac71569ae139e67eef18b07127d841554d6214c7eb09d2736ba405277d25c1fdc6873a9c69f608dc2d8592662b75254a896a30e09b8000f4aa869cd9fe02a4cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f8f4fb6115f20dd7712f00935b67ac6

SHA1
f20bf75cc1ddf57760eabdee22724b5d72aa39e0

SHA256
57bd86b7f848fc4e42471d1f002601491dd75cd3ce801999ca1a541ddeac64a2

SHA512
fccd9c053995b48f27e50149a685d74d20a561258b330db4e399a08b369ff04bf86388ed41b7a5f21fa0ea80c5fa4a087a5df7d8ed96b59ea947a12db599d03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd8f892991df3ce7935b20971c98a992

SHA1
530860c50f777dddfa9485601bfad64973dd69f4

SHA256
e830b51485a8bd2e37724fd197609dd2d06d7a8d82f42475fe78c941f22de0d4

SHA512
dc79d1212ffb9795a81956e1e9111c4997de673b84c311049e85ff11af8e5780af0d381b462f6127c4ea80e8ab3f7fe9836bd645b289ef3130007bc9158504fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f989b6d688db5782c628600be16c7745

SHA1
cb65474298deef6e543aed86786e889f047c0c52

SHA256
b9143917ed081d0bb3ab03fc6b58f84d5822e72d8cecc3bd3c6a482ce84c4cc9

SHA512
340ff6e9ef9f1cd63b64bef79dec0b09a388d3a3e2db661de2ee86ec462a14db34a02048f27d22608fdd90574f4a8a94c493453b9084daa37a6f919255078c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe373f38179b47514432a3e61038a5b

SHA1
b7636c266140ea97b58a442151a3bf7a3621ed47

SHA256
fa0c97a44a0795d8210ac643f5ed212e20efc0e3f4d99991ff444282bc2a9836

SHA512
e5f7fd6e18a50e2656e412cef4b87aeebe0ed03015976b3d958bd8ec486b3cc8eef365a50991a2b070d8cafb8829e9b0c9e4e154a6ddeb6b12ec3d9c2423a081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d0d009d3f03aee113c87c654d06bc07

SHA1
d57746e04d918136afca9dccb87eeee27c525565

SHA256
ab59c2cc24ca752779927e8037f23d4a446740ebbf1bc1c7c1c76136071ec4b7

SHA512
5820f351c7e07873de75104f86f23d866d50513e0286d7a32db4f819626d6c819ea02cefd02b00729c85fbd4c3d7780a1732cc7b39e54895d580a5eb73bd02ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57f197231de81f6ff76983d1301102d2

SHA1
3e6725e92f9df3b4295c8633d7b73c3e3840fa0b

SHA256
6e57d148fc59a80e6cc5bbfb11783de4ff26694b1c83eb2cda4ccd7568fb399b

SHA512
c30bac9edb5de1c2a9cef4d7d97bc68f0245037ea50fbf315162cc5dc3878ae221862e915e2f16982a335b53b4ac206c6eb953d166ce184f794df76bb9cfd458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62FA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63C8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit