hxxps://go[.]dalton-education[.]com/e/837113/daltoneducation-/5vxd7q/1877599094/h/ytHbZUmmv99IAThqeKTBJJ9HZ-fXu7-WLctkJhVQcls

Analysis

max time kernel
32s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go.dalton-education.com/e/837113/daltoneducation-/5vxd7q/1877599094/h/ytHbZUmmv99IAThqeKTBJJ9HZ-fXu7-WLctkJhVQcls

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7CB6461-BB9B-11EE-812C-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000069ddab758533857a425051ffa1897fd84dc35589a49c658fe7c8991e1138442f000000000e80000000020000200000003572ee02d1f07c689bf517b1b957cbe752abcf3685f788266e5f80ac8b71353220000000b9905a4cced0252a8f0b2c10f7709d54f98a840ad0dbf5bad8e9ad0473295c5240000000484e22af6e8ad5cf9d633cf5828b632b36abce07176f845333c8e14b0daba1356f15b8bf2ded393a8fa3d119c4690cb6d6062be2ba3beda6abace41b3f882216	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000009e5ecabf511bc801be459a48090e2ee17c70f0d3f6d51bc61e13a483a0f37f3b000000000e8000000002000020000000158bc871f035c2ea6cc490af99fe1949ed73a25b83722feb0668ed8b8e27834690000000edc196bcfcb4c91a2b69a5694d8c2dfdb3541157f9d9cbed3ba96d3970b8b5f65aa62481af203c5cc4f6ca8a7970f601019d5f01470c08b2438b174578947482dd862c847ccafef77c761c416d705e46e029c9961324f09b485b8f125ad0186a320636692c9c36a04ac89de76d8f051a3bdb809836ad68b6a69d3b64917dfa59836308b3dc222700dc9d9444e820847940000000cc822b50f344af22723af2a3663486fcb17be1b804246c2f760ce8ab1410012742bfff3a2e9b48ab0db1275d4c3562207dbd2f08222fa6bc41b0f4a53ff3573c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20970dada84fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

860 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

860 iexplore.exe
860 iexplore.exe
2856 IEXPLORE.EXE
2856 IEXPLORE.EXE
2856 IEXPLORE.EXE
2856 IEXPLORE.EXE

pid	process
860	iexplore.exe

pid	process
860	iexplore.exe
860	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 860 wrote to memory of 2856	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 2856	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 2856	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 2856	860	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://go.dalton-education.com/e/837113/daltoneducation-/5vxd7q/1877599094/h/ytHbZUmmv99IAThqeKTBJJ9HZ-fXu7-WLctkJhVQcls
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0dff32472997e77ec5a202020b550a12

SHA1
6626c6c97f837bc5d8aaeec8a8f159222bb8276b

SHA256
82f8202bb9e7bb9129d65dae025c379d89bd244d78eb8350a0bf1ef0be720c73

SHA512
c0de2d43c63adf339276cbb388a931157c3ef5bd0cf4d91abba38264d0622815183350a3d4fcfaa042426de541667e350f323c6f01c30a8e06445f965f2a9974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b77c33252a38fe23ccfde5251b4a3447

SHA1
df41f5ef48100f2ae5f5140f1b8fa41232e706ab

SHA256
d86e0b846d31e4ca9d5c2653f22113b84b59f732251f1478709a453d4a77a5fe

SHA512
8dd45a70423b870e169252c6670781933b58d399dcde07d1bc82b2b54f14608e2383835eaea8d7598c5810f23734cc32bf7eaf795dbda1441ef47bbaa7ee8593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a0d7f584de2a0866a4e47a135c485fca

SHA1
33a171038c881adfd6b7626ca10a8baf6834c956

SHA256
a3773e62de448621a0515751d7de3e55848a8e9bd794f09cbc8d720c64f561d5

SHA512
dfc4f822502810cfbcf2528a22e90c4407e7eaf2ed621fd06062ef76282a05475366085f524a483c43a6631fabc7c3aeb87e1b7b247ba2c3ad7b1a423e4f420c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b5f143d464f33e3a76a3027040f1068a

SHA1
19e9ee0e3b482b51c8ec3d01be72708ca6caf85f

SHA256
502f556dbc75009b82ea6d8e43bd3069c6c036ff089ae3700fc2a8bc27a06fee

SHA512
9fd2da0cec12332ca822e8ef902fa7438be1b99054c14c1894f8c829cc434ae0ca9ce10537d5e39d88f6df06e5ecc55d0876aaab2ca5e1af4d7b36636dc6cc42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d0a4816d863ebf8441edae1a8062d4b8

SHA1
90091c4dbbc0ec2dd3e7069688dfd3c1ec795e1b

SHA256
b30e196fe3d49dff4583ab6fc04ba2ef3d0554480cdb0f75b653c17cd1f0bab3

SHA512
ef5a9d74f4d3a3aeea00359d1befd552a8a596f7f43e0cd40d71e5b19f0c0e06bc6b5b59643ca3898a683be79feadd4798b49f2484ab22a38224102293b01ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7fca1e2039f563f15b98ccbdae88296a

SHA1
b976a6b3957f58386ee8b5175016a3102d6d480f

SHA256
d0a9fe3e8ab8bd66afcd9f36c550f6c336fada1d87749946f73cabfebece1ae9

SHA512
347295b1c339808ca66e453a2fdbc3f635e6ec4cc09c0a03604522c2124ed1c626441d64488b1ab4dddab05edca2832c31b601e5fa8437101846df3358f0da44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
edc68901f768f237a10c5b9562d781db

SHA1
1859518bf4876c698c4d79456fa7d377c4be93b8

SHA256
91e47d92824f76fcb7cd6c75be027aa99538d178b73a8515ad7276e7778e11c4

SHA512
91bf2df52a1129ac97b24b166e1e27e5b4f1aea1bd3d0ec65ac91183b88c3c72d3eaf3c6a8311c977007f221624d5d4705e86e633320ea3924bce997f2ac726a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c25d4a391895926b3e013947a912002a

SHA1
e9e50c5ab0fb5fffb688d52f94562072bccb3fe1

SHA256
e313d69e3f5273d3f1a2440ec5baf5775afd3bef98de47cae9610a630b30a11e

SHA512
74756d67405a6517593acf2e8bb4b1e9d1db40c5ffa487f3e1fbe931b4cfa6cc2ac9caed7adef97eb89e2a9a3fcc90957bad03a49a4f28e6571eb86e7c120c82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f809d846852bf42f5b6a6198f472adf7

SHA1
27f1740b9dc21f0c29d86a75c54bb79fa45aeddf

SHA256
1b8e7a0afe82744b45b76e0481d6f3ca99f470c20df4d37f4e0a5ac96a328f8b

SHA512
8c357e5c173c5351b4bde571eaafa5f65b70e94d9474ea8695cfb78a5bfa11238521748190d71ec68f44dedd593b2139ad917725865adb66c589346786b82ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C26.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5CC6.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit