hxxps://tria[.]ge/240204-byds2sgggm/behavioral2

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/240204-byds2sgggm/behavioral2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000010bb44c03a1a7ffdc538d8ae3f2b00167b5eab8a7a4c6f1d3d755ab80518e982000000000e80000000020000200000007168595a9c00a5941da451e46e34383bb03b5eee04e8f4cfbd523fa8d5697d8490000000de2b940a3ea20a71e204593ebe41edaef07aad75ea22460dc8469ea65194637b471e7bb58d4f8318ce8332b0407d79e2019578ddfe6a34031717929a2cb4eddf24556737ef25faa2d645bb7843b997380a0eb5da7b9cbba4361f5f4aee90d491ea1a10e5012277b2dc98ae4fc77464fdf52496eb400bc754f0045a1d284ea02b9155b0908cec22bc36b3aa8deced8ab9400000007ff54c1e08dda882a6c59c5de7c69ca4f5348d101ad4257669f12c70535046d580785af0ef0ebc2bb21c6f7994d702e40b3c045bdb849dca0bc3700a09e85f78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0710e7f0f57da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413174537"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007336d4d2455030f002db7b2bd19b6980fa72acdd31353ae7f34bbc5ab737a83c000000000e8000000002000020000000d730306c13cb09ac6339cff387b9e2e5e0e408f4ca770a77db1cc22fa32aca1d200000006b2199e3f74efbbc87435f1c733026c03d4429879ee28e7d99705b22d2a1e30740000000aae86a2f0386b7ca65d9540d530ad970ebea23aee099e857305557a97601a54b052d5fe2c809df49d849380a0e230a31eb005c80d9bb5afbd07a0bdeddb2bab9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9BEE921-C302-11EE-A0F6-CE253106968E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
848	iexplore.exe
848	iexplore.exe
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1468	848	iexplore.exe	28
PID 848 wrote to memory of 1468	848	iexplore.exe	28
PID 848 wrote to memory of 1468	848	iexplore.exe	28
PID 848 wrote to memory of 1468	848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://tria.ge/240204-byds2sgggm/behavioral2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06277ee27963480ab0e92631c5ec3736

SHA1
b7d36dcb216a8ceb91a3d78382308c108e54e258

SHA256
70f123d3f7f74bdddcb495acdace847fbfc2b1df5905a70dd1fb4bac7b9936f6

SHA512
04e509c3d86bc565c2717ae34f391d43917ccb255d2cd74ad6713ab8cb7ad9239cfb42f1712e4c6864ec62762b5c15d2e549d38693cfbf05d638770c890502c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58da9e6632c46b692464f8033d265354

SHA1
eca935e8ce1f8a1e4b45d5e4c03d83b107229284

SHA256
115743cde969b6c6173216f0a6f4c1ed9252b7e1ef17bfa377c8545bc01aa093

SHA512
228ea8f201f43db0d8d49f06712d4b1725d2fe5791fd831afeea928bbf2db32d245457b301f81bacc0b8f1e7cdf83307d6ca609f67281317c24be85ba6f56de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843278fd083a9372498973ccb381a3a8

SHA1
a7f86747dc7904c534b960793289c1e47eacf150

SHA256
b7b2120c64a5f58d2b8e24cefefbd907465ff54adf72f9a9ebe17f6917eeb091

SHA512
4566feed30f28aff6bc98d1deccb8fae862bd89d9930467c0a4f7d06f9244a911ba1705ee8c780a2bbc9e61bc6d8780588a2f1daba46f60dfc51b84dbf16356d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ded6b8207ae65cc8adb9747ef03ad8

SHA1
7a051cd00d5e8adeb772e5efb9f62d0b4d29041c

SHA256
7882dcd9fc9d21dad91eb07d5b4b3f4832bdc10d6f4a73288e6e29511dc1e05b

SHA512
8a54cb53486fadd5430b2f404636cafa1f78c3aa0a42857589fccdd3b49e63910794e353f7c9b04bd983936372401b318e99c36311cc974c956e1b6d04b3c66f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32c77bf2e4c95e9cf08d8e4c15959918

SHA1
a479fcc80821d6c270a10d2618e1d2d4eb04091c

SHA256
4665893f0fec99cd763f4bec37f87af1eb6f095359c8856188166921602baf63

SHA512
2d7167c70366c3dc070a6330225cdb235c8c914290e796ede883e2da14427d946c90871bef76f15ba0ecff55119f071673ad4f79b96970260b154f4664725bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc25c95e5b1e11a8072f3edfa338de3

SHA1
6b43b2871be5ba1e1ba604845312d4f1af7e5dcc

SHA256
b10d556ac4539f8f6336bd95c879eafe2d357bd50a0d0e026d79df43697c7b5c

SHA512
9a4ba4d2281db3ea58f25ea1ba785892b5e30e8e9a1e8894d49a440ff1f41569b5089ed594823f46c37f565a355172af623d41f3e6cb261cc6177a0abe427186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0dd492f5c6a82fd6bd4dee4a8b1eb09

SHA1
5c3eac8529657c25166dfd20eec6d664b9f0c994

SHA256
4d3598b0e0f14b94eddab8929a1fc6ad5cb3cc8fa9640483361845109f386872

SHA512
25c7a0ee8e21111dbf7931265fe8a14e60d84731e019389f3b167a8239969bdc29352e3b95f80406ddc01c049bf38e2e02bcd2774f084e6e9ad2cb102f582f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ebfcc226c6a026b4869ec061d1d6c87

SHA1
cda759974b6901bee0d18de3d77b249f3988d52b

SHA256
ed68f588241b8aad44c4af8e3d449c9f07d6f0357d7911131c64d3d06696c65c

SHA512
2a33ec8beaeac33615e809f70a1d489000c4939fd7105ad3e3655ecb46d4513a7e51e6a920db371ce6a083cd1d2d99648eebe294bf4d960e487d953411ba6b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119dc13f026ecdb23fe3afa441ef1cf3

SHA1
0dd5f1872b666869dec333a6ca09fd492c47d65a

SHA256
6b708631354d42c5f536b9891849bbb09be94b4d0504f02a00d4147a283ab51d

SHA512
804e97ef7fe452de84bef69796e3285342735d05dac23a0edb13a4bcf1081cb2e3e1bf501018c81a49d8f6a4b34c387dfd640102cc1cfdb55922944c750e06ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebe93a07e9c9860ed0c77a726d366a54

SHA1
9aab8297ec045bd62a11d3a43ed2f9337d967616

SHA256
32a5f7e81845889842e385b02c25b86b4d4c1f2512760694f0816fe13d6a2d44

SHA512
215c3971cc3730bb8ed5ab5b6fcd71320ecd1264724b0f2858dff628ddee90104c9387d0f16437d162c831a92dea90f8c4fc920551042159dedb176ba9d25e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56354c388a37113ec008ae49ca85d963

SHA1
8daaf8c20612ae13bec643ddc46f1dd9b53d3579

SHA256
9b5ca1543ebd607dd5c9093a948e0f74afb8979a0a40de6db027d0bea665046f

SHA512
ee682fb9536df96f97b67d4b4d19a63e2ca210dd7d2fa9eed74323257a7c288f4ba9f6e535cc908e147fea37fd983efa1ef49a008ccf9e8810940e3bf87c9313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
490250dc750b32cefa0e03df75b1547a

SHA1
f28d6723fa7295d2cbada8984ba6d96e2f0d4926

SHA256
d571619db18c369e96311e422ae19ec5475d720552a05b140bd5a372f1b67a33

SHA512
39bd9c50d082d5ec4f349676983639c24aeee74e88e9e3a6233d363ed509cb05c397aadf5af6fca5abc904e4ec30b7a534ffa9590667675b47c415b1cb9e3a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d47d050492842326943dc4364cd26307

SHA1
4cb792848426138d87f69113bb07180f16596e13

SHA256
b09a9e26e2b19b8a835024c601d8d6da95432febb3d5a6f9f950d7cee0f1eda6

SHA512
3861c4b99b86f06dd3cde1e0da71db8948f82d6faaea5407d47d7c1b7d2e79f82d0302f6633e53676e657db5385e2a96351f9f73821d936543329e9e6f765a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef41b388075bf8ee9f09711a5cda065c

SHA1
a27db59b21256d56e441c6155168a0d1b9ee6347

SHA256
fa9c0d8287078e884b67fef73945de084b0646568967efa4a8a80447b4b29dfc

SHA512
2acb7002e6bd5bcefa45cd8c2e58d97257ecb8ff5ec97005a8f4cff7054e0afc201153eb5dfa2567e855e72a5785fc80d9a0c16e6066d03a64bbf692beb04b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cabca331347102f4cde2733f0073f22

SHA1
7d07919f972e0d2e614fc242fe5ea302cfefc8c4

SHA256
bba8d4ea4550482a0aa11d7c695225e46214a8965a7f8a7c1552fbc380ed60a0

SHA512
892b50cf975e282c2b31a2009ff5a44480b27c9c54c9841eb44d6338ff7e90731f525951a436e7e123431d9bdba6a7f7444ebc7e9cee98b27b02b51773a0ce35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7411d385889bfe81acb1d18616b88b75

SHA1
f725b163d053aa407a73a26b2ca9b00d5bb83d4c

SHA256
de39bd7181ad754cd9844a9e9b111fdc801583dee928106bcbf2c3caa9d527e6

SHA512
92727d5639d191eaa3556ca23d34db45407549e79f6539d365f178e86246e9421b036b060ea199f630dfd25ff4576eb444c190f44ad8cec94337b9cd647f7cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4193ae5963ece4b19083e7f328f10c1a

SHA1
267dcbce217b07b62eca14846238c4c00d668de3

SHA256
f176bf249404555e0c1d0cabee4072d526bd4b91f19f6e8cd7389e1cf7cbe8af

SHA512
51f00a2f9ae488400317c3d569f4a4512a505f79f33f5ef4b04845789720421962295ae102541464a531c278167b54aeca09834dc79f96af4d343868bdab53da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91d918b19dfddb77ac88249bcd9bfc99

SHA1
3a82f1e74cceb2f167946da359127db8746fa626

SHA256
c7d25dbce0768c92f0c70d4c4b6f457e4b0da1a4c8eafd4477808a9b93d0cbf7

SHA512
6f1bbf6f70e89ccc4e4ca737bbe979b1000fdcca72c0cd3b5ddf8e77ded00ad2c92ee23ff05a3af096bcf3d2b7817509c70cc883a4790e2435666b90e062c73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
010d4bd65ae92619d9326c65f77097a5

SHA1
bdc664090d7ac8a509b28ce768c6af9e330a1282

SHA256
f58f02e7db5b58a58ca652869d0c27bfa16a5f5609e69ce925780dd152523e6e

SHA512
bfe61eb482d7981c35f1d70b7758da2ac2d3575c5ff29bf2d6e3f9c076dffd955a0f5b7f7707f16c5be53cff9a8c666326626c3fdcaa0838870af1fd562b5c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A91.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B12.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit