hxxp://141[.]11[.]109[.]151[:]8000/

Analysis

max time kernel
1560s
max time network
1560s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://141.11.109.151:8000/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E52F441-1868-11EF-B04F-52AF0AAB4D51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422564014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000093089f441ad2392cba37658a0743b4702c8026792dd82acb09ebc2317c59b0af000000000e8000000002000020000000ea5639997c2d9001ce41d13e6097eb0e9a9aa55644df2cbd4a6624879e5f802f90000000586945d7434d5ccfc5d8848fce117ca9d529096ec3cf4014a8c2e19b5779d3a7bf60493c81ef9e19728a6d2209f776739dbfd2a2c97856916a115b475aa3e4fb76decfa8ff410a06e9e64d387ea81756ca06119812c826c9bec58a93da664607f79fb1912ae3b8cd7107ca1f10667e5790467c15cc05eff8a42d1244f36283c6aa46ecba3934c34bd07ae7b657c98aac40000000121132719a52a7abb925c04b14a9b97621991a40c28311c5b896609870db7d1f33203bbf8458334d886b9ba252d3888e5c56d0e484f0742a6d8c885a68904d8e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000922807e55f0e63da06203f67ccf579741c552e01301208024fcfe8e453b9dee1000000000e800000000200002000000001d208e7f3cff367fe5450c4abb98e951298c632201be74b27b76b92b4442526200000006d7cd1b3fbb081a26cd8d64213c733e33f0d1648645a408256b6863aa90ba2334000000017be49c6bca6b016a13760ce0be731e26368994463b8e798be810605990ed8c5d573a493b2c76f30ea51006e935bf939ed11c3305360a72cefc1d154414fa861	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10890a2c75acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1852	iexplore.exe
1852	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3040	1852	iexplore.exe	28
PID 1852 wrote to memory of 3040	1852	iexplore.exe	28
PID 1852 wrote to memory of 3040	1852	iexplore.exe	28
PID 1852 wrote to memory of 3040	1852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://141.11.109.151:8000/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dafd8d1211dc3e19d53b6c2b2228f49

SHA1
05afafcbb3cb4b2d44a1c6a71d15b6b44055e7a7

SHA256
56779a93d0c1921d88d83bca0a28a7f89f7387c8c06300837f2d5335407d2c0c

SHA512
07f9829650d927679df0b5c01a8f7bc91bf5171fe5864e5df23fa6e0d3f5108d8a54ea0ff5c5a82e3c1982106acec905af1793f608617ef7c199fd606848316d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
237ea55f63304fe7b950c6cf36ace099

SHA1
093991e19411f446717350160d7000258078b932

SHA256
91c9d07351187f231775a9ad13cb65cf5fcb43c7492092386638bce249004075

SHA512
05375b1f3abe0fc5257cc9b5849584eedce0488f5210ff676294e23a8875608d14e09ee0e5078863036c90908a578fea3846132af40634555ff7e530dab7605e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8329075584cc05e541df0e01aaf1c6e8

SHA1
91c20485cfff0f29bcc53ba04a677df5f95d41a1

SHA256
26ba7525cf877ca18bb157295d99d6e0ff1d1c9b39f18b37a6e6b7510f7f4fa6

SHA512
ef44a53efa11b524456af3dea5ce2a37d126f5368b563728056601afcda6815cefbe2385e997c0ed6eed9035934c6dfd0bc84c89b2cfa2b6ae5188ed24979245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
becfaac5e1b04204f45cd3b10591b831

SHA1
1c14d037faad3d65866fb26c874d595ae7a4461e

SHA256
dc85abc721002ae491a1c7e6bb56bf327253ef7631e9debea66bc6d809cb3877

SHA512
b767dff66862caa2fd86727c97c8465db45916ec13c9d51456a2fcfa6823391409cee02d993ed7257206805556dbcfc97e2d638adb52b1ab5ef22d739889560a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd9b6295a5efef416b8a25af3f48c1b7

SHA1
da3e59169805845938226982bb64fa3a3c30c839

SHA256
4a22e7666556bc9200eaad964cf951593acb8ffd0aa47344f137dcbfcd4c145c

SHA512
9a2177abb0174fcbe15b7207f0eb23fd89d53f49ac9dd398a5c222beb6806092c9208c975adf42c97755e427713b58f5b47fe56ea6bb1df96eba095522ac79f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf31d631c8c9649c4ed6bec959dff24

SHA1
ed32162c9f6b13310d9812b97ec9b5300203068e

SHA256
67e0ffb2d998197542e06cbef72d2659394df94ce4b2439f6d95c1165507f667

SHA512
2eb079f162a50e0befb753e7cab935950bcb9ecb7de6b203551c313806be45e753a69881e3969b1484d7e815709b760a828b30787a435d78aa446ccc39da1e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db93e7d15050c55030588b01dfe02fa

SHA1
0ab22fd65b8d6d801529bd456e9a846f24960f21

SHA256
4a961fad27d8c6841f3a8231387bc5b5c830a27d1afb378bee891399b5acbc31

SHA512
98d9a63426d727f71764d43c6377fba2cbf4090c6a59e00b3c2609adc3a13e6ad84d1b1823c54c1b2a45332f3a5a770bebfa6d4ceaf421975dbe96d67105ca42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43233372b312c716159dc011316911eb

SHA1
ca69aaf6cc1c55005cfba91be94b1676c9bbea22

SHA256
7b8e236e8d0da1a3e0403db697be27f54029bfc4835f0772396f9b146961aee5

SHA512
3ab48b2334eabe1b7e766446ccbbd5de9d6ac2e2d5fcf2f47fa460145a91947d162f69dd10712507c51662c1c797a59ea64aed72432a9b9400b00c1d2e937e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15560190f107622a28b96be3af25157a

SHA1
2a319922de7583504e4a56d3f15ba8ea662f5f65

SHA256
6282794cb129aca5f52ac84c0322bd5d537cb1163fb76e3dfbcbfd42ebba8e40

SHA512
781bec84b0456735ab0822f3a939e568c4e8262f7b238b0225cf3c31d80708f82ce79da9ceb29c106d237f6246204b4a87ae7790e9ee9caa19de15b54156849d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85b0433903218c10de4c1c6834987bfd

SHA1
412b52b7d1c165d3ff254d90d526fd3fb52d95dc

SHA256
30c9c4554c0a62a84ecdb2c150c25de3944c98c62119d21316c40ebec7e649a0

SHA512
fc7ec611606bbf2a359e9fb7ff2f4e56f0d10b8440d17ed82dfb0abf107c29efea24a9c58fda58b7562e4714063a5e159f9a92073344e50b6a9714dd05fd8948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5812d33caa35d3a6811a9ac2d771a58

SHA1
cfb11867bd32938c4bad88c4011ed8414dac3718

SHA256
26c86a5b5883e18f532328cb1ec10c90a2da2e8dbbdeb257f3f9a1a727c207cf

SHA512
12c7b46a73168cd364a744fc72f8ab12e1d7911219862eca55dcf35af59324a873d4e4b1080201d7fb11043464abf19fc4825949a7aa50e2b833127696c47548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fab043d9f40dcf9a7c5b4bfa2c1e75c1

SHA1
440a0399978774e1a19d1e7c168b20ba8097b8d6

SHA256
66eeee74caed32bcd08140b27f4e1879137f643813667384c4405a70a10dc730

SHA512
4b046570cf68e24ec93d5cf1c4ca47989394aca1e53a0da1852742e6d295174a13ebd867e0cdc35da675db9b5fb0fcfd681cf0e9bee117108a88e62aaf2c71ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbf74a632d29d6e726a7b0cd8553e47b

SHA1
6ff55093e1a09ed8423fc4f5895710df18baa411

SHA256
942ccbb14064b5895469eec93b8d072d05103f7a6d09674b8533ceaac9c1b1c4

SHA512
1df028ed63f1388be48caba33c12bf87970c6905fd2e6f7b61a6fb909126c974d03f933efdc4e7aca5d43362554fea0f685d5bbf98f8b849c90f484e5b960623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac814e51ecb5503c3bf34ab7661fe692

SHA1
200fe3b7fd648fd181efea0888716fd73ba5adb5

SHA256
868c0d41ac54d9d687897f2fc3b2da3e81919f339cb992234c076e5f4af6ee12

SHA512
323bbc4dd0544ebc5c90bf4cd07bbb64229abf007ce925a4eab2f42ae5c04039483aa6be97107ec3ce362c196bb7fef955260643afcd439f300a4dea20b305b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50dc619c8fc1c6be8c786b1d69e33c8d

SHA1
36e9e916655628181287f7fa707bf172048bfb0d

SHA256
8b6e5f3e8ba98f440899a1aa005e7c4c7a913bd82811a19856ea4afb211379bb

SHA512
b9893c7a9b38d9e5506a389e0b89d4902c0a186731d7405f62c66809723f4fce12ebb3c5882935db13d38bfc21ac4b406dcb196a07d4bb333979c650e3c4c867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e080cfc179b5d80e16269b84f14cf8c

SHA1
95077087d37b9bcee2c9dd6566f4d920633b97f5

SHA256
4dc55b8d15455f313ff6ef2f2441695ce147115a1ca67e355c92052aa1039ab3

SHA512
01b943b7e21f2586a5294f446534631839196b496215a48f9428c2a7963689a709af6b1dcf1b58c9ed36c202627b82ccecf881bc34681037982c11b3ca5f8581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4d4330ffc8b00bf3f639b8e42688fa3

SHA1
0a3559c5b342b0f7459d2678234e477b7f04561a

SHA256
8bd840465a94d166f8859f50875f604a85a2305ec19c99d36024ff7b230b0eaa

SHA512
7f046991104ad2a169cac35b085cb36aee6d2ddab811005f6527b7db994f8c24d35b2464c3426d9343e208f10fd30cc6afd5135c098350fbde2f0ef232a68967

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD8D5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD926.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit