hxxp://nbggroup[.]sviluppo[.]host

Analysis

max time kernel
75s
max time network
76s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://nbggroup.sviluppo.host

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B6D8C31-403F-11EF-93D0-F6C828CC4EA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c84fddd143f47762815da5c6042234c1ed2da4a5693a410212f91ee819a29384000000000e8000000002000020000000a4888d997f9fcafac3f0a48df88133c22a9d1d54cde708c68b208829c8fc249f20000000bdeb189d7dd7741f8a49e6aef44dfe24d75e35a7056762dbcfe46ed6bb7416ee400000004995b91002c79041dc8be6ee8b9ec25bc849c3338e8c467d4f026542230ab2c8ab0413c9ccc877c3aeec1c1749f3e73117e5a7870fb8651066d11bdf8d92d274	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000007580e10634bce83843ae6a47573c130666315b116ef220550547e5bd0b0cf06c000000000e80000000020000200000006630eccd3d7b143bef9cf08603c7dfccb2ffac9ac5f68cd5a5db867cbeb7829090000000b13424e6a2211d8a4f41eafa69893fd7752b5637e7e6a54845e28a5b2ddb7e5374db8c67435db9a735d1c7d1c8dfa99c12c7a6cbdbe41d88f60b5b9a2a3d499ef9972549789d01e0a92b6f805da2b4c03f5eb05d8990236873ae61a2738c2771c130af1e93c3959fda97ab5096c916635663e2ab46f34940bba8c939d7568c3455b82bbb6fb7687be8c57b6d865b91074000000040405ac2b98265f0b623b05272f8d4ac3e3b8cc0f6d40582d054db95f8f3e342c88a45208e9035045413116407fc8f48ce499c62ca085d09826b4a928d18253b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426944505"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a4a84a4cd4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2976	2516	iexplore.exe	30
PID 2516 wrote to memory of 2976	2516	iexplore.exe	30
PID 2516 wrote to memory of 2976	2516	iexplore.exe	30
PID 2516 wrote to memory of 2976	2516	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://nbggroup.sviluppo.host
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b485edbc116e2c669d688b68370f97a

SHA1
f8d6a51e47ce5d8da72da6480e1d5458e37e41e7

SHA256
cef002b22d1c3fb6c48d267ed0dec3ede21ba18a57f734db0b838826814286df

SHA512
8d058cec723620bb8ada25e218de9e65d69cd1a514a237eec2775ac6353d439e17f4e78cd824f9075884129f3dbfcff918d31c49825f041f0ebfd5b10358e6a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6330442faec16e94e4baaa76d2b86c7a

SHA1
f17f346abcfe6a9f91c7d3936b63e204d0cd61df

SHA256
27b931f4d5e498676e5bf31049141e12895f33784816bd868e0b85fc2656179c

SHA512
f539dc0601d0ac9941bd040e946f5da2753ed17673168c1240cc8a60d49006bfb7419e946d4d80f853df45f9df4765987360e1e4f6a0db5ed06ee7cf3ea82b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
281b1463a8781c3baee08c160b4ffbec

SHA1
b3cfb866254bb340cb284ab488bfe079d43074ba

SHA256
c55688d19e76ed989afb108489fafd26975028befbf3230c9188bfa8bfe0ab6f

SHA512
e3f60b8f98775c228a5dd3e9f0f8bac0f8e12435d04f4aa0ce98e6f9d22ea6c2142df04fb9a4180671001502d36a1d5b08d3e10e5dbebca79b14b1bf9ab02ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9068c95be18e987115ce332c793cccd

SHA1
41515287a4af6a6637330d74faa00138af555c43

SHA256
f03e5182459d64d33d10fc29ce4171542db3cc3a77e3e3747d3bffbcea07e5b2

SHA512
1adc19926f768b0b4ee2318c91daff939e32fc8d3c890c27286a4e9824bc9077f4c11ba9c36f4a32809f9706e31f7e59e99a4e8a677b331b1f9cbd814a857361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d62ca47a92182d81dc952e71948da63

SHA1
6a9843f671335b184bd2ddd56c40aa338e9cf80c

SHA256
a2b18cf323988dbfe55e7c46296135cfb5b789f6c61909db2ec4cf4bd21e1db5

SHA512
255b6b53076d0c7ab51b5c311e03caf7ca2f9c4530ff33be92a38aa90ca782b3184e096fd63f22e5163960796db473f2520c70e89c9982db4fa534d776fe1249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8bb5a2407afc25ac37b1493254a04db

SHA1
b47af684bc800be0ed54622ac7f1100dd0012ec9

SHA256
1a93264b4591fc70c2a9b9acc7958649c50d8487873819c97cc3e0164bbf86b0

SHA512
bcf76014e04d3a2059064eb4b7e224c9892c87c1ba9b32e746d1e5fbd283643e699278034b50d7ee958fe983a57d04719792a4a7ac0e91e2698dc1a6f5b3c96c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebd09a300d4a0f92e7ca3cbd8a03917d

SHA1
9c5b7e3defbf2a61b80b0b661e413e5db791fbde

SHA256
7b48824706794ab16ed9d2d36e2b1bac1d6416f9db9feb2d71b2d0c23b293f86

SHA512
decdacf066d8112360297d08fc8c084987104741eeda0b388677fb3610f4e5ba2e8757ee466002f36d5c7afd5e9a428194d36ff3f81068944f332e275ba4e46d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90165776c7a7c26a6b0671e615323417

SHA1
315dd397a5b3fb33a8a3bdd7a690bc1b71dc5235

SHA256
6561abb194ffdc0cead3f23efae06559bc069d68ceb7d069980121f496d1a686

SHA512
07608c33d5b1b04b2f8eac1d2793d5eeef6f3ee4c2f436a5cdb51f0b63a41eec9428d4a67f663800dd02ab46295d62f8d0c674c067644ab4da7deb3f113a177d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab784C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit