4abc4e174beea2d801bab1f52a202a1adcdc372443e25a2f1875b90f112ff56d

Analysis

max time kernel
601s
max time network
367s
platform
windows10_x64
resource
win10v20201028
submitted
22-11-2020 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index(9).html
Size

119KB
MD5

33b72c6dc00dd802f5e2d53cbe5c613a
SHA1

450ed8acb15133ed843576e735cc171e77c6fe53
SHA256

027bb852118f95abe8945905a2ceb945b2051c14418f0f47cb9db097ccd97a36
SHA512

fb734e720d5043f887e0a8d66b01cae4a3c5028712a28452406cf0d1d629e2c4205d623286f8aa193b5d269ae8f545d860ae0a65cebedf77e6a887dff7163370

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d0000000002000000000010660000000100002000000030c0f8956d275c3f13101fc2651c9807a21d6fb101c6b2e56cbb17ae383608dd000000000e8000000002000020000000cc9ee6700e908d608da1c0ad8859f1a8fab623bfb51c25e6ef822270aec803d3200000008e34abb64c07350bcd10289fbcd73d6e692410e0ca408e7fdc8b8f72a40e4d934000000092fa98f8c0bab89cab0c0b8141325b72356a393597c000185145baad557ac1c838e2b1bf5d822e2682734a85b15fe3938b927ced3bc91c0673702502f9380874	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000009321210baf3e49a4842ef0f38e84f15619b46cf363526c14587c5cd3d0aa2f0a000000000e80000000020000200000002e04a7c97f92d75ff4f99a549e60b9ce35859ef17c605099a4c9724e528d3dc820000000018b75a5dcdb2fe9d3986ff9a28f1fcda98d1e5e948b01e29e4f2636e614dfbb4000000093b10c6c164629728d5402132b65a32697050b3ec1797f1b2175a93f48a070075d3786c617eac5cc472800738b0eb90ef826bdefbf386005da0fe6d7bec0a86e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30851224"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30851224"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08d5f8d98c0d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "312791390"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2356024291"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00116c8d98c0d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B71AC084-2C8B-11EB-BEBD-6A3FD5463AB0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30851224"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "312839976"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2345299073"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "312807984"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2345304130"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXEIEXPLORE.EXE

description	pid	process
Token: 33	4228	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4228	AUDIODG.EXE
Token: SeShutdownPrivilege	3480	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	3480	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4760 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4760 iexplore.exe
4760 iexplore.exe
3480 IEXPLORE.EXE
3480 IEXPLORE.EXE
3480 IEXPLORE.EXE
3480 IEXPLORE.EXE

pid	process
4760	iexplore.exe

pid	process
4760	iexplore.exe
4760	iexplore.exe
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 4760 wrote to memory of 3480	4760	iexplore.exe	IEXPLORE.EXE
PID 4760 wrote to memory of 3480	4760	iexplore.exe	IEXPLORE.EXE
PID 4760 wrote to memory of 3480	4760	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index(9).html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
MD5
ffc04cd305e33221116feebf2eaa50b0

SHA1
6aeecd1a32ce6655a43e6b35cb2d0cb45876c9d4

SHA256
e0215011ac1136f278389a2a9b9572d9cdbb704f4a2a6d4b9cb8e99eba316de4

SHA512
ecd09a4db7f337f7b4b767edca0615262af8785c3dd85e6369037c04eda0865c59949a406e6e016ba8e893e7f740881be22909aa472ea6fd1c38aa3902979a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
MD5
55be7950fb164321e4519ffaf4dff491

SHA1
0b7ae41fde6bc4f85c78cbd4dc881ecb0f1cf65b

SHA256
20cb128ead7c086f0f26a008dd813bba8bb0326e2f7f79f16436ec7f69cf6cb5

SHA512
9c076dbfcbfdbbdaaa7837dcfcd94d8499231150ca5032513ca5b5d155fa01a4eb24f85a7e740cc277843d81a6239ed2f4d306b18c518ac9389bfc3c4218ee27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\HWYFXCTE.cookie
MD5
97baf2121bca95ea3f5453fb88363889

SHA1
f41716b5109ac98cb26a2c6cc8a0ef5b38999e3f

SHA256
d6fcdb6b05265606b90a09e5c15e004739c371bdc6a4c309ccea2e4f76f84594

SHA512
6f9e0e84ea92e0256a26c49a207dfb320d45c960a1a66be8c30d271f11d85e74b253a531e2a7710479150174ef9017192a522412f8c8577822d724c52714a092

Download Submit
memory/3480-17-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-7-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-16-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-1-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-18-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-8-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-2-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-11-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-10-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-12-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-13-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-19-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-15-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-0-0x0000000000000000-mapping.dmp

Download
memory/3480-4-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-3-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-14-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-20-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-21-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-22-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-23-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-24-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-25-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-26-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-27-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-28-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-29-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-30-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/3480-31-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download