hxxps://exitmagall[.]xyz/iduew73

General

Target

https://exitmagall.xyz/iduew73
Sample

210621-mykyk3wv4n

Score

6^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

856 2000 WerFault.exe IEXPLORE.EXE

pid	pid_target	process	target process
856	2000	WerFault.exe	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7F3E6E1-D25F-11EB-AEC4-5A9049F94F70} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e450000000000200000000001066000000010000200000005a35ca9f6ed3de0bf1f38a33da9665712f204d9ddb7472503b2fcc95eb1462d0000000000e8000000002000020000000f2bf7310c6ac305f59dc3168f9224830219b8b479f417d434200e8d295dc7d7190000000b8072d41386adc0589799c8520f082e21ad91d7da1b1cba8d690bdfe5bfaf7293cb33200e2f7a15d0170e5f65cdff0fece16ba14af6b6467b93536a9ff026539aa22203e9e186c64d8c65fae88bc21d115ec9ab84f89bb0400438578a66bf62d3c77a72393afd8f0d5d9cb23a541eff06e69199f78b56f87fc9e71e753597f727f05a218365c1e4d6ee8f16808f20c3340000000652c791ebe75a4aa95f3d0ac4f8b18798a30ade2eb83d305b2e92ca8a04875a2e0d8bb417b0196d26e42d87ff9e593c3a6ebbbb32dd927dabfbd61d375e752d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e4500000000002000000000010660000000100002000000087d8aa8653d659f840b0b85669b6c3f32f21bf604c94db2a83c2919add8008fa000000000e8000000002000020000000c5ed615b936d5072815f862a3ecc28f90442317c232fece30a0a177d0d0c28302000000046ff566b0c303e75d7765f0ac3f82b6b414df388b16e419411ae3516e1c9773540000000727ebd5ec24b434374e7cc19ae6af433256f5b432f6f1451cf852f129c5fd6369b7d07fbba94f0a9990b8961b0f3d7520b75ac563c0b0bd4048879e9c1cb1f5a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bb33976c66d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331024414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

856 WerFault.exe
856 WerFault.exe
856 WerFault.exe
856 WerFault.exe
856 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 856 WerFault.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

684 iexplore.exe

pid	process
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe
856	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	856	WerFault.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
684	iexplore.exe
684	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE
1596	IEXPLORE.EXE
1596	IEXPLORE.EXE
1596	IEXPLORE.EXE
1596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 684 wrote to memory of 2000	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 2000	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 2000	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 2000	684	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 856	2000	IEXPLORE.EXE	WerFault.exe
PID 2000 wrote to memory of 856	2000	IEXPLORE.EXE	WerFault.exe
PID 2000 wrote to memory of 856	2000	IEXPLORE.EXE	WerFault.exe
PID 2000 wrote to memory of 856	2000	IEXPLORE.EXE	WerFault.exe
PID 684 wrote to memory of 316	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 316	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 316	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 316	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 1596	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 1596	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 1596	684	iexplore.exe	IEXPLORE.EXE
PID 684 wrote to memory of 1596	684	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://exitmagall.xyz/iduew73
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 2252
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:340994 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:316

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:275473 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
0fd27a8cd1eb2839b28fe784ea3b60b8

SHA1
4210ca1299b17473b6131bc4eed72623dbcd69a9

SHA256
8df9ffe1480f0ec4cfc069dc3cf51606e6bb8f1e87299bf0c28f6ff9a71c4fcd

SHA512
3a4ce1bac7dad8bdd10b94ebc0a6a999428b053c65c9d9dbdc4088ed0e4177d5970ba6cad1ea6ba2d67e6fabfd9fc751de25a1b9cb75aeea2968493b0fa541ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RNQMQDEL\6Z8SRV8M.htm
MD5
ebc41eaa231a2639432fb73307408d0b

SHA1
b55295554146a36c0ed746ff4eef501a5960947e

SHA256
7cbc3fb8b88bceea83aee3b5b27ef3fd8ea1e459090c9f094145d5e92016d5e6

SHA512
1b7cdb6b451817cbd1f5c9894153c9906b177e3cf93da0b6bcbd1200adc6e5ef83c61f46519c500eec1d275a9e5a98a32cdba4b411f13d9c7c550dee25b1d8eb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8ZFE5THI.txt
MD5
615c7316b01b3f5b1006bb12bfc7a3b5

SHA1
f148ad71bea3a0d3c8cf39db88cd5324fa7960ee

SHA256
b830d0ca9a7c9b2767b9d5582a01ff6a5906507fbb5ec4fac4bdd42515cd63b4

SHA512
5c694c7e0b6346de4baadb628cb893aa1159331be99a57c69c8d94e13544366a7bc46849276ca0031d3a004af795145684e8d668262643de4913f9c22f142a3a

Download Submit
memory/316-64-0x0000000000000000-mapping.dmp

Download
memory/856-62-0x0000000000000000-mapping.dmp

Download
memory/856-63-0x0000000000450000-0x0000000000514000-memory.dmp

Filesize
784KB

Download
memory/1596-65-0x0000000000000000-mapping.dmp

Download
memory/2000-60-0x0000000000000000-mapping.dmp

Download
memory/2000-61-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads