909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18

Analysis

max time kernel
265s
max time network
278s
platform
windows10_x64
resource
win10v20210410
submitted
23-08-2021 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tGeiUalbScQ8sPK2KKmKZNga.exe.xml
Size

223B
MD5

a6a676051f857d516f6c4bec595a7cfb
SHA1

10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
SHA256

98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
SHA512

df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B8700B4-0457-11EC-A11C-465F29FC5D21} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4029425866"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409ec8f16398d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30906467"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30906467"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "336534840"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4038644497"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4029425866"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "336566832"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336518246"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30906467"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000434a4e5855e1dc468317400778f824b8000000000200000000001066000000010000200000001a2e33239b7cd29f2ffc119d77dc7af407e6fb60aa4756b6a71719b24fcb8fbd000000000e8000000002000020000000d00471b7b5110bc10105d0543bc21f87f9d56251e06fe0c5dae1bdace1795c302000000088b32fae4a2853d5e7be6a6619e6b7d0c12b8c6405d125e6b28d310674429819400000003cea6de7abf9e97ea2e8be8c59c61ee00f0a7f6c1bf88807743392d6b5f4c81c934d795ebe0f64deb357a3bdb0094c48588a67a3097ad9cb258ac400b1ad2985	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000434a4e5855e1dc468317400778f824b800000000020000000000106600000001000020000000bd1b85ac07e1727b8307c520a85396242847d489c127659eb7124afa68489d55000000000e8000000002000020000000c3aa245ee42e3876987178691bac1a07215f2cdcd3c686c6d053c2ee1561b0e720000000451b771106f8c4bf89213c7852fbd08f64fb500bea266e879172a7c56cf6965040000000effc819defda033cfde415f2bc27325aff4d3637249afdc47399f77e1e3e10c6e9fd1e9a3360fd590e0caa8fae0ca7e6003b0b713deab10da96f0091a306ed8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04c9bf16398d701	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2632 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2632 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2632 iexplore.exe
2632 iexplore.exe
3404 IEXPLORE.EXE
3404 IEXPLORE.EXE
3404 IEXPLORE.EXE
3404 IEXPLORE.EXE

pid	process
2632	iexplore.exe

pid	process
2632	iexplore.exe

pid	process
2632	iexplore.exe
2632	iexplore.exe
3404	IEXPLORE.EXE
3404	IEXPLORE.EXE
3404	IEXPLORE.EXE
3404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 3268 wrote to memory of 2632	3268	MSOXMLED.EXE	iexplore.exe
PID 3268 wrote to memory of 2632	3268	MSOXMLED.EXE	iexplore.exe
PID 2632 wrote to memory of 3404	2632	iexplore.exe	IEXPLORE.EXE
PID 2632 wrote to memory of 3404	2632	iexplore.exe	IEXPLORE.EXE
PID 2632 wrote to memory of 3404	2632	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\tGeiUalbScQ8sPK2KKmKZNga.exe.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tGeiUalbScQ8sPK2KKmKZNga.exe.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
adf80b4499e2ca831a55d61bf4afcf29

SHA1
ee0cf7b14f744da03352610edf39c0daeb141c6b

SHA256
7e1358223b9c4f74f62546b4263840edc41b8913fc728928bac321a33d1b8f47

SHA512
431d30ab28b2a00a9055ae040efdb0e7d11c670fb03781c8e839a50848ed993439d19504b6c7115c74fedbf52844a4de3c923cca4643e95f0ea2c2473e9880f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
39e160723e6ecf72b6b30e4df58913b2

SHA1
c36d3dfac0949a4f06a153a76f00322a708ed1d4

SHA256
bda857d67d86612b6f21c84ea3a695f86924270ceaacaab0add6cac98d620fa7

SHA512
a4c2e4d76574a9d4934de034d60606da9e3c613a93b78a0f134450ba46a26482b2bee88a5ad57c8eb21fff2836a39afe42f9e749fe3101b153c8fe027eb85681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\DNQ0OVN6.cookie
MD5
6ce6489a818c66ba4431da02fbd8d0c8

SHA1
3ca63b38961332f7032c31800c165afd0dda77c7

SHA256
9186363964bffe5d06037e4dfb2ea2fad9a8c51f2644af99903489015ecbd6f0

SHA512
f8231da41f94bce09caf461fb1e487253495bc54f6af6eccde126139fb6621e23d9611770974a9968ea80da108feef5ecfa262f06556567689fe3c0eecf53260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MCJEQY9P.cookie
MD5
513ca366bf382a5859db69a862ea50e0

SHA1
7cdf0d5f670c129fa502511160720bb53064669a

SHA256
6b9ced745c0fb1cdbcf39bf4d9aa50f4e953ce5f7d70e6f814b033546354c179

SHA512
009c6982bf174517bdc919f878d03d0f6f810dd584bf59ff251b74b054324b87f9887e9789833c6651ba5b996987c4958cc89f9425108b405369a994cfc70fac

Download Submit
memory/2632-126-0x00007FF9EC080000-0x00007FF9EC0EB000-memory.dmp

Filesize
428KB

Download
memory/2632-121-0x0000000000000000-mapping.dmp

Download
memory/3268-120-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-123-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-124-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-125-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-122-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-116-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-119-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-118-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3268-117-0x00007FF9B87B0000-0x00007FF9B87C0000-memory.dmp

Filesize
64KB

Download
memory/3404-127-0x0000000000000000-mapping.dmp

Download