909aaea4a3072305c0bcaab9d7b9cab70990305541db276ab8d870e3fbc51a18

Analysis

max time kernel
258s
max time network
279s
platform
windows10_x64
resource
win10v20210410
submitted
23-08-2021 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QwnNK2SHckcc_GsoTwi8hDi5.exe.xml
Size

223B
MD5

a6a676051f857d516f6c4bec595a7cfb
SHA1

10e7c48a109ffbe60fa7ab3585c4bd711942cbd2
SHA256

98686e602b5f75bbceb801ca315617579ad9ffe9e2df66d49673ea35a7e1f343
SHA512

df302b28e5897bac668ad1ae2b32d2424af7c8cdf4527ac54ea268e6e9fbf41efe28b236af25ceacb5e5acd95b6c99b8cf95fa735687358a265bd59e2b127ba6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30906467"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F19F66BD-0456-11EC-A11C-6E47AA25CD96} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30906467"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078ab7f1b523aa9439b5fd0b4b0dd7616000000000200000000001066000000010000200000008b6cb24735f41cc561f8f22150989f29d2301a2a2e8181862b4ea2850ac92b40000000000e8000000002000020000000322b5896be9cf8ffa3b1847f88472e5e9130add20e2eddc97f9fa553d7369d07200000005d8d3bb9089b460181b4d82d1f6b6ddb2d591dca159ccae3af655352c134273f40000000e41ed469481d79389872ac5bef9dda616b621ff34429ca9d04658fef0636e0fd52289d7066fad78c0023490c9cbfcec79e4fe3d2c5b72757f441f5eb222e2fe7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a99fc86398d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336518177"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "336566763"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c293c86398d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3326848965"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3326848965"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3352630786"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30906467"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078ab7f1b523aa9439b5fd0b4b0dd761600000000020000000000106600000001000020000000f4c8dd63585afe7774c17a4a23690d1e1611476980f97f62992466c494402e90000000000e80000000020000200000000f1b6e8ab3d02c5686da8340df71fb0ec5ff95ba6e89d444ba458c0edfe9035820000000acbe822cab7958f8c9628625eb7c0dccc47e01bf6dffa778ed5a6b90f500663c4000000094afb575631933ea9a47d25f441172a3600789d0c95a3d0ef364644d37fd616cac2216134ee44d480e75f489d9f0cdebe8397ebaac8930e45aec2f5bd97ce929	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "336534771"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

5092 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

5092 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

5092 iexplore.exe
5092 iexplore.exe
3844 IEXPLORE.EXE
3844 IEXPLORE.EXE
3844 IEXPLORE.EXE
3844 IEXPLORE.EXE

pid	process
5092	iexplore.exe

pid	process
5092	iexplore.exe

pid	process
5092	iexplore.exe
5092	iexplore.exe
3844	IEXPLORE.EXE
3844	IEXPLORE.EXE
3844	IEXPLORE.EXE
3844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 4448 wrote to memory of 5092	4448	MSOXMLED.EXE	iexplore.exe
PID 4448 wrote to memory of 5092	4448	MSOXMLED.EXE	iexplore.exe
PID 5092 wrote to memory of 3844	5092	iexplore.exe	IEXPLORE.EXE
PID 5092 wrote to memory of 3844	5092	iexplore.exe	IEXPLORE.EXE
PID 5092 wrote to memory of 3844	5092	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\QwnNK2SHckcc_GsoTwi8hDi5.exe.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\QwnNK2SHckcc_GsoTwi8hDi5.exe.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5092 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
adf80b4499e2ca831a55d61bf4afcf29

SHA1
ee0cf7b14f744da03352610edf39c0daeb141c6b

SHA256
7e1358223b9c4f74f62546b4263840edc41b8913fc728928bac321a33d1b8f47

SHA512
431d30ab28b2a00a9055ae040efdb0e7d11c670fb03781c8e839a50848ed993439d19504b6c7115c74fedbf52844a4de3c923cca4643e95f0ea2c2473e9880f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
31d24e8a8d8244bc4584c25dfb680358

SHA1
75fe6d9a569700f5f089e8d88e77a929ebb6be13

SHA256
73b1087960c3855c70f4d619d60e259610c50fc0f6bb691dc95d0132bd8fc7bd

SHA512
d91643ad750ae039669ab45c1aeae46708770c6899a7b4992254890918b6edfa7f0e63c75d38daa4aaa1db05ef335caf99509bb3458929658607b08a84bf396c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\3UW759P9.cookie
MD5
9b6ef10fbe7f06521865f507f3bf82b9

SHA1
5e91953a512f7b397be66da40aa2bb16f5daac28

SHA256
8745c2463e46dc4ee25a2c9c09ef73f5cafe7c591d56875c9ca22b00e51fba89

SHA512
3d945f4f6af26df3ecd16bc4686d3e8d5aeb23b8cd67bc5c9adaa7b97b4e5f97359aadea027d46ca4f9961e869c14fa1ea1824c63a4cb725be0d810826104b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\DV8S7730.cookie
MD5
8c1af144c50a4f6fbba2d4dd4d505902

SHA1
afd819c99050639d5d4fb8bfb5f32169803be490

SHA256
d6c62fcb33d3d99c0fae95729333c4087e70f1c6819a1e87665dff1ddc035320

SHA512
6ee9d520984179205fdcb732953fb5aa0dc03934f6c53d51bee5296a8a877a4118018a08a87e976a29635314c6b80034f5ac87b87d7f8b07a0ffd0b1e750264a

Download Submit
memory/3844-125-0x0000000000000000-mapping.dmp

Download
memory/4448-121-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-120-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-122-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-114-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-124-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-119-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-117-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-116-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/4448-115-0x00007FF9B3A10000-0x00007FF9B3A20000-memory.dmp

Filesize
64KB

Download
memory/5092-123-0x00007FF9E6F80000-0x00007FF9E6FEB000-memory.dmp

Filesize
428KB

Download
memory/5092-118-0x0000000000000000-mapping.dmp

Download