b15635c02a17dd851f7f1c7717feb5a55ee2cf3546acf689806a745789119f70

Analysis

max time kernel
108s
max time network
156s
platform
windows10_x64
resource
win10v20210408
submitted
30-08-2021 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fonts/fontawesome-webfont3e6e.svg.xml
Size

433KB
MD5

912ec66d7572ff821749319396470bde
SHA1

98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
SHA256

ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
SHA512

4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4007212914"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105ef6f0dd9dd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "337168984"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4007212914"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30907869"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4012212794"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30907869"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19EA27E5-09D1-11EC-B2DB-CEF18E2DA9C2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0831cf1dd9dd701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30907869"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c63afb8efe3b7446b1630bac70d6700d00000000020000000000106600000001000020000000a35c1ff96d8013196c325e5af9bda8675a39cfe7dd831142032779ade8107d54000000000e80000000020000200000001cffc2786900439b9399dfd908f91f202cd8d6bd043c78b26c492b190e8a2a7f20000000373b918e55ff05b42fdf95247b1b4aab09de04bf66b69a76b8b6f0a1384ea7234000000060cf03dbd39493fb549b6c56a7698955eac2153eeda63505e93b65ada2b2a4ec21fecdb0257ad874da04afee3e0c364b3ba8d2b1b7f51ebec6261b9dbbe2113c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "337136993"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c63afb8efe3b7446b1630bac70d6700d00000000020000000000106600000001000020000000dde7639b323caed494df934a37e2b8e396a84f753c6d3365ff4daae850a6b84c000000000e8000000002000020000000885738153d7c2e2e816d5fdf5a4d9e811fdd941c5b5a0a897f45b1207b115df520000000d6d2d52382fbd0006470215956c383d045615df355cdd39dbf45fcdcda0e1e39400000008de526e8c25c82a8c5a963225b52953df231149f7f7e87eee92955e190577207225a4d689ace9682969e35d1ca2434c7d356b412e26f09fd84d296dbfc4373de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337120398"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1896 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1896 iexplore.exe
1896 iexplore.exe
3356 IEXPLORE.EXE
3356 IEXPLORE.EXE
3356 IEXPLORE.EXE
3356 IEXPLORE.EXE

pid	process
1896	iexplore.exe

pid	process
1896	iexplore.exe
1896	iexplore.exe
3356	IEXPLORE.EXE
3356	IEXPLORE.EXE
3356	IEXPLORE.EXE
3356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 584 wrote to memory of 1896	584	MSOXMLED.EXE	iexplore.exe
PID 584 wrote to memory of 1896	584	MSOXMLED.EXE	iexplore.exe
PID 1896 wrote to memory of 3356	1896	iexplore.exe	IEXPLORE.EXE
PID 1896 wrote to memory of 3356	1896	iexplore.exe	IEXPLORE.EXE
PID 1896 wrote to memory of 3356	1896	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\fonts\fontawesome-webfont3e6e.svg.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fonts\fontawesome-webfont3e6e.svg.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
fb9ed523ba700d7bd169da09f80f35cb

SHA1
52b48d4ab50a3d34f15054c485215ad78b84a020

SHA256
9ad885119fb1556ae1f94eeb9a78709bc300c956d5de41ec19a84cdbc0ac7411

SHA512
44f3cc19d96e765a719d89273f1f2ff3d26eea5a274af97e136764fe63c0aaf72b343c6e6ce271e49d167f8c875566259d9b12245c7b05f69bd3bc17dc624ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
9e973fa86313e220c7332acc051f6364

SHA1
8c47171da62400c79231f33a49a48d02db90cf6e

SHA256
35930802ffe1ec55e11275ac2662231a516b7997443e6ab1d1f2143efb472745

SHA512
f64a3cd63e22364fc5124e78afb2b1c251d9332efc0be42c189df7917866cbd9b82fc841c0e1d155723ba5d33fd502d01f7662b3926891db30f046655bb57009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\2IFANN2X.cookie
MD5
83fefb6e76b559e04c76efa4a24fbb42

SHA1
056ef8b1e0584d918c46d7edf77b47def2382029

SHA256
b92d66d967b1f22675c10346c797aeecf5e60022c0ed9a1a871eb06120162e69

SHA512
405eeb586883337cad1851f3c80d7f9dacaaaba4089bd264f241818701ec618e1e89eed62cd3704acce23ca8f8957ab57dc1982c20d77aafe23dffc2cf64504b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\NS6DPC81.cookie
MD5
1fef4f20a0d4b249a12b65041a8a5f94

SHA1
adb1418338aba8e4808c95489faf3dadce6331af

SHA256
605b9ef8982cdc3ac4c27cec3802c37bcb8d8b5175f99f498f9a019505b0a7ae

SHA512
9551c7357ac18f40b4c99dce7480b05d998a7462e0a8a1d69f0c16a80801a40178b47b55b141bd48313904b3110ff6a88734f2264397920f9e1b5267f768df43

Download Submit
memory/584-121-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-123-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-124-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-125-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-126-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-117-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-120-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-119-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/584-118-0x00007FF9EE820000-0x00007FF9EE830000-memory.dmp

Filesize
64KB

Download
memory/1896-122-0x0000000000000000-mapping.dmp

Download
memory/1896-127-0x00007FFA21D50000-0x00007FFA21DBB000-memory.dmp

Filesize
428KB

Download
memory/3356-128-0x0000000000000000-mapping.dmp

Download