868d61ab45680a6fb0ee0cd78f47a39858a30e326c97ae8e1ff5d0937b6e54fc

Analysis

max time kernel
135s
max time network
195s
platform
windows10_x64
resource
win10v20210408
submitted
30-08-2021 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dhl/dhl/images/img.svg.xml
Size

1KB
MD5

3fecc9db35d5d2a9e6e71ab4b02d22e5
SHA1

628ba2f505b480097445aaf08649a08242bd6847
SHA256

362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
SHA512

c0d70d0f914d3d9f29366c9886f174580675334ec79ba77158c4cf184075540dd7d25b3f35f7129c1fae764527574daec29f5fb8434817ccbef6951b332cdd5e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2151997304"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30907846"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "337158918"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e1f90e0c10bb2545afa8f0813bc82e95000000000200000000001066000000010000200000000b7bc22f3a871af9c7f7a7041fca587ac074e920cbfce76933b3dabb285be991000000000e800000000200002000000068cad098aaaa2389df8495efb06857e4ca4540ebfc789a234eedfcb78aff4c2020000000157dd8b9b972dad37fc77e1d7a5e0565b4e91d1d748a9595ad60f1a3510f929540000000e4305a4b7a707906e829799027a41dc440bce8dae87027bb3b9972af15409f1c8e35c02a7de53f0439a067ee0af16567b0f3d6be49852d8a32bf2ea88a2c71d3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e1f90e0c10bb2545afa8f0813bc82e950000000002000000000010660000000100002000000033a9ac1f091583eaf530d01818e8df410cf6e9b1f931ce3117e2001cd3d2ae19000000000e800000000200002000000042eac9eb7b29f5dd1ffbe192f48721a60d7fdb5172d31ea44b924c9f4e96c22d20000000030cff7a6104489574601eaa96f18f8706f1cc3abb9362fcd073e5bfb7c4e10e40000000a52d2c07d1ba6cf51172e1f5f713a568721c285cec7666e2bd169c033ed896c46e26accdfd3949252b2b308af9e16784cfa1c93b3ee32dae371810df33fa3092	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "337126926"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80328783c69dd701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0925a85c69dd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6341D6D-09B9-11EC-B2DB-FE8EF4155406} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2098715432"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30907846"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337110332"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2098715432"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30907846"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1256 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1256 iexplore.exe
1256 iexplore.exe
3160 IEXPLORE.EXE
3160 IEXPLORE.EXE
3160 IEXPLORE.EXE
3160 IEXPLORE.EXE

pid	process
1256	iexplore.exe

pid	process
1256	iexplore.exe
1256	iexplore.exe
3160	IEXPLORE.EXE
3160	IEXPLORE.EXE
3160	IEXPLORE.EXE
3160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 496 wrote to memory of 1256	496	MSOXMLED.EXE	iexplore.exe
PID 496 wrote to memory of 1256	496	MSOXMLED.EXE	iexplore.exe
PID 1256 wrote to memory of 3160	1256	iexplore.exe	IEXPLORE.EXE
PID 1256 wrote to memory of 3160	1256	iexplore.exe	IEXPLORE.EXE
PID 1256 wrote to memory of 3160	1256	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\dhl\dhl\images\img.svg.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:496

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dhl\dhl\images\img.svg.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1256 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
fb9ed523ba700d7bd169da09f80f35cb

SHA1
52b48d4ab50a3d34f15054c485215ad78b84a020

SHA256
9ad885119fb1556ae1f94eeb9a78709bc300c956d5de41ec19a84cdbc0ac7411

SHA512
44f3cc19d96e765a719d89273f1f2ff3d26eea5a274af97e136764fe63c0aaf72b343c6e6ce271e49d167f8c875566259d9b12245c7b05f69bd3bc17dc624ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
eb28c20f03b518d66250e5ab4d3e3bcd

SHA1
0f25d8e815aed78afdd46d4b49b4eff972e5ead8

SHA256
2961dc4c89f26bc94bcffaed8be4f9e8138549b99750b9faa151474a4c141425

SHA512
b138c56e61d82abc8f181f5ec0ab9f0a512059c29c84d77b1e1888ef4880298296432cd4995cbefcf61d4d00a5c8be4d3d063ff416b5f416cfef89d610825a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7VVRZI8C.cookie

MD5
b86ab50bb18b107bafe030a18ea6f7da

SHA1
6bee635c4210f020bd70c8de88e8141c8436b8e9

SHA256
ef1e63bbb728e82804ee60c06fee5664e377db988c47040533e87e8a5866cd0c

SHA512
4bf0d8ac85ec2838ded549e99a6190414c338a9729b15a6fb05eb51f53c1bc691fe39f7e375f898e2ba9832df0a2ac4fd27867987db6edf39518c76ecca5fd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\PSAF9EKI.cookie

MD5
f81058b0dec178a2036a68d06dd5360b

SHA1
64b69e19825972d950948dd6fe60bb9a171ba209

SHA256
44cfed1cd2dafd9cb859354ae36883d696c0ac1902f108c68ab0a6425de0f5d6

SHA512
96f72bed6c4b88bdabaa855a4106e13822838132200f84d4a3e069c1afa80bb85c51bff8808cc03c8d5a0e2372370242d525433c44e674136d0e3e2f4e64dc19

Download Submit
memory/496-121-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-123-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-124-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-125-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-126-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-117-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-120-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-119-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/496-118-0x00007FF882460000-0x00007FF882470000-memory.dmp

Filesize
64KB

Download
memory/1256-122-0x0000000000000000-mapping.dmp

Download
memory/1256-127-0x00007FF8B5750000-0x00007FF8B57BB000-memory.dmp

Filesize
428KB

Download
memory/3160-128-0x0000000000000000-mapping.dmp

Download