hxxps://team[.]chadkrause[.]com/vendor/phpunit/phpunit/src/Util/PHP/Template/vc/ugi[//]flcybgpeuexjzv46rfqqx0hk[.]php?i3i6H3163232003734294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f456&email=email@email[.]com

General

Target

https://team.chadkrause.com/vendor/phpunit/phpunit/src/Util/PHP/Template/vc/ugi//flcybgpeuexjzv46rfqqx0hk.php?i3i6H3163232003734294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f456&[email protected]
Sample

210922-rlt79schg9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00342d6bcdafd701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339092422"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{919A8CEE-1BC0-11EC-B2DB-46FA6997EE5A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1765474365"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbc41942358f0408e424be39f9d891100000000020000000000106600000001000020000000154bf44a3feacb103b7d390474e5c33b2bb336290cc8483d169e0a2f711a2d3a000000000e800000000200002000000081e369fe22c00ea6bbfe9c1264a7f61a9bcdb4096227d3a6ad0c1b497b9c25a720000000dc398a8f0b51478290cf24d9d97624b3070f435a366d5f6784a6b9bff14884a0400000000bcd769245416834b4032dfa02ab532ce43640e94a17a59f3a9c816e2fba6bd4643d73f8131324a16f8ffb8d51ba7f52a22b41728ac670f99822145d3eb022d3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30912461"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30912461"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6009706bcdafd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "339109016"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "339141008"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecbc41942358f0408e424be39f9d89110000000002000000000010660000000100002000000066a8c6620e19d157cb3c4713eb3ee7c1d121bb292b7b9475eee759a72e6f881c000000000e8000000002000020000000546ff74dd0cbe7d026dcbde0c45cef72b6079fd9861e107ed1fd4716242cea50200000007b2684c1874063657292f65debda950ba023258e1bd2decd0dbbe9f18e0d166340000000e45058e852bf5de224a2743e794500935b963f8ddc5504957c85c1cc78cfb64071932c1757623f525e9ef3399d3cdd189c214600f9e81dd90880584939af6b4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30912461"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1716568035"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1716568035"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

640 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

640 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

640 iexplore.exe
640 iexplore.exe
476 IEXPLORE.EXE
476 IEXPLORE.EXE
476 IEXPLORE.EXE
476 IEXPLORE.EXE

pid	process
640	iexplore.exe

pid	process
640	iexplore.exe

pid	process
640	iexplore.exe
640	iexplore.exe
476	IEXPLORE.EXE
476	IEXPLORE.EXE
476	IEXPLORE.EXE
476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 640 wrote to memory of 476	640	iexplore.exe	IEXPLORE.EXE
PID 640 wrote to memory of 476	640	iexplore.exe	IEXPLORE.EXE
PID 640 wrote to memory of 476	640	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://team.chadkrause.com/vendor/phpunit/phpunit/src/Util/PHP/Template/vc/ugi//flcybgpeuexjzv46rfqqx0hk.php?i3i6H3163232003734294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f45634294144611cd4a19b656e6dc0d7f456&[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
6184b0e7016067db51a6ecf5f3fec69c

SHA1
d95dc8253b3f7ee8eab391a9933de56929b7b9a8

SHA256
f0310616d9b89c76451b430a7849df7d6de967e7be98d4db98b18b13fd0d4c24

SHA512
1d5a39ff7c1a9896999b5a571ac198c8c7c667737f9970d1b81c49b6d20925bc800df7b5f2cc890a079646bcf8e7aba25934018e55cf555d1873f0f19dbf05c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
d665c093f04dc9d115e0f351b0ca365e

SHA1
6ad2ec43673a8ca72ec48bf6c79dd4ccad06a2d9

SHA256
c9be1819c28f448d8a77dc8c8df7d5329a470a0e2deef710f4d84823e1fd1a13

SHA512
8619d1fe5a2dbc2a06f1cff319df22cd4e51922682fa9f8473cc301d0aa104ff730bd2b76b1b148d58c6d404c3327401adc2536116f38c607e1755503ea57a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\O8H5FI86.cookie
MD5
a6552a10aa849273afc644cc042f00ca

SHA1
023f03501f4bd14bfa91950f5bdd188726627290

SHA256
2bd81be20ac4dcaa0762049289a7b31fa4b5b7c61af46009937101d6b97de072

SHA512
5ed6e4c7149286507b81f41fd4733d328c8ad0fd9ee07b950e7feec0bfca73362585888aad36c960a0ebe79a57835be0d09eaba4698d73301a35c93ed95d9b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\T7CTSXI1.cookie
MD5
e64e01d5269e2b4b60f19c6492007f50

SHA1
b306ec66243d6f5f20b699b63f359533e35d3fdc

SHA256
698467355d7cfd141a7578ad29310a505c162fb999690cf74295ee76792d88f3

SHA512
861280ee1fcf5a00b375337efa3765fb4e3b4fb78cf7c9c962e485f7a5a7f88ee8dc991f3027111bb6d0e804f6a57a9c14319efdc249e11649988623a91cbfff

Download Submit
memory/476-115-0x0000000000000000-mapping.dmp

Download
memory/640-114-0x00007FFDD6DA0000-0x00007FFDD6E0B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing