hxxp://hillmag[.]xyz/

General

Target

http://hillmag.xyz/
Sample

210930-3w5mjaafdj

Score

6^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1052 1996 WerFault.exe IEXPLORE.EXE

pid	pid_target	process	target process
1052	1996	WerFault.exe	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339818169"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009de89b7900ba624bb13c15be4d9ae83500000000020000000000106600000001000020000000b87790a1a68f6b61c07a554ce213fbdc738ea0c6816ff48d81a15f6a3589fb34000000000e800000000200002000000072beae1cf921f64e9a004c04ebd868f5d03154fd2001cce32e59ffbc32073a5890000000c36238b42a5b8855bbb23f6253f24dd49610b3bf0935ba1ef7591dd0aef638585298344688ed2e4b56ffd97c0a01dde81b8398e1a8bea26cef1f5772a5564d1a871885f5a1b50205dae01b055583f2d8a4800803a9d991b123fa5c43e9244cb1f1fe46b1dcefa182dc837427ece86b9d053d5e95f4fdbb07dff0ada55483b06989660079ed3a22f84d21654fb4d2493140000000ecb105f6dbd06939399b7fadfe53af3971c4635f8b8cd2a61ead64f728f092a01409874e6a67aa94b101dfb2c7c89ad41838eb8f95b45d832b6fd79207f832ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55CE0991-225A-11EC-AEA4-C2292E95568B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f048b42f67b6d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009de89b7900ba624bb13c15be4d9ae835000000000200000000001066000000010000200000000b2eef4d99a33a2ef51f3bfc1fd90785c73c9d0a988cbe7c5c4e3de008e13b1e000000000e800000000200002000000065002e7030e3f94609677e389baa1d2890ed52df2452a2a676f719a7b400170320000000a4b8ce1ad7e4517a365fd09100a825f98d730e674fa9386fb7cf6689df5779604000000037c4ea8b8cced6474a4a3b51325485c189c2b13f532decd968d50a82910fbf46ad74fc1f2a939e30da6c7560cf4253ab61877884eb73fa12bde650bea81aab60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1052 WerFault.exe
1052 WerFault.exe
1052 WerFault.exe
1052 WerFault.exe
1052 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1088 iexplore.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1052 WerFault.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1088 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1088 iexplore.exe
1088 iexplore.exe
1996 IEXPLORE.EXE
1996 IEXPLORE.EXE
1996 IEXPLORE.EXE
1996 IEXPLORE.EXE

pid	process
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe
1052	WerFault.exe

pid	process
1088	iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1052	WerFault.exe

pid	process
1088	iexplore.exe

pid	process
1088	iexplore.exe
1088	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1088 wrote to memory of 1996	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 1996	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 1996	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 1996	1088	iexplore.exe	IEXPLORE.EXE
PID 1996 wrote to memory of 1052	1996	IEXPLORE.EXE	WerFault.exe
PID 1996 wrote to memory of 1052	1996	IEXPLORE.EXE	WerFault.exe
PID 1996 wrote to memory of 1052	1996	IEXPLORE.EXE	WerFault.exe
PID 1996 wrote to memory of 1052	1996	IEXPLORE.EXE	WerFault.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://hillmag.xyz/
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 2352
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
a4cce08b623ecdb77857cdaa1747e70d

SHA1
655115d30aab97e0f7c23612b3f3b0d1feafc06e

SHA256
05f1fc255f3633b63049bed9652367827c7bf03d4d08d1480be6f4b34dd21c35

SHA512
148c7a111f68bab048fa4cb39427cf859cf3656996f710472c5d91f8061d164c88eee2df3259bbe9f050b828ebc44f3301d09ac0138c8264a1432d06e55ba394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
2d8fc792a9c4656d907dd38a8f0851f5

SHA1
2c8d83ac4012244896398993f4598666c9a1c168

SHA256
da0353c4d2f4e67e72f66ea82a5c346f6df8db64b96c13b587bdc21fb010cd7a

SHA512
684c57ae6a91a5a2bdb2787248b2567ebff9d015d4f14878d84708021a6594f70c71fe92a5cda0bc98906d2eb022eeee57aa254a5b2d8bff44a36fdffaea6ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD5
49e0cf67f5d7bf712d7f2fc46cb8eb23

SHA1
6de12f3e6b63c3236678243881bfef1254d6e7ce

SHA256
f0f4755ee8b1260515fbd0d5587becde4fe7eaa2bc0ec159bb7b7847f2833afc

SHA512
5af5372b4b400c182b0c27af37a92a2e02013e641f770794da5293b0e6a3ea2b0f0145bbc2f7fb2ebe768ef392a04564a8a56bc2c6c6fe92467788a8049f8f25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EM1YUI1O.txt
MD5
8199a9be51f6772e1be6a6366c4ef5ab

SHA1
3eccff44bdd1d786cec88e602316a0dd6eba5ffa

SHA256
00581321c7d7d5aa8bb61422d8f471194bbf99a5b1c044e83581c3ed0cbbac2b

SHA512
fe2f38039df10b83f3a140fd2667a6577d3e9b57f63ae415f05e94bc6b46776ea2d0bd8a909ce10607533e47cba4fd6c53470c42bba46859790c24bbd353bb5a

Download Submit
memory/1052-68-0x0000000000000000-mapping.dmp

Download
memory/1996-60-0x0000000000000000-mapping.dmp

Download
memory/1996-61-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing