hxxps://e4ff557e[.]sso-secure-mail04wtwdw4[.]pages[.]dev/?emailtoken=redacted[.]comm@redacted[.]com&domain=redacted[.]com

General

Target

https://e4ff557e.sso-secure-mail04wtwdw4.pages.dev/[email protected]&domain=redacted.com
Sample

210930-by1mtagbbm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d0000000002000000000010660000000100002000000072233a72da8788fdaac5e796ff3214f52776c674080ed7b4fad9f2f63d80310f000000000e8000000002000020000000e82eeace7ec6198a05ed5b6caec2e645b66fcc60e91907f0e44d3821476a849420000000367fae42d830cba14231993feecbdf9fb4de420ed30ba888c2c7a4c8566aa54840000000f8a4954fd7300b5f77462de59aa43f295895679f1dc8c17fecb5998db6400e9073cfb254da40a0250aee373c7bf7a4588957cc1e2633d494d841e27eb86a8d98	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1396168837"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c4a4519bb5d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913947"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1404764137"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1396168837"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913947"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000c58a5e84b8fdb09906f07fada09d1b1d19df1f364976d46237a4e389a836b469000000000e80000000020000200000004a96eedba4aee25a124ca44505ca51a55718b4b98d64167660fe7b7d85e5242330010000d564f2f1af42af49e9e131735add9c8b3f549b7c3a3c129b8348461cd7703514b9daec7ecfc043b9b9287f173947704787fd9736d32de4b299f6e3b69c5c94092e7841b464a6f216af76ceeeec365fbced402462335992caae35d739b1ee30d6c814b7fd649635b4b5a2060927098692f44fff7c2115e820d818dfc397d43d8545311ee6dd48d8e30f0cab24dd72e49734a40b8bd7e33d4553e8619c8fc36fbf25c0d290f992ffca17ff410001c570899aef5655ef07500617387a6e81bdce492d4be0dd9740354e0a279c912d2697e47c28119b2f4d6dd0e0e606f0de79be71a4799a9af456b0525648d935a000408b7184deba1986ac023065073b273601d8968ee1d207070a790679277400428afca77d617ffd7fe5920c9bc4296f6435fc6198ebc4b75dc0e9b8bf6f574574cc4540000000c8c0efe7b52898a9a30e0f6712f8782d832c69302ee3cc1ead3bef2dae957bc64dbef69f0970cd30e0a929b96b679c9f568ea2a225ef5ae1c6edbd29d1295159	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30913947"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000b2297f98da0cf1042a96c2c67e4dd0632c88a06d7998fbba491c3190570b7320000000000e8000000002000020000000459ec311bd4090e935447dafc8e4d2510c1be7095ede67525b602184151529fe300100000edf35b060898f0f829a8bece00341815c742c522ac116ac00fde3c114e0eb2a187ebed710c8775aed9fc4679f22985379f59a8d29da13d3d64c084713eb5f4974a21e6ec6ec034dcf757bd04c6108ac027ac1df5cd722fa61106734629d05ab51fcbf6ffb007e3576fd8840b342860d66e192c1dac86a467128d7cf8a73ce3e3d0c1e1239fa20fb515ad40d1a4bc6a6afdbedb9523874fc24ab63c9f8cae626e4688c82a132287e94a23bf02ee3b2cc3d86ce54ea0c18d478bc7b6d1189a4c294da16009905f66cb5bf3d7661108cb6f754df5c6b255de037174ce07d132dfdde9ea6bb378b5c6e5a5e58af5a5cf0fec2e319967c8b6d975108f83b93d70ef4831fd0644e4ce6694b2309f31097ce1768bff96b38d058e7bf85bdccaa803a3204ff22be8d941e9a50759653b920b2db4000000094754b76cb03ed6b0955a34679f565b5d8038f985a40a5d1b62475bc150009b71798105c7ba43daed3c0d4afd8098fa47d72266ba4b62e3198bb37e74868cfc1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7EA11C1A-218E-11EC-AF2E-F6E18B238CBC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3572 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3572 iexplore.exe
3572 iexplore.exe
3828 IEXPLORE.EXE
3828 IEXPLORE.EXE
3828 IEXPLORE.EXE
3828 IEXPLORE.EXE

pid	process
3572	iexplore.exe

pid	process
3572	iexplore.exe
3572	iexplore.exe
3828	IEXPLORE.EXE
3828	IEXPLORE.EXE
3828	IEXPLORE.EXE
3828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3572 wrote to memory of 3828	3572	iexplore.exe	IEXPLORE.EXE
PID 3572 wrote to memory of 3828	3572	iexplore.exe	IEXPLORE.EXE
PID 3572 wrote to memory of 3828	3572	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://e4ff557e.sso-secure-mail04wtwdw4.pages.dev/[email protected]&domain=redacted.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3572 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
37dbaf0c1c892f266bb47e267169e6bf

SHA1
186be5e010bb3b45cdcd2d3a44333f4f3af44b7c

SHA256
102fc92235beec91291f0daaa2c554c5159e5f87b51d4fe1d58446409de87a41

SHA512
b205b73477a02933260ffe313b6bbcf57c1f7971fbeaa8d08f0a67f73fb6c01204dc6954595f0ae629e31d0c8f2722c2f4bf7ceb9753730771999200c2f186b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
9f20688c661750ad6dcf06eda97f88ba

SHA1
a0c2e5929e9d6ed87ae9d555fd8a1c49cbb984ec

SHA256
325486c68075a5858c7fa3bae5e88791eaee7f42546d0436c64d9742d22eae3b

SHA512
839b542d80a961ee40effea26f4da8d85e7a1e06e76b5462ad71e853e9554fed9bc1011c3bce03f60a1d5844cd09c194923776507d771a28c8ae47482dfebec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
9cc2e6fd60d309e12eaa8010906e6457

SHA1
0d0bbb2ab8a4ca72e404df2ae248c062c8a18837

SHA256
7fde1d271b5c7041b9eaf8cc84b8514def47650b29cf065b0ca419faac14c099

SHA512
5d03e6d4eb7e5a5dca61524cca22d1ebc5ac03102973b5ee500965bd7b15a020b32396bfb4435b01529eb1db8672a4067fd4099a2adc12e90b261f727c0d3d5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
5c918812e55f0220292b7d22e262db2e

SHA1
00dabb67a66a2ba47cac05e00c34788838dbd627

SHA256
a8b544517ae665627d0d33df0fa5e8534736dbac16b75eb0907cf2df5203e20a

SHA512
be180fa630b8bf9d2740ab8f3a03c43f1e2ee6ca3ad41c11cfe9690fab9345476c207d88730dde53e19ec954177a110809453e947d6477a150b45b15a79c9ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QT2UOKDP\QEO691KK.htm
MD5
286ec32a447b0ea3404c4c3df32dcd03

SHA1
910fba7d799a881ccef82f0656ef07f5f9cd984b

SHA256
236c077bc71571633689df6780986079654f1b450c332f5de3d25eb5ef40e9b8

SHA512
5f58f5e4d50c2f112b4871b65e221495ab765bd9ab574e178397faa4b555fdabebc877897b31a792279851f0b2814fc2f37180dbcdf4a3a1f3c2988e20661f88

Download Submit
memory/3572-115-0x00007FF9961A0000-0x00007FF99620B000-memory.dmp

Filesize
428KB

Download
memory/3828-116-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing