hxxp://mss8cb1sp[.]k16fq3x[.]shop/zhzc[.]php?anli=maidl&v=us1633559217670

General

Target

http://mss8cb1sp.k16fq3x.shop/zhzc.php?anli=maidl&v=us1633559217670
Sample

211007-cqkgascacl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2041581494"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340354584"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30915361"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2034081125"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30915361"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000003bc8366ea82603bf014740c443ac169d5957b30d84e7f2bfe046c20a577317db000000000e800000000200002000000051349267209b3a005f68cc7f448ad11a64f460fbaae03a6fba8fb14d8dc4995a200000008baf37cd1afaa655389d027ba5052fe3ace1db91367d1b091a9f0be1a6a9fb2140000000a4fc0354f78b22d1388ee02891bff4473420c4479f521238a44cc64344dc1d513770d3128c49513dcd8701ce598d87efae2210f956a5a53372837e8c173c1af9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3078547a21bbd701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2033924514"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30915361"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a45b7a21bbd701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000f8b5d521d80bada3cc2be464125c96111c54e093be6d289ebd16221127de7155000000000e8000000002000020000000ebe45d808860abce562edf9e3922d9c2ec826bd200d724f1665b19f30c8d245c200000004f997659603d993b1d319b12c7beac4ef26ad44dd6dd819b81b9aa3002bf7cb2400000001e59485f12dd88f1f12a33d679b634b13451fb20bf6553a52aeb1506aa9dc891a91c89a6a1db2729e813d27ffb034a1f4ce54e31be4cdfd07aa47721db16cbe1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340337990"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340386576"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4A51D7F-2714-11EC-AF2E-72797945EB6C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1552 iexplore.exe
3504 IEXPLORE.EXE
3504 IEXPLORE.EXE
3504 IEXPLORE.EXE
3504 IEXPLORE.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

IEXPLORE.EXE

pid process

3504 IEXPLORE.EXE
3504 IEXPLORE.EXE
3504 IEXPLORE.EXE
3504 IEXPLORE.EXE

pid	process
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	process
1552	iexplore.exe
1552	iexplore.exe
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE
3504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1552 wrote to memory of 3504	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 3504	1552	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 3504	1552	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://mss8cb1sp.k16fq3x.shop/zhzc.php?anli=maidl&v=us1633559217670
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
dc34cc9727d7e94b8e3331515d4c51b9

SHA1
76669e23763505f37562efce970397cece194dcb

SHA256
4106455d3cc0646e27ff696ac2030db43b8291e06a33d4d5d179ef03425e1bfd

SHA512
8e858e38992c3b1b138bf3993ddfdca979bf865b032a878c3123aa232478f2e8bd5c006057387084870b02edb401fb1710d1b3c55db55278c74c548674fd4c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
a36852cff769395d9e10e8fa711401d6

SHA1
7382d1fd57a4396db24b56af1228eea2a4f3bd60

SHA256
037c1fd446e6dd5dd1a9bdcb60589192b9de3a0b2be94bf9fe295e06f1aa170b

SHA512
e0c3ff26117f392640a0c477e375823b8ac88ac36e9012454a61d1eaca74cd1a76f303677cdeeb374348b6bc5b9e4c00c4af241445531353fef71ebd22777a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MUK81QS3.cookie
MD5
f83a65c495d38be83f3b9b4347cde142

SHA1
52b5de86d7e150a8caf8a176ae9f5dc9af097f2b

SHA256
cb222b06c3589b4c08fa368ebd7c4d5ef8755b8bcab4ff7b024c3c75ddcfa511

SHA512
eb141ad3be072888b14aec33f55142c3401c2489e76f81855e1c9d52c46d1e4de5b2cc88a5080806d5ec81657f37d2e3977ba63cee0f101c013c8d01d91aad48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\XKC5RXJS.cookie
MD5
52e07782d059601b6d510ead14f58c1c

SHA1
6abfcb555c695d744d8a0977e3177cf18150d809

SHA256
31b74254b0bca9a6100f820eff8d37cdede792760ff191f85f185a222d96db11

SHA512
7d7f6fac23fc705932c30e40a85d8d745c43dce7bad89f8478c5bb13ffe3a5426d2f07696b63145807903c2d0d07999abc505e53dedb3baf3f388be9fc557387

Download Submit
memory/1552-115-0x00007FFF3F160000-0x00007FFF3F1CB000-memory.dmp

Filesize
428KB

Download
memory/3504-116-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads