hxxps://f002[.]backblazeb2[.]com/file/balaghat-unaugmentative-ureteropyelostomy/index[.]html

General

Target

https://f002.backblazeb2.com/file/balaghat-unaugmentative-ureteropyelostomy/index.html
Sample

211008-zahdbsehek

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340504054"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f7a24f81f47ed94eacee13386d7c4add000000000200000000001066000000010000200000002f4cc9457701415b8457f5b8e6e390ecae35a909b6d81329b53d902ec7b51bcd000000000e8000000002000020000000de21f773f73d97aa104481dbd9a4ac1ac66ec46355fb73ff502ef23274836db3b0010000e058c5d91cc4e84ba4cb1a2d4befa079a26a395dd8faebcb55032f5c2f9c60bfc702d357662762d4d1bfbe7f09b0f96891a51c06e5f7ae64efef3cc81ab3f9f51474b992aca59921609094138e49e36e7b1e5f3fba596f3aceadef157783f114ce64c86b7aa6889cd166aa4f0b4b0c6e253b01980500cbf0139e6db722726988dd144513c089b6e1709eed6c575da2857b46b35c2420cbd62d35fd11d980cc7fc59162e59c41241a103c01016a4aef5f4d80eca0179ddcf5ff77dbc819425ffe32e8fcf97d91c1c464664761b8199a482b2ff42e0f43f5908180be37e2d9ebf586ce13a121ff27bdc06c1428453efc92d17335040f3c2676b70d8c99c0a312823a7c04eb084998cd7bc364c6c62d5eb2898c49b2fce1cbc6089735cd66ff2efb660450d27c9c500e6944b55663163d15935879a182490a8694524ab0f504bbdfc51f43a747d78d313bd97490449d20f09f72b47d73b0675710a32f23e1ca11351d321fc1d2fdd840c92d53cee2117988bc72e37ae30b24ea43a2ea5ec34bf317c1ac9289bf8fcd80e929c393f66ae4d01ff6c775e2d67a2a3fa426d02bbc9cdf7cd46bca7c48157fc5c9a8fbc67da3ce40000000bf00b2e5e5c9e7a3f0c24e7d5fa58b39acee1b4b0296b960bf19da6ec25fb85388cf30a00997d29a62ad7364d85ca6d545ec6d4dd9ac488bc97348750e2ac215	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E11949F1-2AE2-11EC-B2DB-5A4A21AC7400} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f7a24f81f47ed94eacee13386d7c4add0000000002000000000010660000000100002000000098685fa0902867a1152a6267cf51ff99c8ed345b5ca317153503bf8820ddc6b3000000000e8000000002000020000000539e760fd59dedeb1a886ef36de734094abc5ef935715388f55ee086185cf52320000000f6c040d36e4560e702c8c75952fc6d17b7d91ac736879b01b9c757a60f46468e400000006b00514658eee015f27bccdd295807742346a7c7858739c9f81fdb733eaeea05ebdcf49242d6f65241d0bb0330a02917ac55b9c060f63fae3b4b068858387ca7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4292163968"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340455468"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340472063"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30915634"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502b400333bcd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30915634"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4292320341"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

656 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

656 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

656 iexplore.exe
656 iexplore.exe
3948 IEXPLORE.EXE
3948 IEXPLORE.EXE
3948 IEXPLORE.EXE
3948 IEXPLORE.EXE

pid	process
656	iexplore.exe

pid	process
656	iexplore.exe

pid	process
656	iexplore.exe
656	iexplore.exe
3948	IEXPLORE.EXE
3948	IEXPLORE.EXE
3948	IEXPLORE.EXE
3948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 656 wrote to memory of 3948	656	iexplore.exe	IEXPLORE.EXE
PID 656 wrote to memory of 3948	656	iexplore.exe	IEXPLORE.EXE
PID 656 wrote to memory of 3948	656	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://f002.backblazeb2.com/file/balaghat-unaugmentative-ureteropyelostomy/index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:656 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
54e9306f95f32e50ccd58af19753d929

SHA1
eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

SHA256
45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

SHA512
8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\65D3B76E6D5CD07FD87738B1551F1A53
MD5
8fcd3d3d6f6c591fce102be652986c55

SHA1
96ea201b688a7ce48c4ee41d6c78d0cb38f2030b

SHA256
55ac5bb3b823446f2b08c94a97c17258f1da6db07c004058fa17f6b7d4ab8d8c

SHA512
19724bc08931e2ce0dae7871e41f1014de0696f6dcd0f4dff38ef9622c143d3705d4420a131948e3af72e6a4debdd9b209a543e92cfd52c88f5399301e858121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
8164e94e470b3ca863a2f09e7790e301

SHA1
dbcc87a391558dfc9148165c5d3d3713e2f99eea

SHA256
3f5866721f37418ce50ad61b99f798e5e600311350e9514b8d0e8d3f6dbc878f

SHA512
640ad2e5b36264b3fdd7b9441b28dc824f6a31a2ec7a9cc1deec193fa9a8465559a17ee30ba9072e1657e283162c1e08d21f67a2eed4009966f37b3f7b86f847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\65D3B76E6D5CD07FD87738B1551F1A53
MD5
444989c6e4276c5b1df1c59986740b7e

SHA1
0d190f9af2ad29ce4d25a630ab7fcfbbf76a3ed2

SHA256
9fcce1a83bec105a99ee0f4ac1d387dda77d850848e3a2f5429db6db46e9eeac

SHA512
b73c27b178a97c26d0d9123c917940923c5f21d83682b9c15a462d61a294ecbbf860208bdf9dc87a09d80934f49307458298364fe09e020147e1caa9dd7e4012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\86IIN05K.cookie
MD5
7947b461a860fabb325e14281e1e2d25

SHA1
9961c5e432bd105a505aaa942173936312081a7f

SHA256
d1420d2aa3efd5aa847ee334a0a69be462f5f7061ee735c9ec470ba2a767a41e

SHA512
7acf184dcac21526e54b80a8da851f65c908e20629d16b5df0f7bc188c6bf62750f44227e87d91f109f32a1515a787e50e69a0a1685d7ad041de4e5e2257e9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ZKXWK2HW.cookie
MD5
1f7a3900dd13bc6765277eea6b514852

SHA1
c9f5c0a36101160cef2839410a6f925c91ad07e3

SHA256
19cbbaa066905a6bcf8dbc35ccb8dd755b2fe63b5456fe95f74638543584768c

SHA512
d4157a230997284547c87dac615ef68c5618769e62054f32122622e1b71a539845cffaf954ab2453a2c1b3daa24c8755ed7138ae441e5f9167b22d657d4ad91a

Download Submit
memory/656-140-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-148-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-119-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-120-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-121-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-122-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-123-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-124-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-126-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-127-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-128-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-130-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-131-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-132-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-134-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-135-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-136-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-137-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-116-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-141-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-143-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-144-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-146-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-118-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-149-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-150-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-154-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-155-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-156-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-162-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-163-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-164-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-165-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-166-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-167-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-168-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-169-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-170-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-171-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-114-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-115-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-174-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-175-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/656-177-0x00007FFA908A0000-0x00007FFA9090B000-memory.dmp

Filesize
428KB

Download
memory/3948-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing