hxxps://0sjtv[.]mjt[.]lu/lnk/AVIAAD9kMcMAAAAAAAAAAAAf9dYAAAAABVMAAAAAABpALgBhZvLKhT4UTVthRF-etIrVKaqm2QAZU7U/2/BSuEGzUvi2tyPelWT9R1Ww/aHR0cDovL3NhdWRpLWRlbGl2ZXJ5d29ybGQuc2l0ZTQ0LmNvbS9nby5odG1s

General

Target

https://0sjtv.mjt.lu/lnk/AVIAAD9kMcMAAAAAAAAAAAAf9dYAAAAABVMAAAAAABpALgBhZvLKhT4UTVthRF-etIrVKaqm2QAZU7U/2/BSuEGzUvi2tyPelWT9R1Ww/aHR0cDovL3NhdWRpLWRlbGl2ZXJ5d29ybGQuc2l0ZTQ0LmNvbS9nby5odG1s
Sample

211013-wpedfaehg3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d3277833c0d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A886C140-2EAB-11EC-AF2E-722E034E2031} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340944085"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000005f0b5e0cda304c9a1beca67491e9b875b7426c6a544c7307f5e38ce035cb23ed000000000e80000000020000200000009b427ee954ede3c4bf5d12daa63a5f722faced9a58afc42982b2ddecc14353ba20000000dfd003a3fd1440ba1b66425edeee89536c078d1b1d228fd09520fd2bec29bb58400000002480925a93bc7fc7db2ac848e5f42705a979648e6c69904977c557ca4a310b2edcf8b75bd49d4aa75356b02db5079c612a82a36dcb625600cbfcdc5553851635	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340895500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340912094"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2468 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2468 iexplore.exe
2468 iexplore.exe
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE

pid	process
2468	iexplore.exe

pid	process
2468	iexplore.exe
2468	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2468 wrote to memory of 1972	2468	iexplore.exe	IEXPLORE.EXE
PID 2468 wrote to memory of 1972	2468	iexplore.exe	IEXPLORE.EXE
PID 2468 wrote to memory of 1972	2468	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://0sjtv.mjt.lu/lnk/AVIAAD9kMcMAAAAAAAAAAAAf9dYAAAAABVMAAAAAABpALgBhZvLKhT4UTVthRF-etIrVKaqm2QAZU7U/2/BSuEGzUvi2tyPelWT9R1Ww/aHR0cDovL3NhdWRpLWRlbGl2ZXJ5d29ybGQuc2l0ZTQ0LmNvbS9nby5odG1s
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0D6M6RJO.cookie
MD5
c8f9877599f92b31cd7dd0210ef15947

SHA1
54c95bbd784f7e3bdfcb44e197fbccff41cd8fe5

SHA256
0067566c37fbcae2eb6e8765917509843a75f5d6ba71369c00e83ba0894528e2

SHA512
2a42c6d0f17ed927181e365d3018fb5a9b6226afa321df5cbbc060f3a78b94979cead35656dde4aedb20e4e9ecaad44dcfd71fdacf418de58f3508d10597fc39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\NEG1X5K3.cookie
MD5
0fb597bbbf34259be0ab5261a3011dd5

SHA1
52bb585bbb5dfc24ff51fb85f0f5b7f9600e55f8

SHA256
6db748d5f8b34faf874ded1a8b498e1d02f0b1e113fd1a9058512619e3e4c8e9

SHA512
f7389006aad7e015f9069219d21b2f6887fbbd7c7b2e36d1b332038f14355ab6d4a2a13beb6bed6dfd677c15c2945d05c7f454751218649df395e29a328ed697

Download Submit
memory/1972-140-0x0000000000000000-mapping.dmp

Download
memory/2468-142-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-122-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-121-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-145-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-123-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-124-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-125-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-127-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-128-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-129-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-131-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-132-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-134-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-136-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-135-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-147-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-138-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-119-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-141-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-115-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-117-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-120-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-137-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-149-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-150-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-151-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-155-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-156-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-157-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-163-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-164-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-165-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-166-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-167-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-168-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-169-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-173-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-174-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-177-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-178-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-179-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-144-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2468-116-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing