hxxps://6207096785619137190813056382554851545916[.]page[.]link/NXWoVeUVL4ypeWJr7

Analysis

max time kernel
119s
max time network
144s
platform
windows10_x64
resource
win10-en-20210920
submitted
14-10-2021 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://6207096785619137190813056382554851545916.page.link/NXWoVeUVL4ypeWJr7
Sample

211014-3vw9rsbbbn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000910c97535f95d4364b98299fa2b7bc230801ad7906fd7e296fa07e19ec7a0c8b000000000e80000000020000200000004e969b456ee7daaeaa5bd290abaf76d3d80fdd520c5675bf6e150704e135692a20000000d227e521231829774ba66fa449c36f5368f30d8527f8e013809043351180f781400000001e04f9e0f2e0c067bbf05ee3b41a8e3776110d41d144487525261e4e6b23d83fe4f7be397d186355b4f8c70fda5ec620c6ae48c11c534fde9c97e6b9cc4444f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d8645c56c1d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "341020438"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13EEFED5-2FA5-11EC-AF2E-D6FD385E2EB3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "341069024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "341037032"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2432 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2432 iexplore.exe
2432 iexplore.exe
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE

pid	process
2432	iexplore.exe

pid	process
2432	iexplore.exe
2432	iexplore.exe
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2432 wrote to memory of 1292	2432	iexplore.exe	IEXPLORE.EXE
PID 2432 wrote to memory of 1292	2432	iexplore.exe	IEXPLORE.EXE
PID 2432 wrote to memory of 1292	2432	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://6207096785619137190813056382554851545916.page.link/NXWoVeUVL4ypeWJr7
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
06f9941ca26951e04e120cdc2852d6d0

SHA1
10e87d65a83d2bd278d589bfabf5e58cd77c3b98

SHA256
ff7015381806fb12a7820ebd293c575d74c7793ee32624e77221f3b79465ee9b

SHA512
056e10517e46df75d894dcb933fa6f97c8b8407d9854897007038c4118f2fd06412e38ca6cbe8a39adc465bf34f543517c109d44c8d6248cdbb4330d2ba87abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
64e9b8bb98e2303717538ce259bec57d

SHA1
2b07bf8e0d831da42760c54feff484635009c172

SHA256
76bd459ec8e467efc3e3fb94cb21b9c77a2aa73c9d4c0f3faf823677be756331

SHA512
8980af4a87a009f1ae165182d1edd4ccbd12b40a5890de5dbaea4dbf3aeb86edffd58b088b1e35e12d6b1197cc0db658a9392283583b3cb24a516ebc1f736c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_3674EE7A36D4FCEB1723FF65E35B9E6F
MD5
c63f0f2390d546b83ab57f363ea54c34

SHA1
af48a89986f6d2ab037d636624dfd1dd5a32cbe0

SHA256
d8bd9554c71d97afd7c660f4465e4782cc8225b946b1b635010f6ca63cddebb1

SHA512
bc059e9aef62528a41349df8d9e216c0662151b956b3694e4f02ec6d99c823b5896f7f7b7735d01427810f37f9492618f15149af2dbd2dff3e38ccd0112863e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
MD5
12c8fd8739b27e33f24ba5520ae1c98a

SHA1
7404cdc2e0bc0610a8a8990d3b639559214c6fe6

SHA256
792ab98b983cba498fffbe423199c9a6b4d5c4c1e70db6327d5cb886fc70e8e8

SHA512
cdd755515592bfb319158bdc98b96eb71089c8d14d76d1f054aadf7f9ca4bd01d4dd95618b7347679d55b9d5ecde50c83fb31ebbffb590c01c9d03455b9be4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
MD5
0289eee6f3ce35cc1b8a31a36a55173c

SHA1
bccae013c2c3a6404830bb7d8ac34a1522c6b7fb

SHA256
3f224fd9454b871f54218ffa8e873adf851619cc755fad462baa1ac5d584686b

SHA512
7e1aec5077dd97d7d4642486bceb5c985c135cfdaaa12d36c78773e71e0a63b18f2f0264fd6e1e833463d069ee2a8174186f9a23bd1e59274aa49770f94708fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_3674EE7A36D4FCEB1723FF65E35B9E6F
MD5
8157fe6e801d73e26e49b6490c5c149f

SHA1
ee5697e57eafdd6dc8211f3038e07956abfc79e9

SHA256
f6cf07e47996aad0f15cf315c9c6ab6cbbd091983a72492fe9b029504ac792e6

SHA512
51901dc4f89d543787857e8aedb95ea0a0cdb94b9d457e50caad9b89f774f46e31d11fa5266155b7cf330fe892140df60035a91161bc16bb60a95fbf5543cb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0526WURP.cookie
MD5
9e986289f8f2f75d10eddf0474f94a48

SHA1
218958459dc60587bca6b5dd775bc6660e4c094e

SHA256
f298be29c6c6020ea3b7b5762e8717734aa09a7ec17035f4e0e9ad4b54d8be9b

SHA512
c113e7d368f2054ce9950bb59ceae768d7f4635e9566a459dfdf2ad9142c932acea9b570baf22bec4acec05353ed7e398a9e5133168123810baafd8ce93cf493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7N4H019S.cookie
MD5
24535d2f67e2ec1b34fbbfc281d72bfa

SHA1
f04da5ae21b820b205db3fec2581669d0ce8d686

SHA256
10beddfe867626752c93d0c138a2b711ebf162a95574bf5ab9f0c692e0ef94e4

SHA512
1307672d22d7361aa8ae6a93d6e110d0ce8eb9cfa061435fc0b124e592878ea4b3a967e96894bdb21be3f484c51fc40d278cb027ca1693ad37103a36b78948c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\TOKDRYE7.cookie
MD5
89d79a24a32d2e3bcdb60f4445728458

SHA1
b467a1792277f9674d0e50c3c5ea065c9ea9835f

SHA256
b3b0e97f4699bb06b224c6302763437388f3ef4fe8f1547d044f11e4535b9532

SHA512
5c94c45c7ec20cad7431a8cdecf580b8669ae0c896f6fb062235b957849996d4966f7961ce83072bd615fc9751e582bcc0ba4245cc500322dc1ad1d7461e4e2e

Download Submit
memory/1292-140-0x0000000000000000-mapping.dmp

Download
memory/2432-149-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-157-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-129-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-131-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-132-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-133-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-135-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-136-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-137-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-138-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-127-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-141-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-142-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-144-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-145-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-147-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-115-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-150-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-151-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-155-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-156-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-128-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-163-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-164-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-165-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-166-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-167-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-168-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-169-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-125-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-171-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-172-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-175-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-176-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-124-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-123-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-183-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-122-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-121-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-120-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-119-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-117-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download
memory/2432-116-0x00007FF939B60000-0x00007FF939BCB000-memory.dmp

Filesize
428KB

Download