7aa6f5034f66394bec9d7f6b91bc3561fe18f3ee724b73456672f80aa6d8a4e9

General

Target

test.html
Size

56KB
MD5

3eb461097e8ce9042f5ab4110845fef7
SHA1

bc66662b79302d508ac99015c0188d5e47858782
SHA256

7aa6f5034f66394bec9d7f6b91bc3561fe18f3ee724b73456672f80aa6d8a4e9
SHA512

96eb66ab6afff48e8e85e77f52a217844658ea298eb69ca3e6d42b9272e5c2327fb1d81d43739be8031d4ac786d67d04820f711b3aa104bba6b8d8fd0d9193f6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340904266"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "111075469"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f03ff847c0d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340920860"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30917396"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F027175-2F07-11EC-AF2E-EE29200C20B6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "110918998"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30917396"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000145ad3241a1b56bad25e514befacd43c1b44c1db0bafebe407e3fd0fd02e7ee6000000000e8000000002000020000000246bacdd1ab32ea3ac25e358aa5cda34716bcba6f932b60049a6f35224b153d120000000d82f26a22a792de25a3cca024c51cff07883fb5d6cb5cd062a69d5a67b7d188e4000000070490169718efb4e78b549e8ac978ba652f43f2db519d0cfb8e21a7c40ebc88d8a363279969c3675aafa97723953a7a0ce506b074fc7c0ffafd5ce7561bad13f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40151cf847c0d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "165450409"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30917396"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000003407aec62c734dc75ad3a931befd9d50a8a432de6c3900e66799afbdfb4d458b000000000e8000000002000020000000c304a0a8095f5f4b6b503416028c5a271ae405a28062daee50c5b18299d69183200000005daef1e08fb1ad9d2fc05bbad1fb2d012c70eb7bd04cada6eaa875ec3142aa3240000000e2a369f29e51d95b528517a54d7eca4266e0380efb149a125c31fe389c9be1bba18533a70042c4c3099dfb84a1e114ef646878788db6ee7f7f467a80f81846d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340952851"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2428 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2428 iexplore.exe
2428 iexplore.exe
1216 IEXPLORE.EXE
1216 IEXPLORE.EXE
1216 IEXPLORE.EXE
1216 IEXPLORE.EXE

pid	process
2428	iexplore.exe

pid	process
2428	iexplore.exe
2428	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2428 wrote to memory of 1216	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 1216	2428	iexplore.exe	IEXPLORE.EXE
PID 2428 wrote to memory of 1216	2428	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\test.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
0e7076d6b1e84aa724a64a4be6cbf7cc

SHA1
bc48c9a6ddbeae7ed1b9a6f7a5d98838205ff6fa

SHA256
4acfebfc4e9624bd192b338789d23c58deda34aa8de8db5a82163a38f818d0d7

SHA512
5f292e3e95eb259aacab30d9d2e6c1f1d7299b7de0a90e9f10db7d14f43035bf8c007190cdd28159ea6adfeb70f8086c79ab7b8ab4fab3593d30020f51f4c358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
9777312a01f8174393c91d2590c3aaf9

SHA1
b50731f813e035fc29d69063316ea7f361671006

SHA256
6f0d8826a0c8d0d31e842aa29f769e0f3d42a32972ff76ad618416a170909364

SHA512
e5f964497911cd44b1bf2e1aae84a0b2b44c49ebcdb51f591cd521e01f15152b1a33f20249a3ce640fa7270c6de0e678ffde008d9ea078ecb4f76100b6269d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\P5JILURT.cookie
MD5
9c6910f3a5b409a097725c55b28fd407

SHA1
17e0bb9adbd289b6eee4a1c5f173c9c2247ff65d

SHA256
68448e23728225e364d28160e399c6e63e84d1ba1e082c6596775f476eecbb73

SHA512
98204aa964c4f8271a203199054c8eec9457a8a356aef2fec817acade540fc1e36b1f95e39ad29765eaa068594971987c789e14fff002b2f69f526744bd17bad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\S4ZY4W7X.cookie
MD5
b9617459c8153254e4cb60a93d2f76d4

SHA1
84fabc124de21fb50e58dca639c6f0dcd85863cd

SHA256
46535ed460de46672a7f34060bd76c201603389379c5549633efe35eb73156e0

SHA512
bb3d6701a3f59afed002c87960244352017c3f279012f283e8be1817c20c6fb07f3232d5560743aa4377438db01988b3bd8f0e46aa8b69574c06d0c6d411c42a

Download Submit
memory/1216-141-0x0000000000000000-mapping.dmp

Download
memory/2428-143-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-150-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-123-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-124-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-125-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-127-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-128-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-129-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-131-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-132-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-133-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-135-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-136-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-137-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-138-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-140-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-121-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-115-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-145-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-146-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-148-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-122-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-151-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-152-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-156-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-157-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-158-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-164-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-165-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-166-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-167-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-168-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-169-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-173-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-174-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-177-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-178-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-179-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-120-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-119-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-117-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download
memory/2428-116-0x00007FF9AC260000-0x00007FF9AC2CB000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing