hxxps://ia601406[.]us[.]archive[.]org/view_archive[.]php?archive=/31/items/huio_20211025/huio[.]zip&file=huio%2Fbishpfrnt[.]html

General

Target

https://ia601406.us.archive.org/view_archive.php?archive=/31/items/huio_20211025/huio.zip&file=huio%2Fbishpfrnt.html
Sample

211026-sfw1cahgd6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94572E36-38C9-11EC-AF2E-722E034E2031} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "342006422"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d026d41a4ecad701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000001ae0066f3e1c9898a6b92c0d238aa33004000423b226ac085b5395ad43e8c589000000000e8000000002000020000000a769b21a7f3ab06288eaab9c6600fd3fe931342293046fafaf1dcba487574258200000007392698f012d884edcc084b7e5307dfb216559180ab3b8cc4498d9e18df9deee40000000609a3dd9401559709b444c816f779780c8896d85dd1eae72b1f008cf6dd4d63b9cf9cc31f5b343c0517b17b04e90221f5084a9c1f225fc180f8b0dc2403d279a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3090ab1a4ecad701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "342023017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000da69437a42edb3cb7b914caa810010a0af555b7b1e5d611d3f4b3aed9f4059c3000000000e80000000020000200000006bd434baf0baaee50051cbf726351c778db96cab16880d4180b116ab0f833e0a20000000185a9f33cd896b93c184917a9643dae190a252a78be74e4c6135c8a68dfb6859400000000f4afd7488e1f9d2c4f3594d29d5d80d00c65ff926ec00a4d5814d08e8b148571d6052c8cab0b60b22be04990fce89ac82dfa3b72fb182ad5fb2f3845514541b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "342055008"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2512 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2512 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2512 iexplore.exe
2512 iexplore.exe
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE

pid	process
2512	iexplore.exe

pid	process
2512	iexplore.exe

pid	process
2512	iexplore.exe
2512	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2512 wrote to memory of 1972	2512	iexplore.exe	IEXPLORE.EXE
PID 2512 wrote to memory of 1972	2512	iexplore.exe	IEXPLORE.EXE
PID 2512 wrote to memory of 1972	2512	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://ia601406.us.archive.org/view_archive.php?archive=/31/items/huio_20211025/huio.zip&file=huio%2Fbishpfrnt.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\IC3SJIGH.cookie
MD5
662322a102078c4b939a765913ef80fc

SHA1
efaee3f155e3d5ddad5f9b8b40a77650ee5fd021

SHA256
aa214029699098b3143bea01a0d21c6eed116bb54439fbfc877d28929c7ebf24

SHA512
a33ec3351b46a208c30dd96bfce7d00d31761cdff3813be7aceeb4c20ab3c107b21f8f0a4092c6dbab0661aeec75bcd4edb001ebcf7242d86bcc2def9e7e0c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\QUM6KXNM.cookie
MD5
8982f09d1e6c4d66b2245fd7f5fe6e0d

SHA1
97f8f1cefe948b35c65a2a3784f85a7f5a05af34

SHA256
bf1c6d1c8257cd31ccf8ce44b481d2b5650230190009508d79bfd84340abd6cd

SHA512
0ca76bdd60812c9fccc18bfc178a1c5bf1df26a1590e27b788ca66e9dc34aa791a6b8030dfe3cc1eda4c80141f770f27038a752205fe407da0555d056177b4e4

Download Submit
memory/1972-140-0x0000000000000000-mapping.dmp

Download
memory/2512-142-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-127-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-147-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-123-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-122-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-124-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-125-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-145-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-128-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-129-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-131-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-132-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-144-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-135-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-136-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-137-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-138-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-119-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-141-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-115-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-133-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-120-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-121-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-149-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-150-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-151-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-155-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-156-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-157-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-163-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-165-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-164-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-166-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-167-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-168-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-169-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-173-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-175-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-178-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-179-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-117-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download
memory/2512-116-0x00007FFCE66B0000-0x00007FFCE671B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing