c72289d015d5661eea3043a76d53c92e72b164527468a3b547fd3e8585fc1cdd

Analysis

max time kernel
239s
max time network
266s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assets/css/fonts/linecons/font/linecons.xml
Size

33KB
MD5

34af242ca498bf94203e488bf4479e38
SHA1

b8fc297d3365d2b88bf3333e775b6bcbca5ae6c4
SHA256

e49207904a51c3b2b13c42e27289219986ddf7802cfd3ed902d721808bfc0179
SHA512

341868024e240742a7088cb9e7b5c4adbfdfe5f3c8022903987faba3f167bcac4794221eea3b2128044b10ae16171e75f16b13cd9aa793636c923fae60ebd54b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359806448"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000a6f81cb64d77db3135555667f1b6b6f36912870528314793d7cc1b06b5590a12000000000e8000000002000020000000f8a2cf5d26560f2ee99dc33ee8f22d6edc2544776227fbadb77b99996ad8ce5d9000000053840a6eebd746fffcd8b25299e8d429f90bb5f80ebdcd29864fde8b7103fda180ef95c4743d90e47a32071b81cb39d51e0db20ef754f55f6a9c13983e9dfe42bd0deb682000043ccef0a6b8963b7f6e26aeeb56618aed6348cb9340f1962ba0d359f65f30bcb7dfe46faef9174a32282c9a840b13d9798da0ca3cd6d705ddc4105cd6f9e84a066bbac8de78f0cef3a840000000b8eefdc3846c4d23f61e67ebbbdb05f000c3e8741a2274244c29442631e8f8b1cab0d52f18a58e6162a42aea4af2b7abe486db5fa58526b49f4fe13030bccce0	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b67f05326cd801	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd4000000000200000000001066000000010000200000000026905258bf63b3e3a9a0214934ba4686ec2dcae1c8cbab3a9471a51e8dbc7e000000000e8000000002000020000000993c40d47013467d9793307e6d8bfb6c4a4a8d818ba669a76414a3a6026d5a0a20000000559dc0560db158b57d4367a75d329e6628cd29d279b6ea57efa564d53ef2c06240000000853aaf5b6f41652d997283db2d298647ae1b445a5038ad5b895a8106cd494e7d8b982b59d1418248f26d29813c0b34ec91f07185a26bcca45144d56f25c89774	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28DBECF1-D825-11EC-8B7D-62D05D50A506} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1832 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1832 IEXPLORE.EXE
1832 IEXPLORE.EXE
680 IEXPLORE.EXE
680 IEXPLORE.EXE
680 IEXPLORE.EXE
680 IEXPLORE.EXE

pid	process
1832	IEXPLORE.EXE

pid	process
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE
680	IEXPLORE.EXE
680	IEXPLORE.EXE
680	IEXPLORE.EXE
680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 952 wrote to memory of 1180	952	MSOXMLED.EXE	iexplore.exe
PID 952 wrote to memory of 1180	952	MSOXMLED.EXE	iexplore.exe
PID 952 wrote to memory of 1180	952	MSOXMLED.EXE	iexplore.exe
PID 952 wrote to memory of 1180	952	MSOXMLED.EXE	iexplore.exe
PID 1180 wrote to memory of 1832	1180	iexplore.exe	IEXPLORE.EXE
PID 1180 wrote to memory of 1832	1180	iexplore.exe	IEXPLORE.EXE
PID 1180 wrote to memory of 1832	1180	iexplore.exe	IEXPLORE.EXE
PID 1180 wrote to memory of 1832	1180	iexplore.exe	IEXPLORE.EXE
PID 1832 wrote to memory of 680	1832	IEXPLORE.EXE	IEXPLORE.EXE
PID 1832 wrote to memory of 680	1832	IEXPLORE.EXE	IEXPLORE.EXE
PID 1832 wrote to memory of 680	1832	IEXPLORE.EXE	IEXPLORE.EXE
PID 1832 wrote to memory of 680	1832	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\assets\css\fonts\linecons\font\linecons.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HVJH83O0.txt
Filesize
599B

MD5
99ffeaf8afa4109c87cbbdeb97905d47

SHA1
847a2730293f6ed2e42d5e7449835b64d4184f05

SHA256
9da6353e0b4099723df543ac5500a111c725869f8376fa1d1f86e3a141d3c30a

SHA512
4afc15da111fa64ac71f43d61320fc702197a40e76ed71ccfaa9e259cbec992806038117d91e82ed2ede2af7c4d6c2ed45e68db7603d9a455a4be0555a43e6b4

Download Submit
memory/952-54-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download