hxxp://t[.]email1[.]samsung[.]ca/r/?id=ff1b346f,303d531,303d53e&p1=8107023398&p2=8107023398&p3=DM15290&p4=hxxps://adx[.]g[.]doubleclick[.]net[//]pcs/view?xai=AKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw&sig=Cg0ArKJSzPyCsO5VugncEAE&urlfix=1&adurl=hxxps://storage[.]yandexcloud[.]net/sign-ulc9xn31wltys20mume8auhn798b4beueir9xqpf6nm/index[.]html#benjamin[.]hymans@pod-point[.]com

General

Target

http://t.email1.samsung.ca/r/?id=ff1b346f,303d531,303d53e&p1=8107023398&p2=8107023398&p3=DM15290&p4=https://adx.g.doubleclick.net//pcs/view?xai=AKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw&sig=Cg0ArKJSzPyCsO5VugncEAE&urlfix=1&adurl=https://storage.yandexcloud.net/sign-ulc9xn31wltys20mume8auhn798b4beueir9xqpf6nm/index.html#benjamin.hymans@pod-point.com

Score

5^/10

google phishing

Malware Config

Signatures

Detected potential entity reuse from brand google.
phishing google

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "360849068"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30963117"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce10000000002000000000010660000000100002000000009b798d6be9673f55831b59672da30aa0108522a6f5bc91c26668b4e411408e1000000000e8000000002000020000000ec9f49e346243f4ab209358beb623eabf35ff330d85ef81bff1f1b2e2c3bbe5320000000e911e236b28999fed373821c0489aaf2afdde4e2689b8b8bd4c91ec5e44a768a40000000f4325381615ec8ff7c77ed63fb02a19ef655d87384891d28ab60642aa4a3f436775047ffd1ae1350c6b676d83d6f78f00cb680e0ebfb94bc3b5de06d3f9bef99	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce1000000000200000000001066000000010000200000006b1464b362fa519605f8060bf44ea616753ee2c76cd7da0ac8bc65b380eab833000000000e8000000002000020000000e74f152d397ef22b6a4a0d8bb52e9af52b312499a34f002a8495a02fe46e1fdd200000007e1487b93795231dec8c38600d7e2a7da06d05c07d15b1523318d6881f318a0c40000000defbf5682931fc2c68a314f9d565959ac939d37812869945bddc9714a8bb747658f705e0925897bf54b6a0d6c010b5d9005ea19a0de3fc98a34a481df13df453	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2342980283"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30963117"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B74820E5-E1A0-11EC-AD90-F23C9496A3E7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405d098ead75d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30963117"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2355637036"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6076fd8dad75d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2342980283"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

4180 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4180 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4180 iexplore.exe
4180 iexplore.exe
3424 IEXPLORE.EXE
3424 IEXPLORE.EXE
3424 IEXPLORE.EXE
3424 IEXPLORE.EXE

pid	process
4180	iexplore.exe

pid	process
4180	iexplore.exe

pid	process
4180	iexplore.exe
4180	iexplore.exe
3424	IEXPLORE.EXE
3424	IEXPLORE.EXE
3424	IEXPLORE.EXE
3424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 4180 wrote to memory of 3424	4180	iexplore.exe	IEXPLORE.EXE
PID 4180 wrote to memory of 3424	4180	iexplore.exe	IEXPLORE.EXE
PID 4180 wrote to memory of 3424	4180	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://t.email1.samsung.ca/r/?id=ff1b346f,303d531,303d53e&p1=8107023398&p2=8107023398&p3=DM15290&p4=https://adx.g.doubleclick.net//pcs/view?xai=AKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw&sig=Cg0ArKJSzPyCsO5VugncEAE&urlfix=1&adurl=https://storage.yandexcloud.net/sign-ulc9xn31wltys20mume8auhn798b4beueir9xqpf6nm/index.html#benjamin.hymans@pod-point.com
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4180 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
bbe91d0029e4c88e8d37ab6c6a7cc8e2

SHA1
2e74912104fd22ce4d72634ba7b5119026e27da7

SHA256
b3fec3b2e7495c3f65b5ccedd5f10eda0afab64526a74274856469145e1755dc

SHA512
277cb64c27f79171ee80a98992d7f98bc7ec07846e1db817279cedb852066728ae5cd49cfb856f96bbe58ea57a554fc3dd24ca625143953e9b8377387766fcb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
d211c9bd4750877e4f38acb0875bfc12

SHA1
259fd6c31266ee42132a4caefd9d0c5d798508ee

SHA256
d5fda59cdce4bd646b0f40914b9c5948937274038a9fb07b881f814427e01c99

SHA512
905a3a29796fd760aad52a3b790455563ff8bd4f4f877642d4e789dcad36d8219399bbac3a60896015cfcfeb2ccc088f90612e218bbf44772cbacbbeb689ff98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jnqp20o\imagestore.dat
Filesize
5KB

MD5
48ce677e54bf3344fbd5b6af3cd315f9

SHA1
8b8ef5c25e063b17a5367dc15fe40740c6cec407

SHA256
a085d083d4bd352d99d09e0653195fa3bbafef81be23e2f02ff8df4be2e5c8a7

SHA512
d13af2e2d16998ea3234ade52d4349ee791ce50b519aaa62be8532feed0c50bcc4f8e868750d9d85bbdc60a05a064494dc44e7babf66933e9e369451b59b4f16

Download Submit

Analysis

Sharing