24de2b71477635f2bdb96e6990ed37de9cb8848dd29210ffe8ddd1d0ec948734

Analysis

max time kernel
79s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

temp/ppt/drawings/_rels/vmlDrawing1.vml.xml
Size

292B
MD5

242d911f3201e3ae67c12d98828a6832
SHA1

1ea30bd460322e4fa19f030c486c31b9f9625862
SHA256

5a8e6d1316d56fad03cd50976fbb1912906ad937142c1b1d587547d439aeba53
SHA512

cfbd66d5ed488d4cd7052ad1f0fb9a3873b02f46f5544df59e3f6ba4ff32dfa94af8e1f25867e549460b67f666867baa58ba0ef29356049337c651910efbcc06

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC2B1BE1-6E2E-11ED-A993-42FEA5F7B9B2} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000034630fb72a6c9c438c39b8b5b8345d3100000000020000000000106600000001000020000000f4ca8eb823cde3626b6514950a75b87f3328f70358e6cc1bd4c10f760a09cc4d000000000e800000000200002000000052a6713d0b89a05b503cc628c469fa1176eca4236cba451ee0260f53b187cea890000000ffb0b1d630c40a14203cbafb2b8abac428aeb2ab7eb6cb6e2aaa5f6fe5e103c32fb18deaa1792ed795a9bce9ab0ae7aa9c7c20df65912f1b376efe31416742da04368013eb67131d6d8e041238e7af39ee08bc3fe42e938fb2d501b34dcaba8ad09bb489329072bfb95fbcfaad330fd6e5b63b877f17adb184cf90b137ba7c4cbef9f6ca432224f23b0d6f6ed5834e1c400000005bfb39ba7218547c5e5a6a049ecdce6e8afe8a3acc72f33424f789be8eade447b02eb45c1f8e390a88a8af803a853e6c79845103fc440289c901507abc8808c6	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376303345"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d2c7d13b02d901	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000034630fb72a6c9c438c39b8b5b8345d31000000000200000000001066000000010000200000004db8b98f90a84cd274bdf5fbaec91f9e50daea64410b2405b026ba9799e5576e000000000e800000000200002000000073e67e88b6ed35a3a85950fef2866e6a12027fe807b425da841ee7f0631adbe020000000acb24b450cd4098724633330b6d4019885b016637fdc7d55ed82a171a8ab27df400000002c0f4e8195e2bcaf11eb282521ea586cbaaae24b639f000054ac43f557edd09536dfe46673352bcfc976d85a6aa17e1202af1bfba3d97c4dc5ac052e3a67c7fc	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1320 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1320 IEXPLORE.EXE
1320 IEXPLORE.EXE
1084 IEXPLORE.EXE
1084 IEXPLORE.EXE
1084 IEXPLORE.EXE
1084 IEXPLORE.EXE

pid	process
1320	IEXPLORE.EXE

pid	process
1320	IEXPLORE.EXE
1320	IEXPLORE.EXE
1084	IEXPLORE.EXE
1084	IEXPLORE.EXE
1084	IEXPLORE.EXE
1084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1812 wrote to memory of 840	1812	MSOXMLED.EXE	iexplore.exe
PID 1812 wrote to memory of 840	1812	MSOXMLED.EXE	iexplore.exe
PID 1812 wrote to memory of 840	1812	MSOXMLED.EXE	iexplore.exe
PID 1812 wrote to memory of 840	1812	MSOXMLED.EXE	iexplore.exe
PID 840 wrote to memory of 1320	840	iexplore.exe	IEXPLORE.EXE
PID 840 wrote to memory of 1320	840	iexplore.exe	IEXPLORE.EXE
PID 840 wrote to memory of 1320	840	iexplore.exe	IEXPLORE.EXE
PID 840 wrote to memory of 1320	840	iexplore.exe	IEXPLORE.EXE
PID 1320 wrote to memory of 1084	1320	IEXPLORE.EXE	IEXPLORE.EXE
PID 1320 wrote to memory of 1084	1320	IEXPLORE.EXE	IEXPLORE.EXE
PID 1320 wrote to memory of 1084	1320	IEXPLORE.EXE	IEXPLORE.EXE
PID 1320 wrote to memory of 1084	1320	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\temp\ppt\drawings\_rels\vmlDrawing1.vml.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PNSEOHK0.txt
Filesize
603B

MD5
0e5f88608214536448e7b2aedcb906db

SHA1
2bf936c3f6f99d992c315a56a6373452c9736a41

SHA256
cf7ca87421c7ea1757a61c9615b39a1b77b23e0fd5da9d8676064822b08b6c21

SHA512
96d44811c9d666439495e2366a647c91d7fb09432ab5507c6c1b9943e395895baefa9422fe2c52ccf8a16485125c56af6f1668658df8b929f6277c3fe5e5e729

Download Submit
memory/1812-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download