b19463cb9b847bdfc7dbf8133d9702d0a0ecc4175335c4a75db211e0196f84b3

Analysis

max time kernel
144s
max time network
224s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
19/12/2022, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shipping_document_pdf.xml
Size

298B
MD5

3861a3795095fe81fcb8382d2b9066bd
SHA1

2cef2af9a35d636c3af48902c20891ec49a8e791
SHA256

b19463cb9b847bdfc7dbf8133d9702d0a0ecc4175335c4a75db211e0196f84b3
SHA512

8e881d7f7a8236d36aef500473a3dbc5a98d46c1596d33ab76e4669f858d86c6b4881c0882c37d2d32b888fcaf6280385932ca5ffc6a5143d625c71b8fc8b294

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016210ae97fcd8243b06b0035603992d7000000000200000000001066000000010000200000003e6e36dd649dfc8cbff00344845e4ae1f0aae28432c4560fbd0ac46c728f45ee000000000e800000000200002000000095103ca87249f44857940bfc2240d2fc5df5f0610c6b674dfe88fcbf1f912fef200000000e078c9897a32b122fe4c9dba6092f4cc8a3e0bee569632263cbaec4f58ac8f140000000404632a6386f0a6532b6c114f30d99ceb51ca1c9d646feeefcd96e806c062ca3c10c2a83f28e548582ff5e7c94f0c6e409853e2c2793f31638b822a381653eb4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f42be7bb13d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "378276101"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378227515"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31003579"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3857952131"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3857952131"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31003579"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3865296989"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016210ae97fcd8243b06b0035603992d7000000000200000000001066000000010000200000004b0cadee344dce317908532b68bffeccd53ca2a5414ada0d9bf4de8d1a57a5ee000000000e80000000020000200000009aeac41cf49a234e08d4b513bc4d61ed7b2c9fad3bfe13c4f43a1d34aca3ba3920000000a35cd5daafa62c1317ed10b55627abb36cced8a1253e69b48592c6d7ac60d526400000001ce79a526ff9f9769e4b654d5c48770869b8b8c9dc551d8d747c0bca441189c4ee26d79d6ae2f2de040083bc02d32fcacd3c81c98039beb51215eb970d4933fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1174AD29-7FAF-11ED-9424-EA2F33AD01A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31003579"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00531be7bb13d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "378244109"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5096	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5096	iexplore.exe
5096	iexplore.exe
3544	IEXPLORE.EXE
3544	IEXPLORE.EXE
3544	IEXPLORE.EXE
3544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 5096	1980	MSOXMLED.EXE	66
PID 1980 wrote to memory of 5096	1980	MSOXMLED.EXE	66
PID 5096 wrote to memory of 3544	5096	iexplore.exe	68
PID 5096 wrote to memory of 3544	5096	iexplore.exe	68
PID 5096 wrote to memory of 3544	5096	iexplore.exe	68

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shipping_document_pdf.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\shipping_document_pdf.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5096 CREDAT:82945 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
20fe2af45581dfa321e30289ed8c04a4

SHA1
dced3c2fd35b49d75b86d2cdc5d6f304d641902f

SHA256
a01675691065a50cf25a3b574e5c611864630193d97cf55aac526e3ead79dc43

SHA512
d758901bf4ee3d0208228c8889412888f76adecced519b0d78bce506231eb54456cb833614f6c89882e37af9c778aa9844394a99c6937088f94a512c2c2d854e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
7b4de5b37117d1b943c59a54d1c85f8a

SHA1
fdd43a365c7f63c589a59833e1c4aaa5c7630247

SHA256
0bd27119f92fea69f638f0aa55541dcc9eb71b871c62e095badc403ed515824d

SHA512
5665f98b1592be535af51df05b932a869936453a9b4f9a8d1ae994930468aad79add88800311a643bb0ad30d5fe4a77aee55b439615eed8e37d36bc5ec02d097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YYNPDQLN.cookie

Filesize
615B

MD5
5e838bae6592df76b48bd7a5f12eab5d

SHA1
362da4d1256881cf9b803ad85a94e280d1765750

SHA256
4eaee4bc65712137effec193981b02194d3981dee9cfa7645366080184a94e98

SHA512
30b596a1ce4601771c8157371a7b6c2e9be773f9152d99306881cee88b0463ea133dd0fd3bdd637ea764fdb64b216ac2d73a14b2b030ac30ec211173c886b9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YZGVO3EB.cookie

Filesize
614B

MD5
52685e7a331c8adcd6bb99ded172db81

SHA1
2209d7b28cc592aa763bd8dac225ec63cb1a8c91

SHA256
d4862550ecb5b719f7e20ad975530c03e0b273b6d59285f6a6ea757556480b2e

SHA512
089b8d7dabc078498f9fa25f678066f2f067733c0f7054fd834ff4fce89f4e7ae4c45cac96fc0357564922800de8b757df6f79961fc9341efff8597980486af2

Download Submit
memory/1980-120-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-121-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-122-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-123-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-124-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-125-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-126-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-127-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download