hxxp://tiktok[.]com

Analysis

max time kernel
1617s
max time network
1583s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tiktok.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2404526128"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B87E701B-EA61-11ED-9F77-5A0CB913B9C1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409733916e7ed901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2374836555"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2374836555"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31030894"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31030894"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c000000000200000000001066000000010000200000002ed7ee95f0c36dfdaa668c904ddd8133fb2411d3812075464a2ef903856fd9ba000000000e8000000002000020000000a15b5b5d56da94fbf0d30336e1150b5ba8e10cfc57c25b4ecaccab091e5603102000000071e265bc2274eb6ddc7f19fbffd3fc7e5611d8606886ea9ea269342564c09f59400000000f99b9b27cf4f0b8fec2f1046bd303cc1beefa28bb55320c09cdb1c8e4f4e76fe5d31d3d9450d487587a23db238956a3954f1c45930abb249b0ccfedce8a2ad6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ab20916e7ed901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389959073"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038a9e23718fe574b84afdc36f043bb4c00000000020000000000106600000001000020000000d02d065026a1d182beeafc0c0c2a7fe04f4b9dbad46ac5c6823dbace5604f54b000000000e8000000002000020000000fed95ec286db4abc0b73d1e4c304eff14a06168cf2026ef1f89e3c14c190f40020000000eb7f3b60ad3e6a4b3b01ca3593c81a78f7f5f86850929103ad99a5fba6ae4e4940000000a255c0c14ec399c3a97b6e85efda30a61c492c2c45c4f1a1a3c9b6ac63b9c5c24db21d1bb7d53efa50484c2e4c070783fa08b20b5d3d70c8a8d5049e5d052123	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31030894"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
412	iexplore.exe
412	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2256	412	iexplore.exe	84
PID 412 wrote to memory of 2256	412	iexplore.exe	84
PID 412 wrote to memory of 2256	412	iexplore.exe	84

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://tiktok.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:412 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
6bab4c9ad3e95e1fd0029f08eac5ce30

SHA1
9a5cc9aa49546e7bb43ac7329a5f7cead8a10543

SHA256
c93bdb32f59f9234c077ece327924f7acbabe226f66a54f2e6e258bebfa16dff

SHA512
a74b5f18969189869f96b830cb85313031fe147d8df67a637a407a4573e06a40bcd44ab8bc9228daf2ab301d88943bcfa41c7924d8c4d0ce94ac9b24f6e877e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
7a456a15138b3aab81c4c5eb3111ec17

SHA1
d2e001480289da6bb765f6c238a75dc2d669cc85

SHA256
443139c432189e4e59015b9838594c0abbc26fbd8e22e6d945f4fc9dbc79970c

SHA512
8ba35d52056a7908dba4c479578b05de590ffcfd025f88c104ec61ada529f7124b54b632f9f28548bd9f8fd378b47e2ef554b28a5ff7b1308404620963cee9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat

Filesize
27KB

MD5
f1c96acc0dd59480a4097f5025c47dfa

SHA1
f407a453bf65e85048baf9907cce1a8f85f90fe3

SHA256
681a1f8fe853ba0e300146f0bf51a7bcc00ca3687ffe4c9bc208732a76a0b53f

SHA512
7107821618db635d0ce66eb6926a60b9ce7a4de02baeed04a098f9ab2f2f79d1a01a47c1ba17edee862d0340e4c12b5d48e23fd49876a7438bce50b528e8d2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\embed-Sofia-Pro-Bold[1].ttf

Filesize
97KB

MD5
5000e83c63dfc88586fcd5271e82ea1a

SHA1
481b9543042db353dd4fb958f9be462e6cc95d27

SHA256
1e64411281e3e69afd7355b19ebf60b6f0714cad21656b092364553d4c579a7a

SHA512
db98445c88551e0dc87c41d1962d301a86442bbbb63eebde9559d9d5ed7c994cebf9fb1409d1503d53e27b075c429f763f70530b166b86c2b0743f33a4522c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\embed-Sofia-Pro-Regular[1].ttf

Filesize
96KB

MD5
f7d6e13b14d124de9caf1eab1b57a0ca

SHA1
80bb106d4be7a3d8c448808d2902555f3f11f6da

SHA256
60288f0812e4fd930f78ae0da23e5fb1672ebae5c2f5c63579fa18fec22e82d8

SHA512
fcddbff7b237f1f55f6145249fb632480893e9bfe31de09999c59f414bd9f271eff7deef15c073f30a92936eff1da2ab8dd046432714fb2315d7cff45561c76d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\logo_144c91a[1].png

Filesize
27KB

MD5
144c91a16d5605b852da31929cb39278

SHA1
b72d9a631d7a8aae8bc97e8a0ee9eb79bc46307e

SHA256
5e9c735171956561f39711ea2c6b593ad1d288e53cad060237d0f986202ffb36

SHA512
79ddf369767ac76dde5c9e06f29b2f081d53a5d474f761288e46070777e37dcec2318c742825f8260139cc7dbb2a94086032837f9b90989bdd6dc283e269af8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\embed-Sofia-Pro-Medium[1].ttf

Filesize
96KB

MD5
a346e648794131211e200dfea167d626

SHA1
701c02287e8daecef170087595baf36f8d12fac3

SHA256
2c0c3b71577ed8f0f1b9f4439403342fe4c193d96eacb8b8a96f1e5a8a935b3b

SHA512
be005930d8a56f542027b3ad5f9f416b8350be465b67f993bcf59faa04a46eb44ddac4813a3fb5b882f7e1a4b623e5f4010f5eefe533ad7a6d11e49cdcd7f0a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\sofiapro-medium[1].otf

Filesize
160KB

MD5
224a35b3c9de22dc339f018c06b0be24

SHA1
bdd874406aa1d82fc619edf6e9e3c42dcf804454

SHA256
362732757fd8ef2a7aca850ca0c0a291c44a1192c367281e532be6b90acab235

SHA512
24acf3c50e2e914221dfec0a0fe7e710f7b306821c07e5db3f86942f0ce4eadcb95b8681c714e76d5db1bf67c7dfaf0ca24767d5c45b8ca0eae5d6c115632773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\sofiapro-bold[1].otf

Filesize
163KB

MD5
0062e54b10bd34c99d6de0c4126a2658

SHA1
2ec366e02083c3613cc05674efcf27a8c54c50a3

SHA256
dd3544c991134803b697653dbffa19ee05654397f1321d1c1a1af4d43f080b76

SHA512
e52396237a3ce49ef23cbbd155a649e304b9573e8b5d53e37582accca5dfdad11456222d688be03c3ec6089386e389e4ba8591ca89a1e592dbe136492f6b7142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\sofiapro-regular[1].otf

Filesize
154KB

MD5
f3775fefdc62abe3d65f8ad711bc367a

SHA1
e282079b233b556c3334660dbff54968e4599a50

SHA256
e145b1a56b822a1f604021905dc0c661a5447c13a569b6424be2abc8c140b668

SHA512
a40fbadada67400af1046ecf795e1b55102dd6704aed33ba6478ac9365be246810f0ad60b27bb6a7bba06355e513470e1b8d41933cc21243fec377fd5f89f58d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit