hxxps://acpaorg-my[.]sharepoint[.]com[:]443/[:]b[:]/g/personal/mayers_acpa_org/EdY3d5jGx79Dnn6TNWrdDVcBdLOcxXrEgH9kh5dAfUPIpA?e=4*3al1HuxX&at=9

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2023, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://acpaorg-my.sharepoint.com:443/:b:/g/personal/mayers_acpa_org/EdY3d5jGx79Dnn6TNWrdDVcBdLOcxXrEgH9kh5dAfUPIpA?e=4*3al1HuxX&at=9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000e9f1d09ad8e5f20b0a28e63f35d09c4dbd7b9e5f71595b603b69323c836010db000000000e8000000002000020000000b45b4a098adc3187b8a8646db5b17713b625bf84b0faa3709846e7987082649320000000a6e480ad3994a6d018a0eac597027713e1705baf951e2401e4cb67a01929d27040000000af0e9c6b0d9e4cf7a90592db8c294981942491a3295c3221ba11331e4daeedbab697058a07d36da722154370b058b2b93b81f56844845df2db80baf688c0802f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1454974254"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1442160569"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31031980"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390425411"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000cd2fb784ac34ca89533e9953ba3ef846d4e6e8c623f3c325cfcbdc8e96982267000000000e8000000002000020000000884f36f29bef6cd3b9a7c020ecfbbf96e8b4a669e0c6ab807801a60413231d5a20000000943618de7470786e37869c185ccf4df42b18b019c0aec6d18ea269e3df9e70a740000000afa0768ec15527a058e987c673f5a03beea36b06eb04b4e30ebf1a3e1291b66c6ba731c8feb2bd148def54ddc29d16a926a58a7e9c97e6618ff06b977dad9546	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cc2459ac82d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031980"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031980"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1442004181"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80df3759ac82d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{817B5F20-EE9F-11ED-B7D7-6201C35E5273} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1028	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1028	iexplore.exe
1028	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
1028	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2144	1028	iexplore.exe	81
PID 1028 wrote to memory of 2144	1028	iexplore.exe	81
PID 1028 wrote to memory of 2144	1028	iexplore.exe	81

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://acpaorg-my.sharepoint.com:443/:b:/g/personal/mayers_acpa_org/EdY3d5jGx79Dnn6TNWrdDVcBdLOcxXrEgH9kh5dAfUPIpA?e=4*3al1HuxX&at=9
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
1KB

MD5
841785fa29e2c9c554cfde87bcbda6b7

SHA1
dcfd3c07636dbcea62a23e20d60e268e476a24c9

SHA256
4f072540751d954745f9db3db8ddb93c122a52700fe4bc5ecb977c2c48c52562

SHA512
e9ff84cd3b073e01cd68e70c5e5e9b99f062b552e9641f21c3273497526d158f88baff8a3b08098bb65c353c3f2af8acd8cb3d14079f853ea1bedd655178fb6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
bd71617256882953841a8337a4dd5d5c

SHA1
d9b47492fafc72a5fbca10c56229fe6a2757331a

SHA256
8f2693e8b656256ad2faa63c3421eb6f1a4e278d2e2e3cc97d5acd5642f97ba2

SHA512
2d40d636e04523d2095e6896f24a911c523d581b93d486af41275b3b6dc94e05bf5e4de8e2c8479886e4c3f2ff87215fd25c028846ba5a868258875dcca3fa2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
446B

MD5
eee2813263d49de6635850b2a42653ae

SHA1
eb02344f83266116dad0d12c10c0bb91da284a28

SHA256
00e38d3454a99d8bdfbbb1b813ed00fad30f2b58559c93b6bb09865529cce115

SHA512
5e8c5226ae20ce654b635d78c82b42e4dc2cc0a781d7fc6ae8b79d44e67fac83aa5d21839e38cc46e9163538513c9a4b3889fddf6a238bba6390bedf13494a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
0f880c73b014c0feb67bcb81d9919716

SHA1
a293fcae6d0a13c7af63799bcfd711227ffd5d60

SHA256
d90f39014f39fca9a6c153b3baf412faa2bd2b7dca3a9cf5a75b3860ea54e2f1

SHA512
da148d95973b6223250b60f4c642a5cb9e3ccc921738ead83ea740821ade9edb64a67ee8745e1b455e271d2d14819a3b136b2de51cb0cb4bade50fd06600d492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9afmek3\imagestore.dat

Filesize
8KB

MD5
d0eb18c0345c0038660cd27a03d80b2a

SHA1
f126b33b91f2df5690772ee48466eecd161cd587

SHA256
09b95b0d13e331210a060cdfea0b38f1c94f866d478bb2db863d47c71106922b

SHA512
7ce7dee9c996f2a1c7231ee8ee46fd8d9695b4ddc7726907640139fe2b6ce93613e3209eb88799ceb3846242b234647dfb08d19db4542a234048ab5ae7215f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\qsml[1].xml

Filesize
546B

MD5
2db48c207d18042dfaf2d424ec061d83

SHA1
4ea98932b3661ae4fc25f696906b51f92c62f2d1

SHA256
5860ec1eb12b6dc123cce66d2cdaf60a9ab8eac66732f083b992add1e63302d2

SHA512
f8fddb34753c5ca1e5eb49feb78c676d84b302f911ecf23e9a09ab99a100fcc28497baed00892059d5210674b02aef1f6963c0a2e0aad9b1db3d5f76036fb608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\qsml[2].xml

Filesize
601B

MD5
34a49e0183d1693daeb3c7dfc724c661

SHA1
2b44ba74ccc55ced7c1f82a47bffce886b29bc26

SHA256
d7d9ec0d2f709c414c88f70addadf7f4060028cc8ecc62457c7022e410634875

SHA512
3ddba1a61058c5989592da3d6c4652ea02190144dbd7c68d9ef9fd3a12e970928708571400679fbe3a9bf388f868ad31021d5a3fa18cffde6956d84fbb8d32cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\favicon[1].ico

Filesize
7KB

MD5
0b60f3c9e4da6e807e808da7360f24f2

SHA1
9afc7abb910de855efb426206e547574a1e074b7

SHA256
addeedeeef393b6b1be5bbb099b656dcd797334ff972c495ccb09cfcb1a78341

SHA512
1328363987abbad1b927fc95f0a3d5646184ef69d66b42f32d1185ee06603ae1a574fac64472fb6e349c2ce99f9b54407ba72b2908ca7ab01d023ec2f47e7e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\qsml[1].xml

Filesize
589B

MD5
95a5570a77dec94c04498c888b74bc63

SHA1
a725b6e4b5911a94237a3bf22f5a8360c9702a7f

SHA256
5f0ead3fcb6ce2655661992ca006c88402dc28f1112fb52af6316dfa51af25ad

SHA512
83d132cb1d559242d7153fc2c2db114c5cb05c00859cfc17bfba00a1a5eb8d8728881e31974e514157547313eb3a55352a2fe41b76b7f6389f85c5839ec4fe14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\qsml[2].xml

Filesize
632B

MD5
19f99c1980881709c60a5c9ca0417930

SHA1
03bdbd8ad98a9df6231bd4f416dbc87b860b27ad

SHA256
49687e35ee463881aeed39d335d10ec15e1fa5add0322229a78a845164ccbbae

SHA512
cea44338d8f9d32df728afa2d9f7b269b48d100fa86bd3613d6687a6e2f39dabf39da9c2936c80582752297e42a24fa01aff0b0a734ec2958cb46180a9405200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\qsml[1].xml

Filesize
633B

MD5
48b9267f19340c3eaf36ff9ba3ad3c71

SHA1
dfa34773063d1c182625640b1442852bb42e583a

SHA256
a5b74e72aef4657043f71e49705ec55a05fb992a60a1a0ff05c9fbc689901829

SHA512
7959dd7149f071a4b7c8445b1f7d6b7aebe1482c148ee9a0c44021681f6d778a1b7fb0577f0efa3f6dd91e25c0e47de0671625c9a3d5dde0389576e480bd8d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\qsml[1].xml

Filesize
609B

MD5
24b3fdead9ca2e3c17d628d43cf74251

SHA1
5962bef3e13c64a142e9075672156b7e86a8a317

SHA256
633023d15c3c6845cad2e8c44519b441a1bad63bf69d1dc191a23b9962174f07

SHA512
ce3536742f1357c5d6cff45d25191f2a43f026e4bf5f7c6cadfb0732b121f24bcb8158eef74b0674a83a32128ecd30fedc09339099a6ecb2b55061a11a77df63

Download Submit