311b3e01136c34f6121897d31cefea8a94b82d173d1022db90744064c10788b5

Analysis

max time kernel
140s
max time network
160s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
19-06-2023 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resource/RedistList/Columm/bangJarfuls/spurreyGladsMorae.xml
Size

16KB
MD5

2a8993d1fbb2f830e2403e41933a3034
SHA1

edd36d6e35cddb361797a0017fbb09fee61a30f3
SHA256

869662697f87bedb7b7ed85e7ad014b75342ca4001710ea42042da39753d080f
SHA512

3bfefe516f6682799b766369cef0ff85697725a9736ace63f67e3caa4f289cd94159a505b28b6e7066487c3cdb9193cbbfcbcff98a86d34216e11087c8b15c58
SSDEEP

384:hi765v1dA+IlrtGQOuBFNHOxSoosVS5A51cgML+:g7avcPlKSixrosVn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{395AECFA-0E98-11EE-8E3B-FAFFD49130B0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31040165"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "243637291"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017dd81bb53e2684fbef0095caf0005ac000000000200000000001066000000010000200000004ac4263eb85d28fcb1b134ee4fd36299186613a4541d4cf9f4e83dd5c2997f18000000000e800000000200002000000005d1912c0d22524c564a679aa31e56ed9c8c3100b15ce2dbc81af29b19014bbc200000007b3d8bec2c40c5c1a4f571a63a1775f50adc06f0cf1846f3d915120f4757958340000000f501a8a952de1d811b242db430690bd1697f6a2486a7f1fbc50912fe1669ce17dc0111dfcca4cb8423883029973027dcc478aaddc290ee52d27fe2d832434754	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "234416827"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017dd81bb53e2684fbef0095caf0005ac0000000002000000000010660000000100002000000061ed2a52ed0196beb07a3aee405ca4eaf236ec228e3091e79a5db30043fc341b000000000e80000000020000200000003436827adeda4cd15b6657ffbe1ae7cd076e120962b14c7d167f1fece15b6a572000000026aa456d9596cfa6eacf08b4d3598da9779905f65e1fac8b9d62b5328e4a560b40000000311cd873fe6d8b6cfae613b81d632d45ad38b647847f02448db3948626850eed966f012ed697c0f70ad87845a46afaf56bad22a75d663ccdc786260794a30e1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393940720"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00869c0fa5a2d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "393957314"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31040165"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31040165"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "234261035"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07fbb0fa5a2d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "393989306"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1756 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1756 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1756 iexplore.exe
1756 iexplore.exe
3972 IEXPLORE.EXE
3972 IEXPLORE.EXE
3972 IEXPLORE.EXE
3972 IEXPLORE.EXE

pid	process
1756	iexplore.exe

pid	process
1756	iexplore.exe

pid	process
1756	iexplore.exe
1756	iexplore.exe
3972	IEXPLORE.EXE
3972	IEXPLORE.EXE
3972	IEXPLORE.EXE
3972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 3984 wrote to memory of 1756	3984	MSOXMLED.EXE	iexplore.exe
PID 3984 wrote to memory of 1756	3984	MSOXMLED.EXE	iexplore.exe
PID 1756 wrote to memory of 3972	1756	iexplore.exe	IEXPLORE.EXE
PID 1756 wrote to memory of 3972	1756	iexplore.exe	IEXPLORE.EXE
PID 1756 wrote to memory of 3972	1756	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\resource\RedistList\Columm\bangJarfuls\spurreyGladsMorae.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resource\RedistList\Columm\bangJarfuls\spurreyGladsMorae.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
f12c265a76a9e5a0279bad4724c67e62

SHA1
f64ca14b1fd0aca976ea923ba9550e0c05adab86

SHA256
d6f55023574bd134d2bdf74dd2bae0f0235a52bb302c7b290977dc05e13a2012

SHA512
240c711b1b1439e3e3a141af2a609c0bdaafd4f212b7905d451e735bb518988416b7fd3065c6599559371312079ce8a896779a88e97a72716e9228b755bee5bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
9a8d0741533ef74134476a0b3185978a

SHA1
4bff9c39e46883cd17b1b9a38f169fee3ea6c835

SHA256
c9050ceddf48188dffbeecbb3e116a4f00062c85ec9803f7136642a92cb83c6b

SHA512
7f445d55c2a71d377a53edd320fa80788067e7e804cf39585a965ff21aebacefc3694e2fff7fbedc7a330110ffc1b83281eb1777e5bd4f93b6872bbb6a77f33d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B1FTPK9F\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\1BXJKZNF.cookie
Filesize
610B

MD5
397880b0e2ab6e94fd4f8ba5272f6750

SHA1
428aec1a10e01229ff137582efd1b55c20cc30db

SHA256
268fe3079e3d3f6e22f33139075af6a8d32cb94a41f254f45a2189521c372976

SHA512
47881de6d6db6e9c32006004d083468bf63a7c1a51b57e15b526d318ea80a4b357286a0cdd53a87cc9d358c6b4180073b9ee433d06fe020d2920441fab772b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WI9DFXY7.cookie
Filesize
610B

MD5
3c84641da0afe7098269971d5509fdb6

SHA1
c331fd92b2ec266ed6800edd106ba18b27bb3384

SHA256
cb82ebc143b3a5ab0ff895961b1d5e00d875adea183850a1bc5b5806612b8474

SHA512
eb23d7eb890af8cad145bcd6c6d642d034e7e6f79cbd2a6083c81c72ca56a80a80a30089b95a632712bfebcdb96813dfd00f2db82242892e8f263c5ff1883419

Download Submit
memory/3984-119-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download
memory/3984-122-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download
memory/3984-123-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download
memory/3984-121-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download
memory/3984-120-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download
memory/3984-116-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download
memory/3984-118-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download
memory/3984-117-0x00007FF970260000-0x00007FF970270000-memory.dmp

Filesize
64KB

Download