hxxp://www[.]xm-unionz[.]com

Analysis

max time kernel
154s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.xm-unionz.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807077501c36da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f2b05adb4ac7d374ce6a2eb402770d78b3094ed8ce782c99e5a01f93ce326ca7000000000e8000000002000020000000705e70cf51985a07de2cf9a2c1725bdd74b8a4629d72e1bdd2d2ceeadf24ff9d900000007a8ea085538bd7eacc839865478cc465b43485f1a9a0f014e015fa4ee547af8801834edf2a5e9da3d83b0d4b16eca32217aa8ae250418e9962aafb567c1521579be9bf2903daafb37cfc7cae1b9574a91dd58e8e423b0e58f68da00c0d11304666945982dab0ebe3afb0fc0d093a376014ab07aa58f1f419d36428ddbc5c6a956b18697ac623479bd03d4336f80161c3400000006d2ba31ae46be8e9c6924f3f3a981e86cde04bb0fa913306b45ad7a3f1cf55c25623ccd6f3006ffbcb205cb42b56edea14b8b67952f8377673d9c1724cc4b448	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409551640"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000001ce0d7ec8e213a464d2ea2445ddcea2f894eedd740eef3a8d8b8372ba6161908000000000e8000000002000020000000e87ffd669da19434e5dd593494f315a2a6a90aa8407008e910acc1b509de9e6a200000008f4b5b5408e8d120887347f6dd1bbec0c17bc73d581b06211a37b7fef9636b4040000000186987a5448f0df825b6c51d62d231174c98b56ed85817803c05f45d1949b0ad83c5cb410be78ac75605c9d40daadddecd40f985d42d5bfe849df71f70a0ebe2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E95FAA1-A20F-11EE-96B2-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2864	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
860	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
860	iexplore.exe
860	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2864	860	iexplore.exe	28
PID 860 wrote to memory of 2864	860	iexplore.exe	28
PID 860 wrote to memory of 2864	860	iexplore.exe	28
PID 860 wrote to memory of 2864	860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.xm-unionz.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b660a7315e7a57c0b7b6b285cc77020d

SHA1
7c7d9f787affa9975323e824efa7958f7a174745

SHA256
0ceb38f2104f5d74c55620eec3471aa9c8daf24a36d50da35f3cee22c22e667a

SHA512
21019688ceba9a65543c4f2e1ace9649619d05c33a91f379d89232fa7b3969022f8f6e4eef0b36cd51c10ef4b98ccc0c0ecb8100e632a2236ee6c8b08315076b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca38632b20344b0d1499ca7371da2d38

SHA1
5d6f3ce957a0f61ed352bf4224d96e4e124751e7

SHA256
a32600784361c84c6329b6d95fc62957eac4e46a86dde6a84391627869b92a81

SHA512
41762400327095105360ffa72b7d3c124efd333e43e491c3c14503ac46eeed42f4b327e1729bcfef152f482b6ec3442488870df14cd64663430ae2074ee99b3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f32ad428993be12c51024b71394181d

SHA1
c2476fdc1c0852816221dcb7d81c3dcb1dd9ca48

SHA256
6ec4756728588532b887fd39d0b1b9af0021c8553c8767e380efa5d6499b68f8

SHA512
f03d14585440599d89a4ce8cb5b9427da3448867c6240ee9ea503caa0abe6b207e7313ff3b044e2e304f54f330c543e0f633d74ee89ba23a4edb254fa3232088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
439e531d582a3310dd9d469cacf4b440

SHA1
45494ddce59706e7932598b0bfc93095c0ac947f

SHA256
54fab1e142da11bb5002e8a02ed595c8d0a6b7691dabf2a35aa9b9967318454f

SHA512
cf128b8651942fcb07327238e21b88ce007e8217c1f12fae3727e39e626066b003baf7b7eecb8aaf1f2abcda77981664be0fa6a008ee31f3dddc46ea8f701644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83dd6dbf08202a43cfac01fb0cf695cd

SHA1
a8d8a58858f8f9a0474b819ba37000669fc93e7d

SHA256
bd48cbda3679b552f720ceb1cdedad37e20126d1554f30374ad05c5e633acca4

SHA512
c5bbdfa83efe03a648a45149d9b1a5bc6e328da3fd6c6661d181cab5ff873e28749a6842ef8405836b7a673fbd5c30a1f66b6d52e7db28a659f0fb1104ad187e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc706133074d62f787535cb6cb44b2b9

SHA1
56f3c7cb94a0e5eec5bfd0d1f2c2d0823e943242

SHA256
01f49bb872cf0cc0541df839f23df51ea6717275eef4be4a1ce8b8f4a19fd08f

SHA512
7c99e332d3860dd0671eb303915bdc0d75c77331c22c81867c6c64b502fb8ab0841875c569ca121bdd86117a2b47180389957fca56f4e4900c034a90f42b28a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7eb6111531ac9d3fdd20aaedfbbbd7

SHA1
dffb7f92c70a9eeb3c8f2ac86bbd2bfb933bc07a

SHA256
3ed1e375c2c101490b6f733b51855909ed6813fc57ae2521ac2f569096a0fc82

SHA512
429d0dcf417179c5218c27e8bc5fc8cacd753b3af0ac51d6505cdc728a00676725fa777940d374024598e186df160a49b9d4431c340dc810cc33e51e0f31bf69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5390813503c07280e45a25c8f3f5591

SHA1
b2d98abc9378f1d99d002d7d49168d86db57d005

SHA256
60fc11556d5e149f30fd6bc879489c699e731df029f2691d837ca50990c0a8c4

SHA512
28092cf37ea544a8ed99f908c95784ad97cc6ec3e7caa8b639b0adbcd249a90464fa524ce4f5eac80d8611c12863873cb3b24c56956286136a0f1ecaf69f2d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac800fe084b3ad5a6f2b17a51ed8045d

SHA1
39e8a41feacc949c67f123e9b2340adfdd2a85b1

SHA256
69b3b010e9337c0e20b45df8815cf02cee843b9e2ea3b9aa2b7ed9d5629ab8d8

SHA512
77d90f6371f7c59b21b3df03fbd0e4b6d5af222179f21625debbe671e00f28dec43ce91a667655c75857827ddb1d8adc553f46fca4f99988512c933bb9390972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
033aacf1c62756ee9f245f77fc98e4d4

SHA1
2c7f36563390b12b8e1e7567d58047f3a8c7788c

SHA256
085732cddcfcaa9146bbc18a576cf2b4db94922e8f8cec5b69eb7ce5ab8f82f4

SHA512
255b21b173ea4f458a8dd8f11a7c5ef3cb0401ffdc9f092b7a6ef249bfc17898960bb7794f9a0dbe8166a8e852b90f10ff8d3991bd8bf5e340709007095fb7fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
720f5d456561cbc73a7154010707309c

SHA1
80e4e36bb748942536153f63fbc50b8b1da087de

SHA256
8ffc02bb512bbfd3a0894c511cf470fe532d6b59d595c383cb13c6169d6db291

SHA512
fabbab593a88a19fc82fee15505833495c76691e3897a27b9670741721a9441903141221f66ebb4d5c54a154a590b4f44ba008551c035b49cdd84ddcacf8ed15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451ab786d13ca96639f75f21fc200613

SHA1
b6a870fe64404d4c62ab38bfa92512a63d0fac3c

SHA256
de08d0732f8aa19b70e1221577757041352fc534093aabb7b7f8911465ab5bd3

SHA512
161e5c2a6251160965046d383ad03e6037fae026b9bb28800f793c5331d7335a8419e4582dc037bc6af5c4c08e6059166c88e4cacb01f36d317582e6755e6006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5448d64ec74e0c5f1a94b8e4e8589285

SHA1
7e60643514f266902246e42ad671b6c769e157b1

SHA256
62c9df0ad57d4d4b5f1650023343cefa0257e1c9ea2dea5da3a0b996674bb33f

SHA512
c9954ddf5c04f5aa3f4d3795e7b76ce9b0f33a4774473b7b8b6571b78158ff803e87ca564e30651b6b1cfa045c2b0d397059d99b301b90cd3f03772269737d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b9235c41940fa66a00aeb218a6c339e

SHA1
9051ba2a1512531e00da36e3d75fa226a3e4a5c7

SHA256
ad8bc86f4d09325b8525d61800f4da24a191fb24a212859d72a99c1a68980869

SHA512
5c62c255085daa825e671e6e34ba6bed63f2d6df5240f2a4fb90fea97d3eacb3a7b8bb9fae0552c06151be74376ca895305e5a7009be1176b15cd744b7bef448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\jquery[1].js

Filesize
105KB

MD5
006d3b2771698432ceeffd3f83ae7d4d

SHA1
06f89f182a9d1e52c6b104c3413478193b75e1e2

SHA256
a4892a45bb7e1711ee9231ceab062f7de18f5434f297228213ef15e1813d8fee

SHA512
d0e59e2a384011703031fa05c35aa886f62ed527c57f6b3f25dae45e01ea187f8c0c11b554ef8ade9b523900f66cc0ca2eefa37e6f6207f241417484d543857f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2CA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF2CB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit