hxxps://storage[.]googleapis[.]com/educatione/washingtonpost[.]com%20(2)[.]html#4SoKnW6111zxsz3qlzqtluqtz354CUFFQGXUCZYWVWS334660HZDT3505589v9

Analysis

max time kernel
135s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://storage.googleapis.com/educatione/washingtonpost.com%20(2).html#4SoKnW6111zxsz3qlzqtluqtz354CUFFQGXUCZYWVWS334660HZDT3505589v9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409967257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AC3A871-A5D7-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a07c60f2e339da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000771c6ded8244fd77604f847f8159ac23d924641cfe274cc27861e4db8deb9c3c000000000e8000000002000020000000d2a6e00202999eb19f2de6405d13bb8932139f1a9a66daf31621c3b95c3b1c35900000009c02ba7fcbfba6d2f82d8dc897f0223a2b20d562d8816bd959d59b5163e860184364e98c594ce68a0e515afc238aea1887baaf43b9afc35811c0e700c15bdad1a532b48b6dea4430d9dddf7c86df759128ba3fe9e80c69f9c1a6d9f2248b9b7687fe8fabf8b3755789c12092b940365e8196f8b64ec00e058ca18c256334321257f309f50923996d06c7231c872a3a4c40000000027d2be8ed87f253b61def2788412ffa2d01b21a92c657fa89a72c713b69e43d5fc38c2bbc0544658dae4b85429f9c6765e230f127225345950abc6a81c2bbf0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000008e60f272765e744dd4741d4fa3e1b83339dcb7a67238e1959514ce9e4f87ef67000000000e80000000020000200000008d9299f3f46cd35b4821b3ca789148f61b96b4d938c393e60514cc0efd03c99320000000daa59c3f304c17bd3e52a1b4add1750ef153ce4fab2e2fbc91ea78a7395a4f7040000000e64f8a511ec8ac4b363d903cbefb403396e751b84a07c79437eb631a4e6afcc4feb3c5250aaff90d812f140120d3f8b01445baec3cb9d41dda9af209b205c8ac	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2576	iexplore.exe
2576	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2452	2576	iexplore.exe	28
PID 2576 wrote to memory of 2452	2576	iexplore.exe	28
PID 2576 wrote to memory of 2452	2576	iexplore.exe	28
PID 2576 wrote to memory of 2452	2576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://storage.googleapis.com/educatione/washingtonpost.com%20(2).html#4SoKnW6111zxsz3qlzqtluqtz354CUFFQGXUCZYWVWS334660HZDT3505589v9
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50005fb37a314741c5b2d4d4444c4869

SHA1
a0123292ac635938b56984fb7eb8050e4551a222

SHA256
2366dbca824454e65b5edf076d3ed2e3e2dd63e479b3066c5703b7b4d8ee5dea

SHA512
2f72a9364e727a5b0d4b4cf4a39bed5dd0fbbef3ab97a768c7ab59e86bbd5b751fdac0c131d4feb9d8d7f2b10e6896eabd64cae664693814fae0561aa96f6e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edff9183d20e418144b1fa4516e00a15

SHA1
5e5deeef2baf34ca351cd3fac5a7bcdf0357519c

SHA256
e829a1509149a8dd91ef4329ab361948a9fcd39c6857fa9e12eed604233d0c73

SHA512
7dcbec80b96fc90f8bcb498bc715ea3c835bce5d19545c57e8c3e192945fcc4fefe02365ad51c219a76d8642fc948680f53c9303b2b8c73de07461da47d65ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e1db7bb1996717de3462a24f6cab8f9

SHA1
e6b9d82d4dd32a0f9bee9e5a870c27ec209f0176

SHA256
241532a0d13ebb86e21b54693e5bcc7fc4d8a5e8332666134ecc0bd47f92bcbf

SHA512
9795ef376f1adea4f29da5e5870151f498bb3fd96f14045da2deb6a0ca27a1a1f6e79da95d9578c16dc95967d4d4afd8c9352b2c932317c22487a4733466e3b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea165e0f9a994820934d6a45b175b257

SHA1
eb8d44086351309d6577cd511ff8c11c3bfbd385

SHA256
7d007d01895180b6bbe812d712bb10088a256d77e99ecb5ca024c3e44e3049ec

SHA512
2039897efd4b822542089754b0a22288c465f10d231cd9d79e64c328911c9bf6cc0e68e7bc30d30c54e3d22f23889b75a988a53cd676a34886a96d4a3d7d6889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c79da15642896b12b477b24cd30ded01

SHA1
ee05c0a22b0220751f8d9d059c3fbb8feb09ce99

SHA256
0287aa73ff67f17c58e85f9c54560134797baee4595db1622d5fe4ac99637a4c

SHA512
006f4c60df2b222fd70308610228e5974f355e79b41d778a98dd772da2a03b37618455b48d8afdce172dead5629e242dbf38ab04510319092be7a872a61dba2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c0d31988f7ae7a68064849ebb35372

SHA1
c55e74ba795b030997789e54634c6b9a8bc4d762

SHA256
1c066439590b918620de8b192f6b2282df1f680ca73ecc5663fc3aa07125def7

SHA512
b4f44873948f8c053f613e7e980f260f11030ce97a34b9824d15f1900720363fc43af65f0e127c0cf23b5f37bf532b604f548943294da5b9fa6d485244723ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
021f68db134aea787ccf86377d8a0f52

SHA1
335f38cbde7d9515abef81e70a2ea32f4fe0109d

SHA256
c1537d77b063a1586dff4f44ee8ed5baa88946ad1478757a81b72e24b69f8314

SHA512
1249260b0a267ccdad3a7c46cdbe80ad6da9f341f5535f5d635d8083a165aacf83e29d4db0a81372caf4357b4161a80d0f98f2571e60247e228809e42932b5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
079cddf8560454d1ce2fb35b5609d673

SHA1
acd6b40bf9cc17f496d7d65772fe744bec03afce

SHA256
95483132d78db7dc017a90f2091eb9f95025f90f93ba2c0c1313d235c51392c1

SHA512
46fd8eac73854bfbce5a6b9beff1f117c3accdee5b446d6749bb6b13892b197946f83a816a608ad84c9e8fc50b586169befa20355ebd2b4db02d3dfa6ba89f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b398018f44e106a391104ce44d25463

SHA1
79ea6ca43566d4e4bfdfaff465d90ddd9e5a9023

SHA256
6164970ad20cce0d72147e6308f3ea9f9d21cb856a9e66664a97157d91848c7f

SHA512
eaa085f74983adea2311e7ea54044d73a4e63997fc20201cdfd3c2afb1fdee294ffee2901ae0b56402fe8adf7a420d0aca280549e81db9c61c8a667cc30ff6e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c14022819062c6e4addd5b4dac59d15

SHA1
39cd1e864ef2852fc512f9b42c530d4d80980f37

SHA256
3ed698cd1ad0f6ad20ab02f3584222e4c4ac3866b72e284ba111d06e905963c6

SHA512
1a6ed15400a6647bea42c89ffa69f8984e12631107871c2050f2992f1500d07bf95133ff95817428d79ddbfe5c2dd4afb005df141bb19502c7692be4d1e0c637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b05571dc38f24197848690508726f09e

SHA1
f78767f086e8e5916da8bbdc1b897480654a280f

SHA256
ae396b9a6908a2459caa85bc46d27288e577bfbb4116ff699e758c70074f88da

SHA512
24d63ac059092a154f2117faa66d596da13a57374fc5d862a99cfcd625b93f05fe0126dd0da3b21b33e4d3fe63084119fa606908b3fbe17cd8380c369ea10d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc3a5c8e012e0b318d759d6ca9a17c0b

SHA1
92af4d8ce6049b1c249cf7fe6cf2e87d080a7662

SHA256
731eb97e4e74faed05f1267a860aa0669b09f395ae58b71677bb1d83bd943929

SHA512
88f37a31c80072acb827b08939a3d48b8b200652ffefffdc77a8291fa7cf920dbab862b37d29c821d2066257738a4cdf44348d5db35af8a87c90ad9d5a242b53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b8242ac1e62a95370a05147dc6f5239

SHA1
e9350c55b9285f9fbbe54ba645ab221a40b50a03

SHA256
4ffda242a7e5405dd6484f6e7457156ef02023b2aa297d92746841aa94770d0c

SHA512
4e43e695b5d2cfbef8af03ca1d197ca1167cfe911cb25b7c41a6c725d7f69147fef910842e0fff8e6333bcc71879dc99ba1a632a2e4bee5656533f52001375fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca26665d62855aaba1b2d17db325d314

SHA1
e8df6730f9c9355be398fa8cbe2430f7c28d8257

SHA256
feb68d36a339165eb3ed013d32d768862a154d51e58f6b5625110bc36c1c1167

SHA512
ca7d2b307754e5959b8b4d2b588d7ecf8c1c4c5d42b7018f850b4fb71c140618c500048a2b9bf2fcb7d4ca49386021f610d4496506529a59029757eb32f608f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E27.tmp

Filesize
1KB

MD5
1f1a3b101012e27df35286ed1cf74aa6

SHA1
46f36d1c9715589e45558bd53b721e8f7f52a888

SHA256
7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

SHA512
d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7F61.tmp

Filesize
31KB

MD5
634548e8cc6055b722ef4b7feae58b35

SHA1
a260237f27ee6eaa350d5e63c7f5a64f4a21d43f

SHA256
277f99d1eae29ad3623639551c6986c8e59e158c7a9b9e69c1045140085a8c2d

SHA512
3e3a8418c2ca80fc12041f94c61987ad0bd2262fa2cb020b3424415e2718c3290cb6d8d30d42d23f2a7ae5a6af9486e99c779e7ae7aab914bbbc93bdc1794490

Download Submit