hxxps://r20[.]rs6[.]net/tn[.]jsp?f=00198I0Mceg4JkimVPCnwGRds1X02-sK6u2fpfll57nbE9zAeYIT2FOv3xLqG5kwKFBC7ex1gx4sqdhWsC4_la-nUD4J99PoaG6aMKnnAogaF4gSj1Xc0XRikIxYvZKgh9BFr3IHcHBocmgGnAzYa168Q==&c=xf9pX93gw4ZHmfROtPxMKNZVXt_Cn4mK9EBXhXKmVi1zYuMQFXXRyg==&ch=BjAWJIlY_OtCKO7JckIiVaaFjBL6v2PEniM_Aqr9aVdc21qemGgGug==

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net/tn.jsp?f=00198I0Mceg4JkimVPCnwGRds1X02-sK6u2fpfll57nbE9zAeYIT2FOv3xLqG5kwKFBC7ex1gx4sqdhWsC4_la-nUD4J99PoaG6aMKnnAogaF4gSj1Xc0XRikIxYvZKgh9BFr3IHcHBocmgGnAzYa168Q==&c=xf9pX93gw4ZHmfROtPxMKNZVXt_Cn4mK9EBXhXKmVi1zYuMQFXXRyg==&ch=BjAWJIlY_OtCKO7JckIiVaaFjBL6v2PEniM_Aqr9aVdc21qemGgGug==

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412165548"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013285a89af5130b7c1835b15577c3b9bf7a25d68a2fc8e23dded2c22330005c5000000000e8000000002000020000000c7db797c5034e40c0ab14335558d109b9fc6c73a40cb23e83fceddc9585197a2900000007107ed1398fb3212572af1e869b66e9892718704914c863c024cbcd2d5f3b8f2ba672c3b50dbcc594ec15f6d9a6c340500ad3cb74a4cd251e4254852fa9fe8f25787d615de0d3a97007d45c547dbba63d1438acdfe9960b92e606317fcbc8fbd94ea752bec0e8e180992af49ec125ae42896aada28153d2e17da5e39ce841ff0bb7fb49a1dc70beb749ceb37af1cce93400000003740c04275101c4bf5b5a52a9de8b8c94bad2c7592b11c96b539b4c4ef97503340703c6ec6442d5087a7233639e259305488494616b60fb6d6ac477ae7de043f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20fdee41e24dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000056bd4540b298ab678982e019fa82347135f6a066286a1dfbdfd097782104e743000000000e80000000020000200000004b257c0a2c0a8e305e91cf847ed1554a67788c0d8fb953e054481066a5471e7f20000000338b31c51d8120e670c44212aa7545f891ee06bed103c22198672a570746828f4000000042037f09e7925d749d59e38943d7927eaccf1962336a6e04eafa0932f6230b3b29c0ede3c1378b18c8b5d8dde82befcc8cb9323f39cc21be1a091bbe54722375	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C323391-B9D5-11EE-8CD0-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2644	2084	iexplore.exe	28
PID 2084 wrote to memory of 2644	2084	iexplore.exe	28
PID 2084 wrote to memory of 2644	2084	iexplore.exe	28
PID 2084 wrote to memory of 2644	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://r20.rs6.net/tn.jsp?f=00198I0Mceg4JkimVPCnwGRds1X02-sK6u2fpfll57nbE9zAeYIT2FOv3xLqG5kwKFBC7ex1gx4sqdhWsC4_la-nUD4J99PoaG6aMKnnAogaF4gSj1Xc0XRikIxYvZKgh9BFr3IHcHBocmgGnAzYa168Q==&c=xf9pX93gw4ZHmfROtPxMKNZVXt_Cn4mK9EBXhXKmVi1zYuMQFXXRyg==&ch=BjAWJIlY_OtCKO7JckIiVaaFjBL6v2PEniM_Aqr9aVdc21qemGgGug==
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2f862b4d84e38807abfc6e43f872a32

SHA1
5ea2fb7492942ee5966131a8efe981379ce832b0

SHA256
348416f3b1cfc4b91336aac3c06058b1afa61ae1b26c8569adae2a8b9d800bee

SHA512
b15aa2b7699096c2ee82865cbdd8fdf5c6f41a06dcc6d5400fddf77e06694a324ed20d64246af6198db8b243a7cdbc9f407362b35fa069ca63b088c9302cdd2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c43fe879deb0eefdfab15b3271f9a37

SHA1
20d0486520e01cc8410f40bd1463c0ab7a70a0bb

SHA256
78d1079989f2514547b30ce41dec24636c9d419cad6394213c8023880b7c45f5

SHA512
2d7cb255009f3676178db49b64b6af69e6a0cef34b866518169875d38c712ce847ff8f941cb2773cd5a5d8402219dde298cb5947de90a7ef9e59aa2bcf81104a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b4b648b76266802e5ccd6ecf9a46e37

SHA1
ad49afe59410f6042be126ce1f1d33ce42dc0af6

SHA256
c9ba1b6d62cdbe766801524db80630f7c769fb08a0049c6b4b4343b2b1438b20

SHA512
1cad411c6c2610990ff5a45b001348f70625abf445fcf6bbd82bed4672ee33cb14ec1601abb45c597dcaa46a0b8a4d417b8414c60493320839c9433b49a36954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
653e9e8747427b6562fb9fec605f5541

SHA1
a81dcbb4f632652e14710331d9dd4f0289932a79

SHA256
0bd050939644ffaafb59dc0495a989688c21353d5cc38f67fd733ed51f168699

SHA512
cb1ba5fc6d1ecb1bc75be3769d6662347b7a83d583ea2364763cf864da5f0bb05239ffaabbdf2da6880a65a6e062a839f9a2ea77eb95b35c5eba2b83d933bc5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d8686c945fadd1d3c098b438b149098

SHA1
1b0ad397a18b3c624728fc9a4dc5a486a6bfd71a

SHA256
8cb3619af9f314c3c5bcb0f90945e134947b2ce1e9c3fe62142410ff1bd556c7

SHA512
a1799b96215be4abea346c61ce6506317cc8ad2dfb931eccc06fdbe447be78dadcf305c22dcaf4511c94464ac1318b2a97fffd00dca042d3baba0df3e523810a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed394174f9e29e48c1efacffb9ecaaf8

SHA1
b16c8ecc829666e99dc2faa89e7b7b02bc3adbbf

SHA256
8f6d6dd524e474254aa3586bf91548e82fcb17891f06453c28113f77e8e3648e

SHA512
d39ca7437924e162aa9934b0adbd636c7e334a73e9409e72c332f7cfb7f9436a89d092d9f82d805d00d7c06f76dc59ee7a48d0b53a2a0a8daf9d11c03756257e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aedda0bb9e488ded8791a0d13d5bf0bd

SHA1
e3cce6f5089983606972f65fe478ed65de37209c

SHA256
c7dfaae424066fd144067250c7acbfa3bd636fc4d5ff327b8e861d487d162c33

SHA512
f7b73605f412e9b578aa301be962509a15e9c1eee8228a1a1ef1c7032b4a95053d946fd23e07262d7e42787de3417558a952fc798b87e133b13587cebde3918c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56a26869bbe9a2df64d80af9645ec352

SHA1
24c3a7a144d12a42a637c847ac955899b13d4c58

SHA256
d5d1114cddeb4edb56c941285eef79fdfa255a513d9d2c77c1b6b5fbfa5aef64

SHA512
4ca7c9d285279667daea2e41c8d5ad282c6a06b40d768e052b56ce29dc93bc2b3eabefec03258d4887dee5c5bcb34c94e734077f52ff0aec36b08b2bc478a00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdcc131e63205c06bbf250941163cd4e

SHA1
9e643c877c9216f2b3b4bbfbfabd06230639dde9

SHA256
eb73789a0115bf6002fe27c0ef5c021b05e26a75c39c5497423a89cdb68e4709

SHA512
8f2491eb2dcdff478a2bba2a67ad948eae58bdd9eac434648f484b54ccd85959a259a8a7b4b5fd51f64625f9e62dab8b737aa3f7fd04c3d5a10f124bb2e159a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4d8eb733d1a892de69116cddffb3b29

SHA1
dd722f422a8c0c1b4f4f6430ba6101052c9c6b64

SHA256
f9814a59e61264f46f0d2958e11071f343f10e921c0609f79ec807312091f473

SHA512
ec18f0700125332e2ee99ac5bb1e6a2a9dee8d4591cf437af60bb3bfdb9dedc4a55fc91f8bc0a6fe194deead8be72107099787a0f42a5b2ce6750c29c112aa59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8a8dd65ec9fee02f7ac644dfc243856

SHA1
63a8537332ecce1d22c91203c54fc4ed5d0e3b83

SHA256
e549ad887d7e640a2cd850c664a81273ecfb423643373505199a8e73d12615c4

SHA512
d1856f519c6569be5e51db659de5cbccf7cc8728ae8ef95c43b2f6e2a197ce1cde7036ae22c0ba17e94970cb69ff7d455db019b909de9a9ca289aeb9c2f86ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44aa590da7e8bc72ac0368eb3e821dd7

SHA1
a3b39da187f0f57bf4fe491446226636bcb3d1f6

SHA256
2ee8e4dd1568cea0406a868f89b7c37cac4a282e70edcd01ee965da6edd8ae63

SHA512
eae3cb6994fdcc53ffb8eada114f7c38182dae9217b50a3b8b594aee622642b8f318a063dcf20db6b57ce0e63dca46cd4523063850f54e2c73062b2dbb05e0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e905da14f482594f821cd667f79084e

SHA1
b8d036105b3ea7ae97a6be761466e99df5bd080b

SHA256
16f876a7263a7e5a7001f73a88a91204480bb3a8dcac95b566cf897aa69690c7

SHA512
90e8891ac6e72d2f3ad805da24b6c35ee57fb92d86b6c540ab53c6a59cf40563f2f59a1782342eedcd239f4fe5907da098ceb4b4a58fbbafd54cd9e02644cf8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc282db34a0114c42042c618ce813640

SHA1
d7a82cfb442c95c82103ef340f05cfc7dc100785

SHA256
da42890e6cc6f1b39e602a23d73f2f761a1b354fa9b8f6566551b0fea3ab68ad

SHA512
620f797655590452aa88a154f80b7469810b9f8321e2c169ca610c5f3dbb4ea07fc6cb4aa64c6aae23205c5491665b8e7b61851bc4dd5cc0fe002d8dcdad678c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25be46a1151960b6adeca2a56f95c8fd

SHA1
e3f08e495b5aa22f2adb95ae1525ac67806268fe

SHA256
040052076d03e6531b19500e6d808b46173d79f1de1dbf00586546eed7416c81

SHA512
b5bfa3f4f649faf45b5eb6edb16ed132ac7dca5e605af9d8df3303ca0663d783f4836349615460871547e6d35b359c258eef1c4422fe3aaa5c67c9f027d9988d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f72963ac093be79095b8d5f0ad0d6794

SHA1
d3a575a80279f5245e51b0fca98ded3409a26ee7

SHA256
31cfc20ddfca561ee7dd0dcceee963563f5b1002715fcbb7148fa798e2ef328a

SHA512
c07eba55cc7dd8528c37cb06423e2fcd0e1ee62e77b8c62f6664da28865ef39fc47ceb8d4abb0a26dadcaa0fd795c767bd828c036584bf8ab8455a46763ff5d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab955F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar961E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit