3343644e85fc33f8cd3b97e0f7275053f1c272932379c61b3c0d3c620a23a4ee

Resubmissions

08-02-2024 19:42

240208-ye7cksbg28 10

08-02-2024 19:33

240208-x9kavshh6s 10

Analysis

max time kernel
126s
max time network
161s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
08-02-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Korepi/config/config.xml
Size

161B
MD5

c16b0746faa39818049fe38709a82c62
SHA1

3fa322fe6ed724b1bc4fd52795428a36b7b8c131
SHA256

d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
SHA512

cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "243920932"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00a2c0fc65ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{393B8286-C6B9-11EE-BA20-4E2C1743BD6E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "414202502"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "231108034"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "414234494"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "231264010"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0024200fc65ada01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31087302"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31087302"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f628ea7d2261ff4185a67470b7a0d4f000000000020000000000106600000001000020000000960a4bd321c8c82727414a88e48feba019bae3270f69c7f10a288beeb08ee14a000000000e80000000020000200000000f075d817be6eef02b212910cd8555ddb16d18b219a95924f34c805625f7de292000000051df2e0bf821223560d743a773b0d900dfc6b825f1ed73ed2fb70d25cb53e9e140000000fb64e4a50236c4262fdfcc90fca0c07d3012db540c410738d4d16384f203d403ac64a8039b764b2368a7a76755fc8855c68987546acf410c3ea51b0630f8c2dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f628ea7d2261ff4185a67470b7a0d4f000000000020000000000106600000001000020000000d0c149c698b8dab80a03e6a6b60875a84759851e575c53c7212ec40d8c748d0a000000000e8000000002000020000000a0b6ba98d8a6273265692aebad52e81c69c901ed1f8aceeb000c94527850340f20000000b125ce7b367043eeacfe9a1dc2c05a57e893788e1f0f7e598695dd5e4bb2138b400000000b005ac650e9102b68fcc11bbc0e360b79dcb42797a64c63c641d1dcae57bd52aac9ad0508933f3060e08ef4026f42090de5b0af3cdd703f9743f6e961e7aad2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414185908"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31087302"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1526633464-1149972181-4216821683-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3744 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3744 iexplore.exe
3744 iexplore.exe
3800 IEXPLORE.EXE
3800 IEXPLORE.EXE
3800 IEXPLORE.EXE
3800 IEXPLORE.EXE

pid	process
3744	iexplore.exe

pid	process
3744	iexplore.exe
3744	iexplore.exe
3800	IEXPLORE.EXE
3800	IEXPLORE.EXE
3800	IEXPLORE.EXE
3800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 2156 wrote to memory of 3744	2156	MSOXMLED.EXE	iexplore.exe
PID 2156 wrote to memory of 3744	2156	MSOXMLED.EXE	iexplore.exe
PID 3744 wrote to memory of 3800	3744	iexplore.exe	IEXPLORE.EXE
PID 3744 wrote to memory of 3800	3744	iexplore.exe	IEXPLORE.EXE
PID 3744 wrote to memory of 3800	3744	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Korepi\config\config.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Korepi\config\config.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3744 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
f2ea59e07724463ec28b29768356eff5

SHA1
e3b55609f7d1a36d81693ed88ed09dfb6221edfd

SHA256
18785db1d77697125fef732d8199fa0194921afc2b917e0aa7b02a352984d4c0

SHA512
0ce0f557febf29eb4a68edd807e5221d3c74576d1a57fbd8240b232b3fbcf5f030ee7542fb234875c004f534a9ea179f6f76341996a0ef08878cc3b78918b5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
cd75146291c624ca26c6de8256bd53be

SHA1
296efb6eaf47335d9b0bff0aa95a88aa41bf2865

SHA256
6935a9bee6dec6597839423d79f0d20a517a3d9278fdfa82a24f2b51403b4f6e

SHA512
a7a65930660646d0b4312b5d7d40b65df3714c5a3d7a1fbdd29bcb8c6fe148253404b83b55f591a849f8937a56db3edf39684f125a208086f2f82614eb49d81e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRBVG1Q5\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\M8VWJG9Y.cookie

Filesize
537B

MD5
6563c0000cb78a6f033bbc7ef1a31976

SHA1
22eea37ca6cf9f1ac83a56653e9be160319a54ec

SHA256
3554d8df9dc4c6ccae13050ca8bf5660949f8d9f274126a278fdafc51dfb2a47

SHA512
9e12d0a04c65a27cc772d47317bbbb6db31f54e79362c35d54e5abe36e9aaabbf5321719b4c809e3a61f7ca47125009fb2b671f5307aa39d2b6ea7c9a25f92b9

Download Submit
memory/2156-12-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-13-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download
memory/2156-6-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-7-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-8-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-9-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-10-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-11-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-0-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download
memory/2156-15-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download
memory/2156-14-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-5-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-16-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download
memory/2156-18-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-19-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-17-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download
memory/2156-20-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-21-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-22-0x00007FF890B80000-0x00007FF890C2E000-memory.dmp

Filesize
696KB

Download
memory/2156-4-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download
memory/2156-3-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download
memory/2156-2-0x00007FF891AB0000-0x00007FF891C8B000-memory.dmp

Filesize
1.9MB

Download
memory/2156-1-0x00007FF851B40000-0x00007FF851B50000-memory.dmp

Filesize
64KB

Download