f94ac83ca87f16beb8dadebb57fc564a69c32416df82f5533699a395414356d1

Analysis

max time kernel
118s
max time network
161s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
24/02/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Astolfo-Beta/assets/log_configs/client-1.7.xml
Size

966B
MD5

c701003fd68e1c41ffd1671340cb175b
SHA1

50c9cc4af6d853d9fc137c84bcd153e2bd3a9a82
SHA256

dca9a1804df74776ddcb5f50ddc3f86fff51a656352f7990ede50fe74c988eea
SHA512

2e5b5c7ce036f2e36244f4dbc335bd4df5d0fc504305d147535dfdb565bb75da4b2f16666ae021c4ae5deb9364942981a64cab02db09d770fa9ca300856f1a89

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e366b14767da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31090503"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2936778820"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "415577591"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2936778820"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31090503"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e21cb14767da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31090503"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2944905250"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA87EAE3-D33A-11EE-81E3-FA3E2D6BDA98} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005cc9aed40953a94f8ac84af15fef74e9000000000200000000001066000000010000200000003b7e870b3c0e71471818ba65b0c3e58c3c90b4b99f9ca88b00062830ed7694cf000000000e800000000200002000000028b8402573913ee4f799663a6823bc220d1a9f2c4000341be2b63a9cb4fa36ac20000000fc854e26132f8bb989df9585387d38e9be1f281fb2bf436589f553ded93ca2bc4000000054f39927ba5236f718f16992a624a3da559597dba75ccc9dac278eaa1a87d1f624e480dc8da212e397235e74d8b885defc14226ece07250ddea586498eb73abd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415560997"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005cc9aed40953a94f8ac84af15fef74e9000000000200000000001066000000010000200000006381e5ef56f05aee7a988177a555e9cdfd52027e0b307649170d0efad4fb88ba000000000e80000000020000200000003a82fab59cb49694fca9482f3fa22b68c6df99393b7685df0c3c76603954570320000000b1b92d0e1d2b68df1ff51fea8e8adf562a77d5dba1312531cee061a44885dacd40000000da1b5cfd85ca82d8ba6231f10a672b50e014c3e8b675ebf6604d798a549e1555596a3568705bf22df172048624f5d23f5ca61bda3eaddfe529ce66b12854006a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "415609583"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1864	4888	MSOXMLED.EXE	73
PID 4888 wrote to memory of 1864	4888	MSOXMLED.EXE	73
PID 1864 wrote to memory of 2328	1864	iexplore.exe	75
PID 1864 wrote to memory of 2328	1864	iexplore.exe	75
PID 1864 wrote to memory of 2328	1864	iexplore.exe	75

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Astolfo-Beta\assets\log_configs\client-1.7.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Astolfo-Beta\assets\log_configs\client-1.7.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:82945 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
6690d1929f9b9dd0ff015b042a10d7e0

SHA1
9919422aad180ed27442bc421a453f22d0f1aa82

SHA256
bbc738df83670b7b947a3a0d6fddc46a0ffd0aead7ca2ea7d4b5ebf5dfc02343

SHA512
867f386b5a1011b0e72c20319fdd6701ab6713d2f9b34995bfe30c97dceffe253e8e5911f58ab706194019cc67f4a95df6b0d74843cdd4504a8b6e861791915f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
f19d54f95eab31fe7aa5706c09e6f77e

SHA1
f70507431954277bbdd5ea2fcc8f2e094ffb2c02

SHA256
be4ed30a90a538a4ee755c5cc695de1a2fd8280245e51b92063e7c408cf84157

SHA512
d716fa5cb7a27541afcd52f8e7264fbb8368d80a51aa787f2fdcaa4cf8f03351df30b7eef96fcb01cb423d51439ff739aa8de3d895b3f1e71cbd699745ac9e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QO128Z61\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\S10I3ICQ.cookie

Filesize
543B

MD5
0ab2e4e3fc73bb07b645ada3bb21f3fe

SHA1
c1b18fb6e8360ef6c6104a6e56ce2d841f210579

SHA256
5ffc1571965726cceb768a8baf2ddc933f36750d147d72499a55d3099c159d33

SHA512
7f726d039a8086655cfa9c09dee8b3da7d3b0f23301fa608c9017ac901409e28e9a0ddf0b45c9358126e2fc05e2534769ed5bcbd72fbcf38b5dfdc2c0e2bf445

Download Submit
memory/4888-14-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download
memory/4888-17-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-6-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-7-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-8-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-9-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-10-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-11-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-0-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download
memory/4888-15-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download
memory/4888-16-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download
memory/4888-5-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download
memory/4888-13-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-18-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-19-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-12-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download
memory/4888-20-0x00007FFF343A0000-0x00007FFF3444E000-memory.dmp

Filesize
696KB

Download
memory/4888-3-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-4-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download
memory/4888-2-0x00007FFF34E00000-0x00007FFF34FDB000-memory.dmp

Filesize
1.9MB

Download
memory/4888-1-0x00007FFEF4E90000-0x00007FFEF4EA0000-memory.dmp

Filesize
64KB

Download