71bfe1f26a98e152344fe5687db229da90e9ba8475cb3804a78a0f46152ba0bf

General

Target

pack/privateKey.xml
Size

1KB
MD5

0d192c21ea5ea6edbc046fa6217567c4
SHA1

6b648a7adb79a19fd095b9e951477458577721f7
SHA256

b065bc372314f2a606da7c3cd2264bb25a3576a7067095e141eee2e5e4258ec1
SHA512

8faf5559d904d190278662a31d820adcf1f112fde1946422099735b4e6348c7ebbd9153cb9e6eb84ecbee1075320c6b0ea77f141363d0bf1df8106bd37055a22

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31103546"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "4116479821"	iexplore.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

MSOXMLED.EXE

description	pid	process	target process
PID 3344 wrote to memory of 3744	3344	MSOXMLED.EXE	iexplore.exe
PID 3344 wrote to memory of 3744	3344	MSOXMLED.EXE	iexplore.exe

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\pack\privateKey.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3344

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\pack\privateKey.xml
2⤵
- Modifies Internet Explorer settings
PID:3744

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3344-0-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-2-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-1-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-4-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-6-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-5-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-7-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-3-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-8-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-9-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-10-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-12-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-11-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-13-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-19-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-20-0x00007FFDF9900000-0x00007FFDF99BD000-memory.dmp

Filesize
756KB

Download
memory/3344-18-0x00007FFDFB9C0000-0x00007FFDFBBC9000-memory.dmp

Filesize
2.0MB

Download
memory/3344-17-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-16-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-15-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download
memory/3344-14-0x00007FFDBBA50000-0x00007FFDBBA60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing