71bfe1f26a98e152344fe5687db229da90e9ba8475cb3804a78a0f46152ba0bf

General

Target

pack/publicKey.xml
Size

397B
MD5

2e232ebbe224269490bd1c7f5782c87a
SHA1

ecb172e020e9bbe8b02283750488d767f81776ef
SHA256

932c42f739cd975a3bfc360fa1876265d45e9e8124faa7d18d36796f310204ba
SHA512

c3f9d274cab96708d9ac8cf485662f0559a2e5e359a1e8a12c36ebdbbe01511ccb3fd8ee016efaf3a78a5a9f3c02ad8c3cf81ee12203a9694fbca7fa6b4fca8b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31103548"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "568135793"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

MSOXMLED.EXE

description	pid	process	target process
PID 2672 wrote to memory of 2596	2672	MSOXMLED.EXE	iexplore.exe
PID 2672 wrote to memory of 2596	2672	MSOXMLED.EXE	iexplore.exe

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\pack\publicKey.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\pack\publicKey.xml
2⤵
- Modifies Internet Explorer settings
PID:2596

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-2-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-3-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-4-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-1-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-5-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-6-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-7-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-8-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-10-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-9-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-13-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-14-0x00007FFEB9390000-0x00007FFEB944D000-memory.dmp

Filesize
756KB

Download
memory/2672-12-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-18-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-19-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download
memory/2672-20-0x00007FFEB9390000-0x00007FFEB944D000-memory.dmp

Filesize
756KB

Download
memory/2672-17-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-16-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-15-0x00007FFE7AF50000-0x00007FFE7AF60000-memory.dmp

Filesize
64KB

Download
memory/2672-11-0x00007FFEBAEC0000-0x00007FFEBB0C9000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing