14218d8395a4614f8fc569306f45eacd8f420d9aeed3a5e830af66ca316aef93

General

Target

windows11.xml
Size

3KB
MD5

7b3fdc510b05e52c1fbf6251419ed77d
SHA1

d071bbc57141f85341be39f6352ad94860527538
SHA256

14218d8395a4614f8fc569306f45eacd8f420d9aeed3a5e830af66ca316aef93
SHA512

3a692d7a049a9c161a0400662b868f6ac4e2aa40ab816823864e4359d8ec9e85d31572a4cab2d3d7ec782fea63150614da76b13ffd18154b5ae8fbf13c445a35

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31108290"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "23694380"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

MSOXMLED.EXE

description	pid	process	target process
PID 4284 wrote to memory of 2744	4284	MSOXMLED.EXE	iexplore.exe
PID 4284 wrote to memory of 2744	4284	MSOXMLED.EXE	iexplore.exe

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\windows11.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\windows11.xml
2⤵
- Modifies Internet Explorer settings
PID:2744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4284-0-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-3-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-2-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-1-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-4-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-5-0x00007FF8F8303000-0x00007FF8F8304000-memory.dmp

Filesize
4KB

Download
memory/4284-7-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download
memory/4284-6-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download
memory/4284-8-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download
memory/4284-11-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download
memory/4284-10-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download
memory/4284-9-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download
memory/4284-15-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-14-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-13-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-12-0x00007FF8B82F0000-0x00007FF8B8300000-memory.dmp

Filesize
64KB

Download
memory/4284-17-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download
memory/4284-16-0x00007FF8F8260000-0x00007FF8F8469000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing