e55e68f63e103f6a39a08d6c15900d13faedf3eb9ff6af0e19e997908585e54b

General

Target

Note514 ‮‮‮fdp.html
Size

1.2MB
MD5

ef32cbeb73aa743a027ae3ff4e43f020
SHA1

a32c5b965234c575b645969724a76d1e0f5b9409
SHA256

e55e68f63e103f6a39a08d6c15900d13faedf3eb9ff6af0e19e997908585e54b
SHA512

fca307f4d9ba330909192aa86e67f3bc3629ad4cfef95c41da6b401daf24406adb6ab16cb14b24a078319c6c9688b80caf614d8fa4c8809a6b68c4b88725d569

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4D027F2-2D04-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307e51526abfd701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000880b721a5b6e864eb3ee85cdf41bbd4d0000000002000000000010660000000100002000000059e2f1dbcc0d2326b4985db8e3efaec40c2cdf1c95aeed08905b970fa0077acb000000000e80000000020000200000003a513a56f570202828ed0e434f19c1db932918f5cca242c017f60a13efe0a56a200000005363e1bbc47b9600f419e39cff51ebd454c2c04e30b207296f6ce873d0a09a074000000095fadeda417ac78e21897c20fd84bdc2995192de4ef363f88016b966af2202515792f234056476faedd926d2e4780db878fc4b72eb61ecf23ce0a694f62ddda5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000880b721a5b6e864eb3ee85cdf41bbd4d000000000200000000001066000000010000200000005c2d0c8b36d6d2f6ed12b81b52653258dd4f4ba95adeac68bafd7f350d34056b000000000e800000000200002000000026589093dedbded3f71dbe084a3255f0bb980b0a92f3e1675cf03aef8e42ebca200000002ffb0b0bdf674aac5369233ddb11d722823d5fbbe656c1ed8c7dd578a2c2653440000000cba05e6db4751d9ba4c0314a63faf30cc81caa581e8c9efccdf21d3d3c88e50a8ae1874b6a82db1e6cbe9b44c8065f06e6826d4aa05294b858137701caea2273	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f046d2526abfd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3128 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3128 iexplore.exe
3128 iexplore.exe
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE

pid	process
3128	iexplore.exe

pid	process
3128	iexplore.exe
3128	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3128 wrote to memory of 2508	3128	iexplore.exe	IEXPLORE.EXE
PID 3128 wrote to memory of 2508	3128	iexplore.exe	IEXPLORE.EXE
PID 3128 wrote to memory of 2508	3128	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Note514 ‮‮‮fdp.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3128 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-140-0x0000000000000000-mapping.dmp

Download
memory/3128-136-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-168-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-118-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-119-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-120-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-121-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-122-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-123-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-137-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-126-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-127-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-128-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-130-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-131-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-132-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-134-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-135-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-114-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-124-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-116-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-149-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-142-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-144-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-145-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-147-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-115-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-150-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-151-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-155-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-156-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-157-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-163-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-164-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-165-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-166-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-167-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-139-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download
memory/3128-172-0x00007FFAA4650000-0x00007FFAA46BB000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing