f4c0fdcc5b0a4f27af58e52571b63b121d09ae37f5d9772d68c2912f6c2ae58b

General

Target

kingSeaCaroline.hta.html
Size

3KB
MD5

fc60bfbcfb72c73cf4380e3d69f8ff30
SHA1

ec4c91db6a6459c765e90db04294094f264d28c3
SHA256

f4c0fdcc5b0a4f27af58e52571b63b121d09ae37f5d9772d68c2912f6c2ae58b
SHA512

f21c3e33042434d1bd0a4ff74210a280f5f30b8c36f0b5623f1659e8f0ef7a5c79a643864b1e6032fb69485a8c7dd10d983640784d678b8d04688d4a315f675a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FFA030C-3525-11EC-B8A2-56739040C57A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09ecce8c5c6d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb000000000200000000001066000000010000200000004b3fd53113b961a82213f64bf49e90718581b1316f9249f459011eda4ded57a9000000000e80000000020000200000002a755cdd1c16643bc2d93921b5c9d7027b176607e6aeef1b804fb111c6f0440420000000eae6f9806a02185f1970e8447d63c05daa47474ea006b12fcdc61eeae312d97740000000b8fcaae4905a523da77c74a7accbb0c96988b3307bd7096bb3bfa7c22ad8726c600da66e841f1ca8ed7164fab988d6bfe7ac786ec6982f877976991048a9d26f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20abfee8c5c6d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f9406ff0332db44b36b7a7c571692eb00000000020000000000106600000001000020000000e508e5b7de244a170f8f8f7b1404b09a066a87cb009f5502e76757854baa46d0000000000e80000000020000200000008baf50169c365e938e167e6668fa6d4b8eabf75a370a11bfedeab3f1bccd7ea920000000df3e97a3c193a678414b84370ca9e476d7ea08c9cd5469047c0a8a59b98741de40000000607c614c73fc48441480bb464fae5400a1c75eb7d15afddfde27c583527a1378d775ea02179a54cf8e7d7db70d5f0b3bb037d9e4bc7a0546c774c6b790e27b30	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4136 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4136 iexplore.exe
4136 iexplore.exe
4220 IEXPLORE.EXE
4220 IEXPLORE.EXE

pid	process
4136	iexplore.exe

pid	process
4136	iexplore.exe
4136	iexplore.exe
4220	IEXPLORE.EXE
4220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 4136 wrote to memory of 4220	4136	iexplore.exe	IEXPLORE.EXE
PID 4136 wrote to memory of 4220	4136	iexplore.exe	IEXPLORE.EXE
PID 4136 wrote to memory of 4220	4136	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\kingSeaCaroline.hta.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4136 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4136-137-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-165-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-117-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-119-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-120-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-121-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-122-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-123-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-124-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-125-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-127-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-128-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-129-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-140-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-132-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-134-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-135-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-136-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-169-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-116-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-131-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-173-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-143-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-145-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-146-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-148-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-150-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-151-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-152-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-156-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-157-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-158-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-164-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-138-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-166-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-167-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-168-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4136-115-0x00007FFF30CA0000-0x00007FFF30D0B000-memory.dmp

Filesize
428KB

Download
memory/4220-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing