741ad4a402ca98e0c777ad3cfffa55cfbd75d7af2f23f9dad63d0ed236eeba44

General

Target

2a00d95b47cb04f233ce7351b842234410ec89c455f7515e8234b4d350b99406.html
Size

839KB
MD5

6742059d39462d81438ef4d97af53d43
SHA1

f6441fe1691cc77b400fadf210db421ada166b18
SHA256

2a00d95b47cb04f233ce7351b842234410ec89c455f7515e8234b4d350b99406
SHA512

ba92c3fbcb62c15008f146fde736fea857da02d776b13b8992ab8cbfce62d1ab1046e0cb0b1373d5092a4f9040853268df8bfda5e6faa14c970ce2e2a1a43ba5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1368 regsvr32.exe
2488 regsvr32.exe

pid	process
1368	regsvr32.exe
2488	regsvr32.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = a3c96f6a9050d801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "549035772"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c08dc6629c81e94884a7b92a3af1a6c6000000000200000000001066000000010000200000001c764768c924921a6148ce90e313e7213da175d71f612d77b9c55b061bfb07b9000000000e80000000020000200000004f3660e5b5a51d0bf88636aee87aa1087689235f60cda48b765a2002c2cda38a2000000078bc7b757cbc8bb2325dd32862b60aad02abefe9a02ed3c9f84939bb4c8fe593400000007bc05e77532d8bdf086a21976248a9cd159c83761618bb0527f350681f8fb1405da082997bd7faf4777e6663a7efc306e3db104821146a0fa0863f428327fd42	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c08dc6629c81e94884a7b92a3af1a6c6000000000200000000001066000000010000200000000a7e523a436826a3545adf8d102090298bec07c7bf865fce9c02f2c0611f3fae000000000e8000000002000020000000e91dc7b93b0480035ee3dc6851360b4d4fa823fb1efa345608f07f7a9d7b3d15200000001be0976e07fa276078f3620bbb5271f1e08f7b0183d67ab5a9f9b37a4b0264f540000000ac861911eec751799a860ab18d00d49353b8b116f275ce750565420c849b25ee95f42940f8167ae0d95926560d31dee182f1a7fedd0016c7eb68f8c9d95d7326	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364575632"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30971794"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{C4A19290-4F8F-44A6-B0D5-E97B7F1FF12B}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "549035772"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07b8a229297d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4C4D82A8-0385-11ED-AD90-764D0E3E719A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "560598416"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808e9d229297d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30971794"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30971794"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Modifies registry class 1 IoCs

Processes:

iexplore.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings iexplore.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2120 iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	iexplore.exe

pid	process
2120	iexplore.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

7zG.exe7zG.exe

description	pid	process
Token: SeRestorePrivilege	4156	7zG.exe
Token: 35	4156	7zG.exe
Token: SeSecurityPrivilege	4156	7zG.exe
Token: SeSecurityPrivilege	4156	7zG.exe
Token: SeRestorePrivilege	3764	7zG.exe
Token: 35	3764	7zG.exe
Token: SeSecurityPrivilege	3764	7zG.exe
Token: SeSecurityPrivilege	3764	7zG.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe7zG.exe7zG.exe

pid process

2120 iexplore.exe
2120 iexplore.exe
4156 7zG.exe
3764 7zG.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2120 iexplore.exe
2120 iexplore.exe
4032 IEXPLORE.EXE
4032 IEXPLORE.EXE
4032 IEXPLORE.EXE
4032 IEXPLORE.EXE

pid	process
2120	iexplore.exe
2120	iexplore.exe
4156	7zG.exe
3764	7zG.exe

pid	process
2120	iexplore.exe
2120	iexplore.exe
4032	IEXPLORE.EXE
4032	IEXPLORE.EXE
4032	IEXPLORE.EXE
4032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

iexplore.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2120 wrote to memory of 4032	2120	iexplore.exe	IEXPLORE.EXE
PID 2120 wrote to memory of 4032	2120	iexplore.exe	IEXPLORE.EXE
PID 2120 wrote to memory of 4032	2120	iexplore.exe	IEXPLORE.EXE
PID 2316 wrote to memory of 1368	2316	regsvr32.exe	regsvr32.exe
PID 2316 wrote to memory of 1368	2316	regsvr32.exe	regsvr32.exe
PID 2316 wrote to memory of 1368	2316	regsvr32.exe	regsvr32.exe
PID 5072 wrote to memory of 2488	5072	regsvr32.exe	regsvr32.exe
PID 5072 wrote to memory of 2488	5072	regsvr32.exe	regsvr32.exe
PID 5072 wrote to memory of 2488	5072	regsvr32.exe	regsvr32.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a00d95b47cb04f233ce7351b842234410ec89c455f7515e8234b4d350b99406.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1864

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\FXS_5979900\" -spe -an -ai#7zMap29584:84:7zEvent10448
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4156

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\FXS_5979900\1395\" -an -ai#7zMap3542:118:7zEvent11019
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3764

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" data\assets\images\ilHD.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\regsvr32.exe
data\assets\images\ilHD.dat
2⤵
- Loads dropped DLL
PID:1368

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" data\assets\images\ilHD.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\SysWOW64\regsvr32.exe
data\assets\images\ilHD.dat
2⤵
- Loads dropped DLL
PID:2488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
4e64144e228300de42014cbc16141081

SHA1
a8f013082dc51a1e6ab624fdec2628b2ac4b9e7b

SHA256
94333b66fadfb3b501b8cf09acad2a37c7ccd4bac4fac50987e26b87da49b334

SHA512
024c8564ecc30be3458308e990afde66c7e945592c7624752740d8202bae451829f0859cb8d1032a09f57613b656324321a7260324000757062fa4d8c414452c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
cb2ab60028dfdc02b5a2d9acc20c824e

SHA1
0df8f74b49e2a8e4d3722862784b5c9499d54e59

SHA256
4205a7178370b1eb5789e9bcd3fe0c9843b8412f8a114d6607feef06410197cd

SHA512
5bb7c2dd7097bb1c4fc6428534ea58bf66b166ae2944544002a9a8ee4e4899ba83a56f3846fcb8d78e0100ee7cdc0d4c1104cd832db0f9f6683c908de7c21952

Download Submit
C:\Users\Admin\Downloads\FXS_5979900.rqvosm0.partial
Filesize
457KB

MD5
f9df78130be1d212ded36a820be9d61b

SHA1
e0abc1483e65d83fe3414fc8ecc734473a0d9b78

SHA256
d3355c4e4f690977831dbdb223cfb0b861cc6f06cf359e2da88efa6e205d13d0

SHA512
0bad7d5ca6fcc6228efbe88eea952cf1cf763c459403f44fae9cc9e0fa3a6709ed1154ddf8183965c32202feb2142291e9f995be7ddcd10258bbcba63390a7ae

Download Submit
C:\Users\Admin\Downloads\FXS_5979900\1395\DATA\ASSETS\IMAGES\ILHD.DAT
Filesize
670KB

MD5
1f7dd197ecf193e23a0c329568c65696

SHA1
556615a28102c40f67c9d09c828675bdb950557a

SHA256
01090ff0d968128575357b9841a3a8d6837b6e13c7b309f656f4543a2181b551

SHA512
221c549f6e9e3f3e96957bcf84085a5882efc394e16a6d9a445c1a806f55f46cabd3ddaf2eafb6f9b6ef7821c0647ee345c27b3b000ec21abe91bf215e73fca8

Download Submit
C:\Users\Admin\Downloads\FXS_5979900\1395\DATA\ASSETS\IMAGES\ILHD.DAT
Filesize
670KB

MD5
1f7dd197ecf193e23a0c329568c65696

SHA1
556615a28102c40f67c9d09c828675bdb950557a

SHA256
01090ff0d968128575357b9841a3a8d6837b6e13c7b309f656f4543a2181b551

SHA512
221c549f6e9e3f3e96957bcf84085a5882efc394e16a6d9a445c1a806f55f46cabd3ddaf2eafb6f9b6ef7821c0647ee345c27b3b000ec21abe91bf215e73fca8

Download Submit
C:\Users\Admin\Downloads\FXS_5979900\1395\FXS_5979900.iso
Filesize
842KB

MD5
dd084d0ac9942ddd3e233a7fc8bc6ad7

SHA1
eff46ccf03925ff6159f9e21314dbde57cba0727

SHA256
d35d5a00e32f57eef75079a7575e49e5f95d13bfc0af02baf9bce6aa68e8604d

SHA512
868a5238554a8ed0269bc2d174a2eba187b9a805f1a3065ffd4f6f90e1adc8b3e4ae81aa655362e5777a9ba7c8d30ecdc976d40b69650ab10a1b47c83ff7d4da

Download Submit
C:\Users\Admin\Downloads\FXS_5979900\1395\data\assets\images\ilHD.dat
Filesize
670KB

MD5
1f7dd197ecf193e23a0c329568c65696

SHA1
556615a28102c40f67c9d09c828675bdb950557a

SHA256
01090ff0d968128575357b9841a3a8d6837b6e13c7b309f656f4543a2181b551

SHA512
221c549f6e9e3f3e96957bcf84085a5882efc394e16a6d9a445c1a806f55f46cabd3ddaf2eafb6f9b6ef7821c0647ee345c27b3b000ec21abe91bf215e73fca8

Download Submit
memory/1368-135-0x0000000000000000-mapping.dmp

Download
memory/2488-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads