7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6

General

Target

7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6.html
Size

1.1MB
MD5

6033e14dfeb0699ee4c1bd6b9c5ea95f
SHA1

a5e5776da0391a064cbe823822956c0137cef76a
SHA256

7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6
SHA512

b2a5f6543eb830b675cdad7041d5529634ccdcf6ce8de89d98cd7cddb8adaeec56d6f9104d92808d276f2e86e7015a2918fecd8e28b41c5913e511637f264c6d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d0febbe73d98d801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364649436"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206a8eff3d98d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009802377df4dfb645a111ad4466fa507200000000020000000000106600000001000020000000679135a90eeb4b12fed7e8d36feff59618d8f0178c849533029a0667fa5f7d3e000000000e80000000020000200000007b08b125488b50ed34c9f3de972b9fe8ed110747d834e033cf6aea050d05b483200000004f1aa8d8142da56bd22b107eb94e3a8a55109e7ec8cf70852930078abe90c2e64000000043b28337f565ab6cb485da62061eb43f4c9c987baafce76c6979cc30e4f8a20f11dc484fa8ef572682d83c0310f16aad20c1bf6f57580c5b6522fa0d484ae817	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{228DCB61-0431-11ED-AEC7-66E616BC8074} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009802377df4dfb645a111ad4466fa5072000000000200000000001066000000010000200000002db552dd44b9a2a8e15d15f87e7cb7873cee6f59a47586801d7d176b167b3bb2000000000e800000000200002000000008f0e83a70ed99eb044117dd127449879beb23ef66b46d60a91363bc2cd744fa900000007a89b414f76b23d8df966f5841b15844d6c261a274ec74c94a816ed5750ad5d2ba7f006b936da2e1c22ee76b9cfda09ce9243c81960278a5ada39e0415bddfde3963c1d053c8bb60d224f12f43108896688d149868871790fdf9e21504f55e5b6afd5ed5399957c5c0bd86436e5db75245d122cfd7558d0f90633765ba6bcdc71727622fb7d61e868eef0529d14197f240000000b6cb4e3d8099d85d4c8a9eff3ab9c0bbf6770821b1d01205d378c2eed2284f08328827bdfacf55bbb629efff8c4b11f707ec59a578884e2d72111bf06be6a78a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1936 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1936 iexplore.exe
1936 iexplore.exe
1088 IEXPLORE.EXE
1088 IEXPLORE.EXE
1088 IEXPLORE.EXE
1088 IEXPLORE.EXE

pid	process
1936	iexplore.exe

pid	process
1936	iexplore.exe
1936	iexplore.exe
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1936 wrote to memory of 1088	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 1088	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 1088	1936	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 1088	1936	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c04f20104e661f361144cb549006e3fd7d3f960d0c410627bad2a795401a5f6.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7a157fa6176c6312736538a703bb6eea

SHA1
1132bbfedffb3723e0e32cc7339bea00a7cd8d63

SHA256
ec37021dcbeb5bc1c8293fe04d36f9f024bf119a9a97ba68a6f31fc7de9c34a1

SHA512
e43ba0e0caa5f1216e71161293027d12eaca16e68462a1f374e615504098d6fe36ca75430719736a3989fa3dce5c98d4e9a00a030247aa4830c3f75b038a323e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QN73D04T.txt
Filesize
603B

MD5
feff8898ef57363ca69a7c5f761d2547

SHA1
25028791f9a210605eda994c62ff096d1d233c41

SHA256
4e9d34d72072b32551f339a87b7fa8e47b5186ca2e259d34fb19a8a988a45ee8

SHA512
9f440049da404b70f0a3d347527bd1206f8426113df447ecca2f741baddf43d480b8271d1f4b3bf90d7871f89801e7d8e6a66d1930ee1321b2646606dda8f2c2

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads