f00aae20ab551c723aa9f93c87883b06c44327036d7fa9523610cf139758bf4e

General

Target

f00aae20ab551c723aa9f93c87883b06c44327036d7fa9523610cf139758bf4e.html
Size

7KB
MD5

4396c6162dec2ef21309826fd33aae40
SHA1

972f791eab55742219be2ec12ec92557631fd4b5
SHA256

f00aae20ab551c723aa9f93c87883b06c44327036d7fa9523610cf139758bf4e
SHA512

394803da97b04751e6660b708ca52c14275a07f2458ee7a674ba52c845cdbf6f332454ff3fa511a0a2e941f6675090bf8a39447bf3b4a239297ee2cb790e80cd
SSDEEP

192:sJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLE:WSGabMPvLddLXuSwSTLdlLXugfo2KaE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e6230a24ffd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963284"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34D0C371-6B17-11ED-B59B-4A4A572A2DE9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a01d38a78b65c448b672c61d4ae6fc8200000000020000000000106600000001000020000000224babb7a7c74a91bd52bf15c48f9c8bf2eb5c1eda4ad91b445d4b330b773d8b000000000e8000000002000020000000d2ed5c0cbbb322d765cb64a471fa1fbfbce90f2f7fd2c9e71d81045cbf5f817b20000000581cc84323fa7977e29b022abced1bb33965394c6b4534db56868e48a826695c40000000b61136d275e6ebfd284f3e45230269d1379ae0cbcf0696b1dbcbcc0214951c884cd130213a56005a69bd5f6ccbba429402c642b980e3e5c96d4b35b2c434234b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a01d38a78b65c448b672c61d4ae6fc8200000000020000000000106600000001000020000000dabf1b6b6ae8a7fcf00e7661d3c28aaffacde55012f1ea52cd8bd24995361e2f000000000e80000000020000200000002f62e201d4565d0d65ab044832153893a0568f2f0e92f8e280ec1235a764d38690000000db227f2e19768fdf0115032166cd75e16f393bdfc877509589319dd9958f4aba5df5ca7375459825aa532429edcb6a57bf65af2435d9bfc29e3dfb316080be2263015af00150a69ec7a420c4d3ef37cef55362b9f749d668c6f4726d81acd23809e24c307e241d1de95b8ee04204fd13643a6505ca427cd61e5bd0241f37aa698b20de2b1be29b88a94d7e5fd4e14d9940000000d4c54b661c619811578216354b52bada90edc4c4f124e9a489601094b552bc7dbe6e4d327399e6f3133dc11825a29b7de2bc27dd9ff888382da57be523d45193	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2016 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2016 iexplore.exe
2016 iexplore.exe
1148 IEXPLORE.EXE
1148 IEXPLORE.EXE
1148 IEXPLORE.EXE
1148 IEXPLORE.EXE

pid	process
2016	iexplore.exe

pid	process
2016	iexplore.exe
2016	iexplore.exe
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2016 wrote to memory of 1148	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 1148	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 1148	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 1148	2016	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f00aae20ab551c723aa9f93c87883b06c44327036d7fa9523610cf139758bf4e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WKSKP3F4.txt
Filesize
603B

MD5
4d982db30d85109ea86094aef7c31c9f

SHA1
06833bae71609a5e7f8f20bea19cd314b2f31420

SHA256
c11c866c9ebb167ecc69b3cf34a1f2a7dfef5f750a6e2a13827542b4ec4d0db9

SHA512
022f541838301a38edaf21a0a1a53e03bcc5e43ec816e51b0938a2509b05483b10ff109237bd9085f4ff19053cc6b5b33bf6b20104db44dbc129c20b50b42837

Download Submit

Analysis

Sharing