ec81794d8f3ad9ac45319c7c9f80abbb1771c9ff6670ee2e589d5f6594296577

General

Target

ec81794d8f3ad9ac45319c7c9f80abbb1771c9ff6670ee2e589d5f6594296577.html
Size

7KB
MD5

486eb03ad12ecab8d913e90c77ebf191
SHA1

8ab77e1b27e4ae335d53d782f9a203357e0f67e4
SHA256

ec81794d8f3ad9ac45319c7c9f80abbb1771c9ff6670ee2e589d5f6594296577
SHA512

b33ec175a55096d42605536e8d597c57aa440a85c4b96462ac85244f8bd872a2a47fe8aaa9e89d60c5e7bd0cc34e931fe38c46a77a3b460dadea096fa119c6f8
SSDEEP

192:rJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLL:dSGabMPvLddLXuSwSTLdlLXugfo2KaL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c7cc1424ffd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000473c15456c74a14eb56049c778c0810f0000000002000000000010660000000100002000000099ff00e358197eb0d7d36cacdf143043497bde4c3b78fdeedf321bb1bd07ab7e000000000e80000000020000200000001474b0bf320581cd99f47d8533584e7781e6c936b7b0139c2d2bca189555b02f9000000054357c701d981c97943797d367699169b43f685fa8c727533105b4b56d917bfdaf7cb69d1cc9191900376bda5d6ba44b6df6e217ca26ce8c6be4bc4be26fc3853fd0fe370dcec6108185ca48c8509aac880278523e3dc44db16af896e32e5cedc049374443d8210f3d3d6202384d76c75358998e683fb1b09ebecd008f50c1d510d60cc88a82db62d53a9135bfd78e234000000064a42cd88f867e7c46e11e5360711c4b373da783a28965428f36aa4c1078c41f61b916fe146ae5f253ce149c94d1ef040d3ff84c78daa243ee2ae459af4b2709	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EEC68F1-6B17-11ED-A674-466E2F293893} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963286"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000473c15456c74a14eb56049c778c0810f00000000020000000000106600000001000020000000b74046737d48f6e6648cf79f2b6e9e8e1bc26fe9d394566d23c59db8c1f8f8b9000000000e80000000020000200000007ec3109ef07925cd9e063c19fb25fdfb31f96fcc88064eb59e588af92f475985200000006f44f23d3a88021b9cac4fcbdc045aa0d3eaec572d12f02739a57e964e93cce640000000f9e3fc0fcfc9e3b698d05aadbc19ea1a4aeebebe1c0fcdfa84d845d064c10a3f63040be341634c45696c7a4799895f0a4634fca4545d72ce054968a9b6b06787	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1960 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1960 iexplore.exe
1960 iexplore.exe
972 IEXPLORE.EXE
972 IEXPLORE.EXE
972 IEXPLORE.EXE
972 IEXPLORE.EXE

pid	process
1960	iexplore.exe

pid	process
1960	iexplore.exe
1960	iexplore.exe
972	IEXPLORE.EXE
972	IEXPLORE.EXE
972	IEXPLORE.EXE
972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1960 wrote to memory of 972	1960	iexplore.exe	IEXPLORE.EXE
PID 1960 wrote to memory of 972	1960	iexplore.exe	IEXPLORE.EXE
PID 1960 wrote to memory of 972	1960	iexplore.exe	IEXPLORE.EXE
PID 1960 wrote to memory of 972	1960	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ec81794d8f3ad9ac45319c7c9f80abbb1771c9ff6670ee2e589d5f6594296577.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AJ9Z07QV.txt

Filesize
603B

MD5
3be4a187dea98e50b633ac858f0774a8

SHA1
9da8ba171f835ab9b002eeb526d960578ea2ed82

SHA256
bcb9cf0cfb928903ff1bce4269d4cf3d9e4d50a036085d857b91574afd85fe48

SHA512
b10538deaf7ddde4d942c0a3cfd50fb4b036c83c86b5b666951fb836981d752a12895566143e477ff52c0194815b4671c985a8efba3f52209eeda41ba05b4216

Download Submit

Analysis

Sharing