fc7c9456499166b70199f0f30b2274272fcfab47a4902b25db6ef371b8b1b2b0

General

Target

fc7c9456499166b70199f0f30b2274272fcfab47a4902b25db6ef371b8b1b2b0.html
Size

7KB
MD5

4e9a7e9a5b5991068df719042fc26197
SHA1

b16f061c81a3984a28b9f24940026f02fd10913e
SHA256

fc7c9456499166b70199f0f30b2274272fcfab47a4902b25db6ef371b8b1b2b0
SHA512

0e73bd41001263cec63816678526a6bfc3551a98bf0b8c4e2f1058b41098bac59331f88b05c4e049784873508bd7f3a528155f1ecff866ba25d2005a6f7b3c29
SSDEEP

192:9CJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLY:9sSGabMPvLddLXuSwSTLdlLXugfo2KaY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1C39343E-6B17-11ED-B8D8-66300FA194E6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f00000000020000000000106600000001000020000000e97a71a6d8aa4943bdf16ff5b94430c81c9526af24d41421a8af1a53f0c8d81a000000000e80000000020000200000005957ca979a17a8edace3d003f53e2ad15ed2e791a0dfef4f0f60baec920f06262000000096014a704636a9cf7f6e44915fd9c0152aa093d5b163db95b7b70ebd06f4947940000000d24e4358066836726938c1f6a126a64648ccb2d1f4c45d9c2b9e22ecbdec8fde782a024eaf551abbdfb50ad054ddccf0e8b7616ec0e83975286c100d9b5d6ebc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000000dbb2110c4d3d4898cdc926cc0a5a4390bfa47da0e4a1c62da58a0571225893b000000000e8000000002000020000000ee83ed69f2281d5d24a6df7b4191ff2420d01b251d28bbd63f9d00cabe8750572000000045e24340150076296ed380ed15162ce25583e2166ee3e7c8437c210c471a28ea4000000098bdc593778f69905c44c10f6b1c8ac059be5dcff7db5c81541f91d5c8a925c4b9a221ed492cd6585d624b10cd02d5baeed53aa206a92e88c2265451123f3055	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000002a068e743e9b0fc9da184357a8f9fcf6d36d199d396feb12329908f373d99cab000000000e80000000020000200000000756bf939645ef6a961a274a38952cebd6d2fbd19725f84131ce840f1beab56e20000000b76f65463017e95efd58bd517a88263d778d611c9e03bf6be10bdf3d5bab79d9400000002995c3c31dde3f9c4b4be06d27a53c11246cdf99f679a16ea2967838a8eaaada785dd2ef08886336cac3ab44a403f7c6b7e9cfb4032e4ed24f02d8af90673125	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6059460224ffd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08b2e0224ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404c9ef523ffd801	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3532 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3532 iexplore.exe
3532 iexplore.exe
4228 IEXPLORE.EXE
4228 IEXPLORE.EXE

pid	process
3532	iexplore.exe

pid	process
3532	iexplore.exe
3532	iexplore.exe
4228	IEXPLORE.EXE
4228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3532 wrote to memory of 4228	3532	iexplore.exe	IEXPLORE.EXE
PID 3532 wrote to memory of 4228	3532	iexplore.exe	IEXPLORE.EXE
PID 3532 wrote to memory of 4228	3532	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc7c9456499166b70199f0f30b2274272fcfab47a4902b25db6ef371b8b1b2b0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3532 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads