dd45c7ed295eae2570f883230732d3a9430250f18367ce363a68e5ff63133b7d

General

Target

dd45c7ed295eae2570f883230732d3a9430250f18367ce363a68e5ff63133b7d.html
Size

7KB
MD5

2755d4959154ac82f241e1e8ef588b11
SHA1

20ea5e5d18790152b05757ce8b696ba0278f1d1c
SHA256

dd45c7ed295eae2570f883230732d3a9430250f18367ce363a68e5ff63133b7d
SHA512

ec536a5b1d569c67602323b88ebdf8138767aec912800f4a37c89ea49f6786535af198a0e5547b536fe21423921b5bbab3acbe93ede426c3f2d49e6603cbbcea
SSDEEP

192:UJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLD:+SGabMPvLddLXuSwSTLdlLXugfo2KaD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f2527724ffd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f53bb39f42a64b8fe67d584a42aa5b00000000020000000000106600000001000020000000b5283de37489a92b73a4f62523b0a431cc605a8388d80e2a854ee1308d2ec0c5000000000e80000000020000200000009602aedb880308423b9fccf971ffea8ceb3d0302bdd17052a561d9afbb8b49d0200000000bf74642b9ac13a085711d0849dd1b23a9e5631678e2d9363a11168c8824a28e40000000f5763b99a27a1c0cae221007002010371f09321e3b06171d84e4186de1a409a1573c5e336b905cfeeddf6a0d58d91e81eee9f467f4a8a1fc40edbf00b443cbc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C866A60-6B17-11ED-98C6-66397CAA4A34} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f53bb39f42a64b8fe67d584a42aa5b00000000020000000000106600000001000020000000798529e09d0763ba244bc1c22b36043125c533c5a7be332170aae43fa2336ec7000000000e80000000020000200000005e980062b15b4a0013390c0f477f6ba59392501d07f9ab3bfbe11ac0a606d20a90000000f67d52fe413854175ad0570694691692a10c86f1d1deca1cc05cfd5e579eda7d7a9f5b6f390d94e527c39786b5e2c0f9bb1584eb0dd0057879aafab035110f52996a115782364defe89f4fcd7958a5950bea8a262849e88b646b4455337801c2826982d2857c46b9835d1d9f03a828b7c52c8a2adc1bd02d46927a512b531e509932de631ae54776d1bf076a36d7b2bf4000000017fdbdc24e6076cf7bebe03baf497079cb916223d514c2741c31fb514e31209c22686774b8b1df288d1d6b26360bb0f24cf13af9470122b63e99ac90513206dc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1368 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1368 iexplore.exe
1368 iexplore.exe
1120 IEXPLORE.EXE
1120 IEXPLORE.EXE
1120 IEXPLORE.EXE
1120 IEXPLORE.EXE

pid	process
1368	iexplore.exe

pid	process
1368	iexplore.exe
1368	iexplore.exe
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1368 wrote to memory of 1120	1368	iexplore.exe	IEXPLORE.EXE
PID 1368 wrote to memory of 1120	1368	iexplore.exe	IEXPLORE.EXE
PID 1368 wrote to memory of 1120	1368	iexplore.exe	IEXPLORE.EXE
PID 1368 wrote to memory of 1120	1368	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dd45c7ed295eae2570f883230732d3a9430250f18367ce363a68e5ff63133b7d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6H4FC7RY.txt

Filesize
606B

MD5
1291b48cec17fff662155a516786b466

SHA1
c81daafa129ac46f4465f2dd22780c73980e8eb3

SHA256
71b83f5a4b2cd75ce2dcb0bf4811b1b385c1296e2d3ed44b4f1092fa2ececb23

SHA512
90a8aa12eb02eef27b5cf60042d02f3693abf190dd8bb4912cc3253bf820207da6dc3896176b899a41a1013987e206d6e29712f6e53c3e68f1770c9da087559b

Download Submit

Analysis

Sharing