d632fdce6105ea56fbe4f1c8a9fa9a703749702b3b6c719656b27fd5b6b206c2

General

Target

d632fdce6105ea56fbe4f1c8a9fa9a703749702b3b6c719656b27fd5b6b206c2.html
Size

7KB
MD5

4a32bfa82fd0622602d082d05936a2b0
SHA1

7ab0baef5aaea471f249db23edf9e995aa4d13d6
SHA256

d632fdce6105ea56fbe4f1c8a9fa9a703749702b3b6c719656b27fd5b6b206c2
SHA512

844848b81efa516f0d9f1ebb0b944ef63f85f1902ca3d43128015cad814094e8073b749baf1472bec21564a364c709a788e274bf7160ce16081bcdcea3502162
SSDEEP

192:7JSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLS:NSGabMPvLddLXuSwSTLdlLXugfo2KaS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDEECAC0-6B17-11ED-B40B-E20468906380} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009cbfea31f6287f45a5d69d2d6e220ae5000000000200000000001066000000010000200000001cbe03fe68df2b818e7eb25e01126bdb039d457ebc6c15d965276725a9b4b3db000000000e8000000002000020000000102efaf1a20fac24b0172a3655a608631508bce7ea44f70e1a3ddf2dc7d877902000000031ec8e2d1a82f5f1a11eb05caf410355d4bb53e5101936bc2fefa9fe86f6c8e940000000486187666036498a795e36d076ab28277dae3103adb48b5ed65abc6f540deb7907b57598acbbe413de9ddd9425097763b076397ccf7c6cc208687878957dd37c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963532"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009cbfea31f6287f45a5d69d2d6e220ae5000000000200000000001066000000010000200000000221b501d46a727238e999a41de0e25cdbc51a66ccc2707698dc8f52eb051296000000000e80000000020000200000007c3173ea0849237cbf53bd9a59de8e7544efbd4297e5f77aa61179f8b9d9033e900000005e1efa452f3401b43186d74fa86e2d3ca217b4a9189a1e6dc976d0d2cee5b8a0afbb2ec393608b3756be8a89bfda672e2b6a2f092966d3fce335665587588599b33f3da3bb8910e7ef43817a13964dc6d6b0024f8c78eff8428d833bef152d3f456f987ecece3fa9ac06edd3069621fbbdd9b52bae90dbb828c8ee75cb1aa59dcf5221eedf69063eb89f5299a792d8924000000081d9189282de83795fa4354bd580e9207c6c4a410e093ea1a922153509881115ade2bc408546103678354b2a747a751f9684f67de527686a6e0b198e159df05a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ad04ad24ffd801	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1460 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1460 iexplore.exe
1460 iexplore.exe
1104 IEXPLORE.EXE
1104 IEXPLORE.EXE
1104 IEXPLORE.EXE
1104 IEXPLORE.EXE

pid	process
1460	iexplore.exe

pid	process
1460	iexplore.exe
1460	iexplore.exe
1104	IEXPLORE.EXE
1104	IEXPLORE.EXE
1104	IEXPLORE.EXE
1104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1460 wrote to memory of 1104	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 1104	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 1104	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 1104	1460	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d632fdce6105ea56fbe4f1c8a9fa9a703749702b3b6c719656b27fd5b6b206c2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4080Y428.txt

Filesize
606B

MD5
55979f86e689c9193b63bd5771761f84

SHA1
7d0d030cb683d18be64a511057aec44fb5a5c3f8

SHA256
92a7489bdbfc0ce8f6c0c5fbf1c4b4fc84daa2734e5be7401b8b09943d1583d6

SHA512
36a6d9be3debeacf695898d4f76509ffff102dfe5e31c802ad6ce12b8f3b4e8d58e9e35a6f4556c46e6aaf0d60dfd2e787d8d56116381a0874ea67f8fcd0d4e9

Download Submit

Analysis

Sharing