d3bffefb1a8eef9b8b73076b2408e5cdf35c01eb74f0aeb61aa5ae0fdea9f8ca

General

Target

d3bffefb1a8eef9b8b73076b2408e5cdf35c01eb74f0aeb61aa5ae0fdea9f8ca.html
Size

7KB
MD5

b9592d1ccf5840887a9b5dfe9555450f
SHA1

022e4fd141ad2a4e6cf1cfdc91d7aaf7e4ded269
SHA256

d3bffefb1a8eef9b8b73076b2408e5cdf35c01eb74f0aeb61aa5ae0fdea9f8ca
SHA512

6f7f84d65d5d59b47aab12bf712845950412febf5f7f097992178940706f5bbbd02b61cd208862b7f7575565954c59eff60f7aeab26acd7873559489a03d58ed
SSDEEP

192:SJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oL6:cSGabMPvLddLXuSwSTLdlLXugfo2Ka6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f8c6b9adcb47842a7b361c91962931b00000000020000000000106600000001000020000000a91b7eb7f9df94a4ddd8b352759eb14a2beacd2277b02d37359cc72c4040975a000000000e80000000020000200000009db0fad5b5067d59dfae9966d75cd77f12d177a0ff57597f5acc566240dd184820000000ddec150795dcd7827b070683b4e073ec3820379e3350e6d8ad2d6bd2391791d94000000093fbff532b96a49e84c9e8f23ab6ad38b13201dc8d092d645ac8d1dee97f489662f4f616a5d739f4c1243f7194a03714c43092f70ec15e3ea5219671ac2ca79d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f8c6b9adcb47842a7b361c91962931b0000000002000000000010660000000100002000000049c0a89f49ea63423eb5212789427cf57e83cdb82018e4bae0ad94d4a0951ccf000000000e800000000200002000000060c835552ec50835d9d7cf6b107529da3bb87b61fda8a249b0d515896500527290000000cf8167dd21cafeba509cd7d280114bc64c312e05c8054ee94df5212b779fe376f2e57326a0cc1b2cbce3ccc865ee4f0895cc9ebf4d191316fc4dfa87766458f769ba8036500423456366504ff9601d32317f33087264c34c4d2946f4501bb684b0962ed0662ebaa769bd9ce60634ebbd4e97b6724e595a354c51e102fb46372abd1608919bf751db44c395cd70db9495400000005bc260784f5d4bcf35c7bf0eb97709c6b7ac7643f68a7b5b3b1b9919fd0b10820fe6be2af42862517574b0adc3dd036a0babe78f0afbf60a643535d2a130252c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000b2aa924ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963545"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3337C61-6B17-11ED-BB27-6A94EDCEDC7A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1840 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1840 iexplore.exe
1840 iexplore.exe
1060 IEXPLORE.EXE
1060 IEXPLORE.EXE
1060 IEXPLORE.EXE
1060 IEXPLORE.EXE

pid	process
1840	iexplore.exe

pid	process
1840	iexplore.exe
1840	iexplore.exe
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1840 wrote to memory of 1060	1840	iexplore.exe	IEXPLORE.EXE
PID 1840 wrote to memory of 1060	1840	iexplore.exe	IEXPLORE.EXE
PID 1840 wrote to memory of 1060	1840	iexplore.exe	IEXPLORE.EXE
PID 1840 wrote to memory of 1060	1840	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3bffefb1a8eef9b8b73076b2408e5cdf35c01eb74f0aeb61aa5ae0fdea9f8ca.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NQE3913H.txt

Filesize
608B

MD5
b3ce4d8a8a68128927f6d382c24f082e

SHA1
dfb3a5e8b299fe0036888261d223c083da966500

SHA256
a869a60331f50d485d6c4cfcfe1d442505274ca0e682ce2740f69a38518e8e95

SHA512
80fca160e63b0ee526832346154bccaf5c4f785c73a277f5e4d287dddb1f93cb3861c65f7ba5f4c5dc3a65ff35629cac94f0cef2fdb53c8e25cd8b91b0f357f3

Download Submit

Analysis

Sharing