8cfa05a7a48e42663dcb9b5303bff6c8832ce7345fa9c42f42f6a69f7134da7a

General

Target

8cfa05a7a48e42663dcb9b5303bff6c8832ce7345fa9c42f42f6a69f7134da7a.html
Size

7KB
MD5

cd285d323b5dbbaef1352f198d336aed
SHA1

6493f4f7b9f1dbb9730d4538e872db3d134609f2
SHA256

8cfa05a7a48e42663dcb9b5303bff6c8832ce7345fa9c42f42f6a69f7134da7a
SHA512

23402e93e155380e89d49bb5811b76dbb9acfe8e91d1fb179dba5404944273eff192bf35ea7dbb7f3d17e7dfbad5c332eed0b8ce3dd18af57d84b931ae1a8d45
SSDEEP

192:HJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLx:pSGabMPvLddLXuSwSTLdlLXugfo2Kax

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6ECCBFA1-6B19-11ED-99B1-EA25B6F29539} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bdaa4426ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1a41cfe3a5ce248acb33abb38f6801f00000000020000000000106600000001000020000000bf33da37187c1441602c4c62ea4651763c8228f9cd127aed94fe315b3e306da8000000000e8000000002000020000000c1b2ed6774800a4215803d5bab05849734a5fddcaeaf6fae1626cf36f13d53159000000016f544b119d8152a38b488a9625808c48d01e2d637c86a073a9815cbcbb1ef1d988782b9aca5fc5fe8fb909f5cc44edd2f2b1eac97cd78cfc988c199a8771903af9359be277aa5e604a8cc3556366439ce16ed5f7b66e2377569019fd44d878bf90a419d101ffe3731adc9b53cb5259cb8e250bdf3cd0abc0ac79ff5428ef92205c183f3201496d59fc2c53ff36ee8cf4000000013883f320840c9c97997359dc6a41d51d22d1b09f23c64c6632bc5fcf87a11552309c2a35dd735d1bddd95db376399a09c76e12ec06c8a2cbf9e04e7abfb9eee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1a41cfe3a5ce248acb33abb38f6801f0000000002000000000010660000000100002000000094f47732b4cda45be1b00c2eced39b72f3f72b8a1f001beb6ce436e0a91635a7000000000e80000000020000200000006cba82c385fcda994ed8580afe1fda65952aa55ac5172ff65c1dfb8538bb378d20000000d6011d99e846d61222e71c09ba4f6884e53f9ab430649a8a41dd5c8cf5b2ce3f40000000704f10fa35f87ec3aed228c52bb180ec539370f13165b87ab2fad8d806fcec1b98c8cfb75872e37352dcdef41dc92f710ce46abc34603e0c35233a55ca379b9c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1604 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1604 iexplore.exe
1604 iexplore.exe
1096 IEXPLORE.EXE
1096 IEXPLORE.EXE
1096 IEXPLORE.EXE
1096 IEXPLORE.EXE

pid	process
1604	iexplore.exe

pid	process
1604	iexplore.exe
1604	iexplore.exe
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1604 wrote to memory of 1096	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1096	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1096	1604	iexplore.exe	IEXPLORE.EXE
PID 1604 wrote to memory of 1096	1604	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8cfa05a7a48e42663dcb9b5303bff6c8832ce7345fa9c42f42f6a69f7134da7a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\M7RWWOHU.txt

Filesize
608B

MD5
fcfa5c9033e74d2f3f3e9854d7e654bd

SHA1
d8a5aad54c8d5f2f73986b1fef5204932830963a

SHA256
336627db37032fe6cc9fdca36a25cfb03e03e2a8c585593f7fa3afe56137c17d

SHA512
5df8e142195b75df24b965e485984445751166b667d5b1163f03ff66ff5cb305eaff3a91683ccfa17032fc24599fc073d3eebfeebe1048949ba261e1e9270ae1

Download Submit

Analysis

Sharing