5d9765c2320a515f8f957bd626b5502258e63524f862f7c4c681d74dbd9c20f5

General

Target

5d9765c2320a515f8f957bd626b5502258e63524f862f7c4c681d74dbd9c20f5.html
Size

7KB
MD5

beae1bff7b077c2b158a1c67986a0ee0
SHA1

636b252457c87b34cec58bc940da679b5c4c5e61
SHA256

5d9765c2320a515f8f957bd626b5502258e63524f862f7c4c681d74dbd9c20f5
SHA512

b9ac5dd68b236da25fec6591ffe074773c075108a15d5bd558e419f8c4710fc010561cac21290f7858939973662534c36da09cf8fecd0bc649a4036a3d397304
SSDEEP

192:ZJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLR:LSGabMPvLddLXuSwSTLdlLXugfo2KaR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d087f43e27ffd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9811f29cf83f842a2bd1ec914de2cab000000000200000000001066000000010000200000002d4a0ebf9eb8ce243e309dcf8168abd7744533c0b5cf7150726fb98b48c74c2e000000000e80000000020000200000003803dd76c08c8ab8d1a661aa1815f6f4e480a76b5cb4fc8f01a3cb97d14bc57790000000ef7895a16fd908253c6ff57f96f1f2e971f8a0ddc4ba46b5d6eead6172f9d235d014afb024e88b03e2ad5b6ac725759f1f6ebe000ba56500d0897bf077ba98be0c9e4aa35aabcfe68fd7d3414f6a9efcb16ee984c777fe2292a27da5ccf25284f3d6ff8b736a945d03a6405e920c50221b07f11dbead9f2495b1ef7a989984d3a06764439dff852e209d49f760a83eee40000000eef9e777f47fb4e0a4981f3efaa7b0a4f8aa5e65c453cf42e316d7ead526b22e0ff0e6bb2d87b3dcb0c9657e0df73776990620dd88d4006b97d98fbcb6a31b19	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6642D0D1-6B1A-11ED-84F9-5A21EB137514} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9811f29cf83f842a2bd1ec914de2cab00000000020000000000106600000001000020000000b8e5990050e7f6466b663f2baf4a1659789a027ab68aca79888b1f51e4d01da1000000000e8000000002000020000000a0c06a2dde288f942a8969a418d4e98eaa268bb92456fb01a0cfc92f77e93c1d200000008c67a9fd0e11f8aade197bb078c1d320be2f1fb589477ce340c085a6af3915c440000000aa4f0d92f6e6a60234b9caf02dc2bc678c3442fa39bd3db34a4860839740a931ac5c11e069e8d8db9437f4615a134f01d308c9bdf3b2de2dddf662ff0b902ca2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964671"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

900 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

900 iexplore.exe
900 iexplore.exe
1724 IEXPLORE.EXE
1724 IEXPLORE.EXE
1724 IEXPLORE.EXE
1724 IEXPLORE.EXE

pid	process
900	iexplore.exe

pid	process
900	iexplore.exe
900	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 900 wrote to memory of 1724	900	iexplore.exe	IEXPLORE.EXE
PID 900 wrote to memory of 1724	900	iexplore.exe	IEXPLORE.EXE
PID 900 wrote to memory of 1724	900	iexplore.exe	IEXPLORE.EXE
PID 900 wrote to memory of 1724	900	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d9765c2320a515f8f957bd626b5502258e63524f862f7c4c681d74dbd9c20f5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TAOF9UNG.txt

Filesize
606B

MD5
87f714715d3186e4ecd132324f9073c0

SHA1
ae2695e08d406eed15b8cc2d94fbc43a0a90d516

SHA256
d280057f432f8cb87cf2823eb8ec79f991cf9b48cfbb638c7e5da6e7032944a6

SHA512
36558d1e9288aaedce4089f5150ac93072a20917151851d64af51618e5daa01ed2779dce68adcb772fc8b7c1d7c6b6f90c47c0cf8052691d717c7da7c0c36463

Download Submit

Analysis

Sharing