4126e0bf9077b51c5ce914d8581317d7a8376e4c74eb637f30725332c6d37bfa

General

Target

4126e0bf9077b51c5ce914d8581317d7a8376e4c74eb637f30725332c6d37bfa.html
Size

7KB
MD5

eacfe63f9e695b5daee0cb3266419cb1
SHA1

0df43ce22444a9b87556ce830b7260c99f193275
SHA256

4126e0bf9077b51c5ce914d8581317d7a8376e4c74eb637f30725332c6d37bfa
SHA512

42046d4b4959967dbe89cfa0f885e9b32ecb83aa8a8dc7954b6b32c587274f505a079633b32592cfa8620865248ebe0383be32f5127497e86da8b6e7a741f117
SSDEEP

192:fJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLy:BSGabMPvLddLXuSwSTLdlLXugfo2Kay

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964980"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d5ffa9f874fb3546b989f8d742129e3900000000020000000000106600000001000020000000cc3a07fbb125f5388c7db8aed2d822b567afdd03442e3d9d76aa68463fb632bd000000000e80000000020000200000000ad19f093ef9f60ca4f0a16858ae4b3bc086d12c6a8dfba3a47a63d4d69ad9a9900000009faa1c695f5146b2717cc209f6a03fab7409c0681a5c0cb36d69dbe73019711a8f76abb4ef460cfbb167b1077c8894f773b5560e46093cc8ab3c0077cefffc866bc0e31383f436402ad4ab54d5bf48028fbfce0c8ab7863aef57410e22228c42cc6952e04fa310ae395eb060cfb7d6d3f108e99efbad54ce4e2ba18c9508aef7f3308739d4d41e23fc2d99e26233029240000000fb660684b92d99194faeaed9de9f643b4f0865a27aedc79af4f6ea52dce0a18ef9445d1e00b1caefbec004004f89514fd28d89ccfc2ea3e565e5eeebc85e0454	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d5ffa9f874fb3546b989f8d742129e3900000000020000000000106600000001000020000000a0fd9daa9b57d00ebcae1722ac1ca63ffc2e8e1fe6583e0acd6eb641ccffb8db000000000e800000000200002000000050e6419db97b77e5c4e01e5c4bbb88a60777b857c0b57a5f98793f19bab2fbc620000000aebb629a795acec69c82335e2a86bfcedcde609d9c827753ef86f52453b3797c4000000040b1c409ebc12c1afe54041b886b7866ea5b6a66602824d1811b4953f4327f7ce01af966ee550e0133520e488ab5192e3e20f390b357ab081da44d491ad7115a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80903f1228ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{298FA451-6B1B-11ED-B51C-6E705F4A26E5} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1504 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1504 iexplore.exe
1504 iexplore.exe
956 IEXPLORE.EXE
956 IEXPLORE.EXE
956 IEXPLORE.EXE
956 IEXPLORE.EXE

pid	process
1504	iexplore.exe

pid	process
1504	iexplore.exe
1504	iexplore.exe
956	IEXPLORE.EXE
956	IEXPLORE.EXE
956	IEXPLORE.EXE
956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1504 wrote to memory of 956	1504	iexplore.exe	IEXPLORE.EXE
PID 1504 wrote to memory of 956	1504	iexplore.exe	IEXPLORE.EXE
PID 1504 wrote to memory of 956	1504	iexplore.exe	IEXPLORE.EXE
PID 1504 wrote to memory of 956	1504	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4126e0bf9077b51c5ce914d8581317d7a8376e4c74eb637f30725332c6d37bfa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5X5GTVX9.txt
Filesize
601B

MD5
94582737e0718b43c8df490fe38c1886

SHA1
39a24f1fa7d9a594d2b7af2539f4fd2c84ca07d9

SHA256
87b61f1e9b75746d705834451aebeacecffa2f24ea724a12d5a267a6215c8d32

SHA512
d8dc485e196e67b8f8f1f9c9b356b1c9f5f0248519bca5222c6061d04b68ca5045621049128cc624dfd82b9345daf113cf695e5944cfe0e22bec443bc87d303a

Download Submit

Analysis

Sharing