2cbd3f366de4c664a51d8d67d4c7aa185c7de758ced115f9b5187cc32411a7de

General

Target

2cbd3f366de4c664a51d8d67d4c7aa185c7de758ced115f9b5187cc32411a7de.html
Size

7KB
MD5

abeb4730c994ef3ceaa69b7eb3f8da60
SHA1

75e37dd5318e76eed1c4337b43321872b7d1d7b8
SHA256

2cbd3f366de4c664a51d8d67d4c7aa185c7de758ced115f9b5187cc32411a7de
SHA512

277bfe9ff16d63b19a5e3f946d5445070736376f5c190ffa88affb95817e8a92756cdc81e5f69c8d1fc175fe73e59ff73fb4daa24300b3710c761f1b7768e12f
SSDEEP

192:aJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLO:ESGabMPvLddLXuSwSTLdlLXugfo2KaO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e75306f3af36784e81b78adea02c197300000000020000000000106600000001000020000000e0aa71cb741068b61c6ce48133626724e8573ee9b1da859ccfa50bb9e220357c000000000e800000000200002000000014fadb0d681885731a6a1281dd6459f12ed7944f7a54f989f6d1e31dbd8ec9b820000000d656637e3bb4f6e532db268da218662a31ece1c94b7c714fe975b9dfcee7553940000000100417b2bb9a5f6f732ba2260e404af4473c52013f3587a41e094cc7a3746ce5c7046a2d2e85a61b6590bcb1db2e0da66dfa77d4a1a631d1e6334cfe32ec3a8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e75306f3af36784e81b78adea02c197300000000020000000000106600000001000020000000248a0cb926f8453ce24dd57bdfdac16a209e42ca53f5a3a206d85db0dbd4a2a3000000000e8000000002000020000000dd95229b17827532beaaae47e804af5d23f16c132199846fd80a64a72354f153900000004888da7392ef96cd6fd4f00e031d6bb79926bf60114bafb327db777aff97d250a4796f50d070c621b4ed6c849762a31ece637b2863ecbe6889b750165c70adb8fb2377bbc66def22618fc86aca3b03a9af29b8ec3b2a8f00ba9808d022c0b5e49d002c39eea1acad8c4c280b8817327c9d224c1f1123046fd0c8c9b4d87fae4ad1223eb8f122b52091bcdea0bbb649364000000004d05660a800d5fa5c680ec751fb45fc7ced77fe9a1a44d8c028f5c821e833b9f024bad48596b08910a3b930adce5d7ec7609f9fdd75661cde85c1a3f7dce2e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06bb66828ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375965155"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{934B5471-6B1B-11ED-B2BF-6651945CA213} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1364 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1364 iexplore.exe
1364 iexplore.exe
1132 IEXPLORE.EXE
1132 IEXPLORE.EXE
1132 IEXPLORE.EXE
1132 IEXPLORE.EXE

pid	process
1364	iexplore.exe

pid	process
1364	iexplore.exe
1364	iexplore.exe
1132	IEXPLORE.EXE
1132	IEXPLORE.EXE
1132	IEXPLORE.EXE
1132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1364 wrote to memory of 1132	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 1132	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 1132	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 1132	1364	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cbd3f366de4c664a51d8d67d4c7aa185c7de758ced115f9b5187cc32411a7de.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FGQCKL3S.txt
Filesize
608B

MD5
7a204b174f061a72a39bf86a261fd8e6

SHA1
51506745757f1ea663cc651f2dc9712465e5edb4

SHA256
9816ebd55ef495f2fa565d1d83d84eada3a5f3d44757719b3a41a0a638b5b54e

SHA512
e4547a31c8c0337e8c6de08fde255f9cdb316c339d4f869ab2c615f3d6523a13791e5aba2e7c79b442a27ae1b777edf0ffbd1ed78b36517635c393aa97882b5e

Download Submit

Analysis

Sharing