0559434bff6ad0e95d52d5ca67775b8c16fb6bd55bc5e43abad63646f6195f8f

General

Target

0559434bff6ad0e95d52d5ca67775b8c16fb6bd55bc5e43abad63646f6195f8f.html
Size

220KB
MD5

7dd6864764bbd68f814772b74beadf83
SHA1

48e5d8e1401cd0de78374bd9f22fb513bb514f51
SHA256

0559434bff6ad0e95d52d5ca67775b8c16fb6bd55bc5e43abad63646f6195f8f
SHA512

c09575e65d1dfbfd0cab945b2fbd3ed5b16da4d4fbde48e807f8fd8acd4b407b2e4251f6f147bc9da78c2206c9ca9a8efb3aa839891ee03f2e6054d04f049b95
SSDEEP

6144:lJA7bCkwMOjXZ2jYtQKoKhUKVMsKcqOPYlJs:lJA7bCJMO7ojYtnoKXrq0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42F76701-6B27-11ED-A94D-C6F54D7498C3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cea9b2eefb3ecb499c60dc0875a18e3e0000000002000000000010660000000100002000000087b071cd81172921f88286d35da2e65fe75642204d15bbb49cff9eddf4fa4099000000000e8000000002000020000000a77ec4a1b6e935ca89c762a9f206c3643d01553d5d90a0f2b721ab41814ed6aa20000000187d420a2fc77f3babbb7207baa30f814cc520d3b414a90229916442d3a32821400000003213a90ea70ae955ef1b5851dc5edab1ee4b9727b6876e538d24c1aa68c682c9b395cb17ac3d7e96ce0320c15e12b91654f33ed3eece26f99057a6f9b619ed6c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cea9b2eefb3ecb499c60dc0875a18e3e0000000002000000000010660000000100002000000028844453b244d9a3551430f87cdba15de34d58dade014a6fa5e62a1f0e870bbb000000000e8000000002000020000000afb5cb0c1f603e8a39fa12ed9e38c14ea812d1281e937c49664b698bc51ec18d9000000088293d9fa5989fc7dacd6219bc4c0411901af16dcca5367b5f9532dd1989f332b1a01ffc89eac23c1bd6efd28c78b8ad472526ac40652453fac947dc4b4cd5d895629633cdb7a52a572c8e35be47135f62bdebae54bc7bacc2c2d99db241aabd4108d2cd7fe6b370b9a921edae102bf588b522d59c5c3c1b8af4d7d46a04afc494cb5a9caf3f193c3a4fa82ce89482f240000000d47eb233d5b0f979a923ad35ac8caf4e8a1e6e3fcaa678ad4305b082b146efdb7491822277e6f3ba81c45de98567f94e397bb3814fca421819372136ce1c834f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375970188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b092da1f34ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

548 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

548 iexplore.exe
548 iexplore.exe
1136 IEXPLORE.EXE
1136 IEXPLORE.EXE
1136 IEXPLORE.EXE
1136 IEXPLORE.EXE

pid	process
548	iexplore.exe

pid	process
548	iexplore.exe
548	iexplore.exe
1136	IEXPLORE.EXE
1136	IEXPLORE.EXE
1136	IEXPLORE.EXE
1136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 548 wrote to memory of 1136	548	iexplore.exe	IEXPLORE.EXE
PID 548 wrote to memory of 1136	548	iexplore.exe	IEXPLORE.EXE
PID 548 wrote to memory of 1136	548	iexplore.exe	IEXPLORE.EXE
PID 548 wrote to memory of 1136	548	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0559434bff6ad0e95d52d5ca67775b8c16fb6bd55bc5e43abad63646f6195f8f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:548 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7RJB0BSE.txt
Filesize
603B

MD5
3c261df49969d75d68697cdfbad5248e

SHA1
6f05b0e3781c6479fcfb74ce828ae0a5cce9ab61

SHA256
f02a264fe4b65ee4df2dc417eca3c34c44e65e1f6ba4f6a4a6e587dd3d96c642

SHA512
d655c2bc5d37daccea7474926f5a9c46d41cc17f528982b00e4c1e4f55e562c3dc49e608c66a43b2d6eec698cb9435c7b8cf5b55dbdda9b55b8f339ce1ab573c

Download Submit

Analysis

Sharing