69436e7cb8bd58694d3380564537ad23f88922e60f2e133dc59bbf2941fd4b29

General

Target

readme.html
Size

31KB
MD5

a306f7fbd7d6dff5c113da140a54bf1d
SHA1

c8bcd0fa089c7f40c1c9ad30b9d2929779ea92ba
SHA256

d3ba2e901cea4c64087e997ca85391157e0a3ac2e8af70357286093ab0a4e8fb
SHA512

f3cf638aad24a58e7ef305ca75109e7bb8f30c05b060ea98ccaf084fc096aec83e6a969bb454ad3e4ba5219bcda1f94a62e09a67b1a56f6a9d910b5a53544294
SSDEEP

192:5rMu2rUjYd1cVhOSEdzKJL39h+iZe+6iX/qy9Zk2aFcReZ4dmKRC9dk3fS674YzP:2QywJL9ocPdmJk6WFzoCD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375983137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f995fd85ad6f247850296420045e98f000000000200000000001066000000010000200000003cc904abea20be44e59207d7a9d2895ca73b1bd1314f4ec0e8b8ce5fc3e5d357000000000e8000000002000020000000c125897bf390935204610886a390f2d4121f3d2497b5b7ebd759a74a9e3c394820000000c82b9709d4f8caf583eb299fa127bcce3affd8dd6d4ebc677fc04c8d9b0ad08b4000000018f9abee6311426fc0ab4e16f4bf16dba56fd9ed77a7460f8145946b1fcdebb93bd1f48224fd5cf8aacdb1af07119fb3c24e6dc710bc36f4620902e335d984d1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76918871-6B45-11ED-AB20-4A12BD72B3C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05ae57052ffd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f995fd85ad6f247850296420045e98f000000000200000000001066000000010000200000006e6a53dc34f3f8f2fe029b94eb7f8e8ce2c9cf8ad65ad2dab04f272941cb0b9b000000000e80000000020000200000005ce9c2f61b545751f56ca7dc513af9f59ec4024137c2090785737dd4ba09bc6a90000000ccea41a1b1f954817a5adb2d814dc0efaecdc148c21e44f15fe06fa6bebc4da698af11f9298654d1e05aab48f857f76f310c6433e12158f75f4763669b9762ecb70932a336b20833caccf92952bfb6c4ab2991441af79856f11fea5a106df4b078e6f507e50619a453665b72d71c665985e69daf46edf55b797e987f330af268e24fa92e2525d92e4d1584c6fb1ce1e2400000006128aef404427bdd8e0dc231ed52d1b5dd46a13c022553babbd91eee4dc3406a0e83cc618a5313007965897f24bef75082ceae52b0b77c4f78848e9b8857b98f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1536 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1536 iexplore.exe
1536 iexplore.exe
1980 IEXPLORE.EXE
1980 IEXPLORE.EXE
1980 IEXPLORE.EXE
1980 IEXPLORE.EXE

pid	process
1536	iexplore.exe

pid	process
1536	iexplore.exe
1536	iexplore.exe
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1536 wrote to memory of 1980	1536	iexplore.exe	IEXPLORE.EXE
PID 1536 wrote to memory of 1980	1536	iexplore.exe	IEXPLORE.EXE
PID 1536 wrote to memory of 1980	1536	iexplore.exe	IEXPLORE.EXE
PID 1536 wrote to memory of 1980	1536	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\readme.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2094fb7c49f5af2b91a1cf772d9568b4

SHA1
72e798fed29fed7b7bcdbfa30cbee37f4f529dfd

SHA256
80a49814fc00d54c774c880aea4d1bf5516d15a72bbc79682978e94dea76db2d

SHA512
87878fbeac8e827514b9e1e3c30e81f5f92252a9e35a20c10bc3c149e3d271fbdfeab7b167fc0051408e92cbdcdc824335a6f8ba5a92969c4dbb0224b815c0dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\18OP7F6F.txt

Filesize
608B

MD5
07e4a502fec06e6eb5cf575b27b25d13

SHA1
c59cf9c4e2d2a757223c2fc97d39f5a7c042d234

SHA256
47973cabaca9eb3351713180a6b5f227f5008d173f37dc1c7f9a79b445c1e222

SHA512
0d044f46bcd98d6b522949b1cc7bd28f10811e5eef01762a28a4a0649d7958e8df950a70cfabd2c172f49253241f95846cc551f4aa258f65be02ab1f177db1a9

Download Submit

Analysis

Sharing