0b391821f77915a6e73a9b8caf414cb7e0ddad66e87cade38d20e44d5ca5fe6b

General

Target

Cancelation 2805431 Dec 14.html
Size

333KB
MD5

b63e330eb0f58fdbd12c38247e99dd38
SHA1

6ea53029c40acb462b6b58f185025041b15e5406
SHA256

0b391821f77915a6e73a9b8caf414cb7e0ddad66e87cade38d20e44d5ca5fe6b
SHA512

d7cc2ff091b4ffd03243c7fdbc18caa42a63ae1af951bd24811b98fe699481fbe58539b97a114683f22c6d4159b069bb3722073858b73b262fffa2892831b6eb
SSDEEP

6144:bJCHs8Ctu7ggxoXujqn1tyR0iv7eTrvuKUiq64JQrUWbq/4KJ:bJh1tYxhjqn1tyR3AzFUO4mu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = b08fe351dc0fd901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000057085a36204d614681724015b1c0835d00000000020000000000106600000001000020000000af758f099f155efd3c6b2941ebb3a503e17fa7955be5208855480eb175e69214000000000e8000000002000020000000c45e1f039b3562699dbe7191490493777e08b4f32ed6568c9d97abd16ab823af20000000d199a89eb9daea710b7cfd108882991f9c500307a63a4ea2bf41b5fb93de0909400000009cea9f8ea667efb14831e3ce5285217ddabb5cf6b02872314b5562176aa514ad97c7ee1770616b67f796c0f482d28cf65e7c9ea29dba24600ad0569711b49447	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70023064dc0fd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377801658"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89EDB891-7BCF-11ED-93F0-EAF6071D98F9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "90000"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000057085a36204d614681724015b1c0835d000000000200000000001066000000010000200000003d7989288ae65b9228f7d63685f28d1f9a6358620a4f8b18c96b5f04667821d7000000000e8000000002000020000000577ea7c0c341d3812c3fed9ce55debc43ac800b4e962d58527cfb2601d6827d990000000c0606e77400ec1918dd220d63a65cc1fea9b6d22cf00178fa38b72c0046b0c44a6ccecec4ce40a6a1c418f57166175df3e0ade761790cb557462f566e16e64bb6dd2658890d8121df15fb00f2d422c00061375beb13701e69ea5302dcc7a99502f4459336a472038a29a7de204e9f16e6b3a03c207db7e584d0b9ec746bb55592b1c036ebdb9bb6cda3189d8e787c9be4000000062f462c991966ad2156eaba6bbf88bf1b408320312bab233f0c580dcad0d585e7a7cb251e5f29b35f200b6dc2a60042c3fd4bbd9adaed14518c66ebcabcb8dc4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

776 7zFM.exe

pid	process
776	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7zFM.exe

description	pid	process
Token: SeRestorePrivilege	776	7zFM.exe
Token: 35	776	7zFM.exe
Token: SeSecurityPrivilege	776	7zFM.exe
Token: SeSecurityPrivilege	776	7zFM.exe
Token: SeSecurityPrivilege	776	7zFM.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exe7zFM.exe

pid process

1648 iexplore.exe
1648 iexplore.exe
776 7zFM.exe
776 7zFM.exe
776 7zFM.exe
776 7zFM.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	process
1648	iexplore.exe
1648	iexplore.exe
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1648 wrote to memory of 1348	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 1348	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 1348	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 1348	1648	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Cancelation 2805431 Dec 14.html"
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1348

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Cancelation 2805431 Dec 14"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
1592f514f8c0500701faaa1fa20694de

SHA1
345e98bb8bf7275e12e633479f83cd39bfcd3f95

SHA256
7310a9aea69d2c6940fca6b1c2293e5133b6dd36fccead5006aa69fd7f64a6ca

SHA512
f22cae3380b5da061269fca80e9b67bf17224c2b43ba61280dd8ce3597f1ee03b939d53a17fb5d331ba3ed8d10df5f57954bf0903b285c2fd938bcf58a78cec4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\W0GG67RV.txt
Filesize
608B

MD5
b1f59884222b0d1e06046c7057fea83d

SHA1
0f5be2da6c33ce1af41edf1a04a07fb03f16fa1f

SHA256
2f7ea3438faeed2108aa6ab8c00105dfade8a4c2359d69271ad3c37d44c0c65b

SHA512
eca4ade947d68902a6bff4c20c4759edee006b02edc44f9c4207a9993a3bbe5fc4243b73824c220bdd51d39a3609dd1b78982222108e50c50c2ce8d8b29da1b8

Download Submit
C:\Users\Admin\Downloads\Cancelation 2805431 Dec 14.v0fmmxi.partial
Filesize
241KB

MD5
f27a9cc9679f21a1e1d6432ee6e2a18b

SHA1
b18e2ccc877075a4f570e09035e738975f2f0bc4

SHA256
3bd9565b4913e7f39cefe1024d0e400c3fc29b0e4712789bf30b94c2b2fc20ce

SHA512
cc8c4456c722bb033ce32aced145f6833730370487c9efd42d4e4d49d95a905980aefdb5fe59ba5254b15509b7433710d9c539bbe85aebf5bcd3a76ad84f33a0

Download Submit
memory/776-55-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads