694adfef602d2ea796b3feac4cfe9ebdc0dbeb0daaee501b76df53ce0260ad6c

General

Target

email-html-1.html
Size

3KB
MD5

f0fe336642eeaa0c37b7094fd1494905
SHA1

69e61a0c83aa7603e4b09e3070da6f17548402d6
SHA256

47c1a0979af792d31e74f1159ca97836d3bf8f3ac37e2bec940aa93aa1eda6a1
SHA512

b187364e4150b18ac90d306d4ba04eecdb24f16f0c06e4e42c1c36f50ecacbcc6ac10440d6575e78bdb75e92b1f5cc6a5c53a6ab5a5b24411029c011092d4886

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205fd5fc9f2ed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381184201"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23019651-9A93-11ED-9172-7ADD0904B6AC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095d9ffd58b118d48babec2584d2ad11f00000000020000000000106600000001000020000000ad06be43333cb824b3eeebd8bc8afd9d36e4503b1170290158c2bd1d9037fabe000000000e800000000200002000000010f117c7ae59cfde2c4b8576027f421657a5e61a43cc8b8f09e631fbcfa6b3b3900000007b63fb90833a08a367dec8a385ad0af0a23e5121719995a47623a62de30ad550c9944c4f373786a1489afa90abd1e6e0e824f105b3fdbdcd98aefd9e78309edaa1277b4338731236368b1360dcb89c411f43fb704c4fb666f1f34ff54803a6ef79e44c24d7a5981f5f98d66c61484f0cf6dbe27982707c3b6b0225a1880bf7d308da1c64cff64414b318cc63f69265de400000003f31982e186c0b1709e0de5bcd689dcfe1d96cafcdcdfb0933d44dcce08456d0d7f4fcb57ad87a241050c2e0401429ed642b0b5b009847ff32ec872303bc9442	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095d9ffd58b118d48babec2584d2ad11f000000000200000000001066000000010000200000000601da65c62555d2cb825c2f3204680ed0a1d61c3753030556308f6e6912030b000000000e8000000002000020000000cbd86d0022518a85b76077d0f41384b5ee9de71f0129dcc978f0ad0650adfd26200000009c8a600bd01b1742e8833183b298e751770e2ba255808fd838e9500b0fd7167440000000b53ab6edb2fc6dd4e5e27ab78ba7676af1cf0d325fbd90923323142b660c8723bc18047b226ad92eebcd2efe2b82021818a1705b27e75bc4375abc99c32ce0e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1932 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1932 iexplore.exe
1932 iexplore.exe
852 IEXPLORE.EXE
852 IEXPLORE.EXE
852 IEXPLORE.EXE
852 IEXPLORE.EXE

pid	process
1932	iexplore.exe

pid	process
1932	iexplore.exe
1932	iexplore.exe
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1932 wrote to memory of 852	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 852	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 852	1932	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 852	1932	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
b2f8eb69f4690c42361a0c05551cb271

SHA1
23b71fe8d55c6d303a7438a2d12f7b6017a425d0

SHA256
cfb91665d5d1a469b79a8c71a84c45589d7a8112fe0376538ff6af5f3fb7626a

SHA512
89d2e673c2616e1dc888a24e8e9d284576472d8c872fbf183747ccdcbcafb3a04bac51291e3b9511aec4861a0dda5fa37fa5946467c7eb8aa41443f774b6f124

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8RD0YLVX.txt
Filesize
603B

MD5
a67d2035ab5db98cd1b3b1397452ecf1

SHA1
52b422a5a337df33527e88152c9ff033ee827147

SHA256
d2aa80dd1732d1c4c74bfb44c266b304be289fa1893ca108e955752fa5561029

SHA512
6a2917b06d4b2d8bd5d56e88f1e10eed6912b47d7ac6671d660d91affdfb4fb83e589619275de35d282e8d58128131ee7e76122a88517364282ce2209cf88b9d

Download Submit

Resubmissions

Analysis

Sharing