edbc4dd68d2cf7c6e4b1340afac67439748ea65542a052a51eb3b3605dbb25d3

General

Target

Play_Now ⏮️ ▶️ ⏭️_20222322.html
Size

868KB
MD5

717e4fa34e5c48cab6f6bf34e440c324
SHA1

806087f396e4e549c3a54f24cac27d2187e25ae9
SHA256

edbc4dd68d2cf7c6e4b1340afac67439748ea65542a052a51eb3b3605dbb25d3
SHA512

cf4c8be672e2b04ab7040f3c51ef3ef5fac852abc1091c82242503d413cf9620e31aa9f6d738659c586d80cc435e24ea4d44fbf57b72b845d657d00e6c282bed
SSDEEP

1536:dLLU+uou0INgSqHM/0N1vh6jz33z2fxJyhAyrpiQv4zsOOh3VzPSkPDAD05kIUNE:g4By13vs5OVyHmJV6mH78JV6ndGO

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1404D71-A29F-11ED-A674-466E2F293893} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ceb6c510f336eb4bb668217b5a00feea00000000020000000000106600000001000020000000eed4281470e5d62701b727854ac860b5d00331f14d514035201172af7f488206000000000e8000000002000020000000978d64d0ccbda479d82062ccfb208dfb25da230194feff7031ed2680e4957fba2000000034e94d279276220f9d7e68bce1d3411a54f6a35cc2c06c00610c15fed185d0fc4000000068208c12c7dbc43ec6d4675204cf6f320f58c468682ea7f7ce3f318e524af1ddf385cadecaacc25318a1f8d1494a7774668e4da4db02fb158b7b25d01aaac2f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600048a3ac36d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382069230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ceb6c510f336eb4bb668217b5a00feea000000000200000000001066000000010000200000004a408daa8cdd4e4f4b7a841a8448886a1f805f4c6cb5c58445f16c7d2bd60210000000000e800000000200002000000045190408d8a891531c05fa0b58d19dc151930b2e25518f1f5b2225d262f4be87900000007d416a6500b532d7c5050b64dda7cbf99fcc43a2877a765353e05684337b9d8af917fb8e28b34a756c507e40cc758a22969e97ee20c50814efd45917f22e4f285ade8170799258fe0f1802952bc146a18e164aaeb4605269bbdaf9a6e046ae7ed50c21c8a9a0c4c7e48fa6faa5767438ec65481f0553c52060e69ddb5a191ba0bd9e4dda63dd99c7646a08e03268744640000000b05d7ee47a9f0b273d6beb6502b32e88b64bc03982e80d1722a0464a1ae1b215fb464ad5255d2355babd5bce34253ca4171a0c112b02c59818362568146ce419	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1644 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1644 iexplore.exe
1644 iexplore.exe
1552 IEXPLORE.EXE
1552 IEXPLORE.EXE
1552 IEXPLORE.EXE
1552 IEXPLORE.EXE

pid	process
1644	iexplore.exe

pid	process
1644	iexplore.exe
1644	iexplore.exe
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1644 wrote to memory of 1552	1644	iexplore.exe	IEXPLORE.EXE
PID 1644 wrote to memory of 1552	1644	iexplore.exe	IEXPLORE.EXE
PID 1644 wrote to memory of 1552	1644	iexplore.exe	IEXPLORE.EXE
PID 1644 wrote to memory of 1552	1644	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Play_Now ⏮️ ▶️ ⏭️_20222322.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b2fb34f757ddc634dcbc6ce8e3c5ebe9

SHA1
da8996d1487687ec03a897d5de218eeb2f6a9965

SHA256
7f02d47230cdcef52ee96266ecbee335fbc7f22aac4a91b8e78c913c8b8cdc50

SHA512
10713fbb39052b342a44eced9e220c543e7baf08c012feca4ef9a0a127f1c0edbf0cb3ffaeda34c109fe03faed87386e4c3ecdadbe64fc53e37694e8bc46aa67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\20RX71BE.txt
Filesize
608B

MD5
5dd8f2149a1853350b2e92b412126e3c

SHA1
feb5b911f29f32f8f3e841dbd77ffd9553e55d61

SHA256
0e6b3f570073d37122eba7967a6fff0000bfb34dbf3bd4c86b762e79aa38bc32

SHA512
f554004a742fb7a58aa6dbe3002e5dddb74be6fa2843e35280fc8d623d4549b79605388ef3481a91cbcb8c214a0cdc2c06a8d658c03367df65d83229c3044989

Download Submit

Analysis

Sharing