d12fb4f53b1d7fb84f94fb655fe146f0b88e361ca305e1829f7d5f0d7446c73d

General

Target

tmp2748.html
Size

14KB
MD5

84628173d9e78f4e12e2c38c2e0056b9
SHA1

170b734579a7189e74785d00b48168cf2432c0f4
SHA256

4150520ae4bc767f0f39cde8332bc1b40f389e69f404badd2f0d84b59d032d1b
SHA512

21f76ac97283474aefc333fccf183593d65f4a2044242f799a9479429a706ee30f4997c2e70f453652ff375002cf08c18b2d5a6a9b27cf7beab10eed81e58518
SSDEEP

96:tenLCobv8hGd5WR1mGK+GxERMObbMasC8v0CZXDMDIaBrsSW7Azo:t227bbb0frzEBrsSW74o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "408557185"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00533ea102dda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efe45de6459e68479fb3092ce4ddea0c000000000200000000001066000000010000200000009c092708ec1a0354ce83b0952361a049df7a28de2058209873744238d5441cf5000000000e8000000002000020000000e0f780f496ff46a596427dff160abde33a4c72fc8e234506c596867cd996c156200000002fd972f4c6434cacc47b760097edd68cfbf3473ca7a674bfc94540102d458e77400000003f4fa717321ae312f00f00cad822f34c3b99cbcfa9581cdda1275bc2b716f644b2f7917bfe646184eb90bb9694cdfb202258ffc94078edaddf7a4483a5a0babd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efe45de6459e68479fb3092ce4ddea0c0000000002000000000010660000000100002000000020cc3f0085527224e012adddafbc5297e91eb1be9e5d66e97894089e4f9bbb16000000000e8000000002000020000000eb09765468e3d27aaddd9f47d59b7a223b866ae6b5135acbd5ed7eedf2c194ba200000006bb466fc9ceef430346886c16da07c48ab663b4555245f5c85751c74901091d1400000003def89aa29edd905da67985fb6b84447e09f96fa3a5b65e7956dd7ea7c09f4869615b0a496a7efc186e53130ff7cca8ea3b5cad660c1a3105e8c026fa2da107a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0710344F-9904-11EE-AFBF-CEBC6C59C500} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0313aea102dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1188	iexplore.exe
1188	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 3000	1188	iexplore.exe	85
PID 1188 wrote to memory of 3000	1188	iexplore.exe	85
PID 1188 wrote to memory of 3000	1188	iexplore.exe	85

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tmp2748.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1188 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads