a560e08dfe6a61a1e73e0ecc82a3485baeae9df2441bab9e28d795c4d6b29a71

General

Target

c2c7bf583331f977ef647b4056e2f3af.html
Size

34KB
MD5

c2c7bf583331f977ef647b4056e2f3af
SHA1

faef80ee83015a79ae889bda25d4736300e145ec
SHA256

a560e08dfe6a61a1e73e0ecc82a3485baeae9df2441bab9e28d795c4d6b29a71
SHA512

d43a4ce79a896d525b94d41f94c78044b59b195b6519c88edcdd1d6d7a01ed7ba301883ce3958f1ec979a091742234fd6bfd2d8ffa4fe855f4da730e434256ae
SSDEEP

768:HIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZxaX:HIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3F177D12-A1ED-11EE-A0B6-6207E08AD8FF} = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
456	iexplore.exe
456	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4808	456	iexplore.exe	24
PID 456 wrote to memory of 4808	456	iexplore.exe	24
PID 456 wrote to memory of 4808	456	iexplore.exe	24

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2c7bf583331f977ef647b4056e2f3af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:456 CREDAT:17410 /prefetch:2
  2⤵
  PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GZ7KRRRZ\www.youtube[1].xml

Filesize
229B

MD5
21d9b267c201e8532a4835dfc7f8e8ea

SHA1
8686cb45d05031dd8512c2e1f7bab603c17ca2b8

SHA256
de27b11fa36578bcbb021e6879c7dc57f19d4039b2bf12de4286893231bf7825

SHA512
0c5ba56d65f61152001a24bc3a9cbc90e2cfc07394f6449958742d4ae054eced8caac9c4af9f77258b43c3e5eddd89b32b4bf279528257d6e229b5fb071684a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GZ7KRRRZ\www.youtube[1].xml

Filesize
229B

MD5
e26fff84256d1866d65f70e7cada47dc

SHA1
b661e819ab0c17a8c0e25bcd65a460730cb546f5

SHA256
7ac3e7dc360d691e781241628008572e90d57a5ecb43044b43389b6af4200ab4

SHA512
c2527d6606c6e31c80f0ef115393a0c72df4f9ecff3154f307d88fe4423fda1f7bdcaedee066643760850d2d678fcf729039eac93b2e9370b66c371dea174c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GZ7KRRRZ\www.youtube[1].xml

Filesize
641B

MD5
e23707ae19981df515092e6d8142453d

SHA1
a099a88bea9e38b27bc6fc9bbe8a521032b5d3b1

SHA256
2aab61a293c58e4bed83fa757e91aaef24ac1db84f76cfc63eda924cd8938ea7

SHA512
61bdda6ddae058a2d94a86ed7f7b17a0cdc9e5fb4d0c79dfc8b83ff4c9947b81b420198e48954c616efbbdac63a3eaffb4c6e098655e4535d354b3fb98cd5582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GZ7KRRRZ\www.youtube[1].xml

Filesize
1KB

MD5
a6da4d856a6222a680ee01e0fc83a215

SHA1
c09f3c06d7c6db0dea97b53673ea98c2bba995f9

SHA256
12306cf630cd567465bc60652c41ca7c1a3bb006096c4611ca5963b1c018f4dc

SHA512
6851038b89684d6d3a4b43d5684563cc0cee7b3a4ca2266f208c57922877cc409b9c5bba737f263e3e2c3a1a9e2dd07bcf839bf22728e61b1eadba29a35fb58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GZ7KRRRZ\www.youtube[1].xml

Filesize
990B

MD5
60f614eacacb4fd2065941d276ad9548

SHA1
609cfc9f1b3183ab9d231dd85e3d8ceb443ee18f

SHA256
4ab0ac84e6892b72c9fd34602bfabb67b955d95912b8762c233051dad4543fe2

SHA512
bcbfc89940b5be398aa11a48e91b0d57c3227555f4845143b9c6d0697364a9d58be29155b654db63137f15f6a5c85d42ce5334b89bd5b8d7b7efe4c68b6b1e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\GZ7KRRRZ\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit

Analysis

Sharing