e33f27655597e4711ee792f707378767f7ac917471ac3dd6afdfdd3bdf73d40a

General

Target

1537d29da63df2d886440d4b28340c5f.html
Size

6KB
MD5

1537d29da63df2d886440d4b28340c5f
SHA1

bc68c0b8afbea1ce7f51629646f09442cd535fe1
SHA256

e33f27655597e4711ee792f707378767f7ac917471ac3dd6afdfdd3bdf73d40a
SHA512

ad00c6656e1edfaca556eb74686d272a21e43cc38dcd0b5508a1fe46a7cf24d0ccfd14febf5e72da59477f7c640a36d556dc61b74067068af2363fd93f37e187
SSDEEP

96:uzVs+ux7yGLLY1k9o84d12ef7CSTUotMoRS0ocEZ7ru7f:csz7yGAYS/jMoCb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41908BC1-A371-11EE-9317-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1060	2936	iexplore.exe	17
PID 2936 wrote to memory of 1060	2936	iexplore.exe	17
PID 2936 wrote to memory of 1060	2936	iexplore.exe	17
PID 2936 wrote to memory of 1060	2936	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1537d29da63df2d886440d4b28340c5f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e6327174d163d1f0f1589ff59dfbf51

SHA1
7eb93a84bf9ba7ded1aee05124cfc8f4516b99a5

SHA256
9250b140973598bfcc108d4abb4b9776d0504f63f68601a223833c33cff6ad8b

SHA512
15be4bf9c12bfb63e50db5dc5205e7d5ee9c754237b978daff11986683bd58d2bdc07db273a46ec0dc1fdba28d147ee47566edb84f6da2431183cd082ee69208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b387152a3e2cee7904c1ecb8e03ec77

SHA1
afb0ad3872964a3dd1497960b64850c203b1f972

SHA256
dd4ba74ea5543e298aaa57973e6cec40bc89066f6b7be4a8752fbbdc6b4d350e

SHA512
33041a8e449008914f3f1e272d0cf667d0f02044105c6037a15367b7ac3719c833249e8a94a40e2fff20992df87ed2e8ea0aba4db1d045841aa0f24f61901102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279e8fe9c445dd1c99242fa3c81fcc8c

SHA1
fa206d9d2ab387a8259b525308d305210ad9cc1e

SHA256
0a7425bf51b33dec133d0cc9ec34dc07f7cdc9cd7342b998ebc75a997e1ab4f9

SHA512
921a3fe5e21dfbba5f69f7946c2cabca9ccf2afb34e8ef5a433be2500a6fb5fd9115555a8058df8495e6c9300ee28479b8895698546c6847bb033006fb88022e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA289.tmp

Filesize
5KB

MD5
d68bc4172ad0b9a8f01e5b2b67ace27d

SHA1
29b6a08b95489688212a46abb5e8a685ddc6da2c

SHA256
2e5896c2254d1234481f2ea069e0d495b70a9cd7af4201f2c79552876cd66de8

SHA512
f8cecf800ae49f3aff51702600f051dc58501325032e6539eb1decac04e7a24ea18d6cdebf7d1a0ef1d3493a105dc5a7b0dfe373b70004e4ab82dba527e02acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA328.tmp

Filesize
20KB

MD5
14f7660b1d17e7aa47484fb7d09df53d

SHA1
0f63f5630337f8a924d55bb9a3ee4735e1935aa4

SHA256
1d3d90c33c0be8b8b938f091db3634fede8656f5ae2385be59fac799aa9ad62f

SHA512
55cc5336f4cff1af9f0c2776bc541c2d3fad4b12206a6bfb476d2b3c1ba561814259fe3fa7d8710139bd65ae51164090a6dc7ccf09cedeba65d7d0450c47cf05

Download Submit

Analysis

Sharing