dd3f8757593a3aca7003d208433476957c92476a70ac56233767bf6149dab7b2

General

Target

1831ea1102f61438f2dfc0bcba58f202.html
Size

57KB
MD5

1831ea1102f61438f2dfc0bcba58f202
SHA1

54da779b770edc45fbaa7aba96c98fd8009cc4bc
SHA256

dd3f8757593a3aca7003d208433476957c92476a70ac56233767bf6149dab7b2
SHA512

fd80a00269530bd753c03625ad52fbd0aa355141640e27940505130d005fc78d36b148d1434841120b624e1fe5b385321866fd7cd019f9667eb4326d560df27f
SSDEEP

1536:gQZBCCOdyGjLB01L2CmOYrupWbf+lQiOqG0IxCLnwqh5udA+t/nGEe0TPiEQfOfi:gk2P0Ixum6eHPhBNaF3hRMnuSoxByhGj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2F53A31-A2EB-11EE-BE57-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2824	2056	iexplore.exe	16
PID 2056 wrote to memory of 2824	2056	iexplore.exe	16
PID 2056 wrote to memory of 2824	2056	iexplore.exe	16
PID 2056 wrote to memory of 2824	2056	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1831ea1102f61438f2dfc0bcba58f202.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
851bd15f908d57e4b14c77a2255f02a7

SHA1
ed2ab9b6e94dd3175c675362b9547b23a1cbd6d5

SHA256
d840d9f3ef3cb2e309e7c3ba16785c2b488da7a42cbee0bf246ba53ed3c832c7

SHA512
e212d0cc17645861b912002fa38f35eb4b712e396eeec81b0b6f3fc7cf7f15a7916efd04c5a6f68e291664772d853352a4812c731ab161a71e4a708441019a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30de4bc7d3f66fff3c344c18bd058717

SHA1
7f2a7b86d8dcd1145db8d453a478cb50acde29e9

SHA256
ae80ebf9713823457e16aa58f7848fed413d826d278cd402ae85ebad1ae9d1d4

SHA512
df1b091a6e000b534733c75d9beb83efe07c62caea02793a2f9030096902d059b1dd6257c94850e2a01842ceb51f358fe56c75ab469b4efd3fd8019795c8a5c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
babaca1dabb6ded9f0ec36524045cc66

SHA1
d106c09e25a58c467683be7f881e6af0e46084c9

SHA256
5fa90d3ff7d976ed9ecc7552f3eca94671a93fc831ad99fa923396473e906912

SHA512
a9e6b19286d74a12d52ab61eaf49c8ab85b7448c17a2d7fe1ec075b3f2e2635d4ef0e8933aee722dd89c4b0b05408de8ede342657804fd43ddf4efc08c4946b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5189e441ed48fa862af4a420bc6b4751

SHA1
552e35501dda1a21f028df76fc6d3cefb5a63c4e

SHA256
772a0e45ce73a80b917873ef02abc97980dac54a258473d4995760b3c1a40960

SHA512
54921746c86f8bde98f8d10d7c206cc019a12a8364cd202e6523ea4ba764883e51cd9680ef14a8ed17aa5437ff6c5555fe1a3898bf52c3ce14b1806d871643fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e92631684cb58b9a5aa69a0e68baa76

SHA1
ac5f345b7fbedf2d8a4bb9f43571664dc62bf1a2

SHA256
d4668bbac8d50330d2de4b82c0ac01ac7d1caabef1cc179ce44fa5a6f63c5e9a

SHA512
0027b2b20b3886d76a7f4e585e10614fa4d85e8bc31ac2a986e1bdc966be76a7625f02b53fb2f4d97dd87a509411c44c96ff82b5e6d2bb18b0b4b6af384e304f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB914.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB936.tmp

Filesize
8KB

MD5
3c4d343843a8439fb3ce229466d6eb88

SHA1
f895040e2c9a9065e54a880e99fe711725b64a51

SHA256
f93e46a8f4b9c06ccb630ec9c6b52274623bec4679921ef6c361e4ad7bac8aab

SHA512
9f2d882079fcd85ff60d834a003362a2ebe1a63add964ab7a6ffae9b34d08191ca1f2d31b33815b2b7f31ff4056b163b722e49f2f5e24ae9dc2ef0bebf6e9383

Download Submit

Analysis

Sharing