e64da0e9da3de1ade07875641ca339675539de5539b3535bccb5b579eef5ea34

General

Target

185e004f2805bfe497ebbebf81af1d76.html
Size

68KB
MD5

185e004f2805bfe497ebbebf81af1d76
SHA1

5bc945a81a81a2f4b58ed9e7a420e9a41ce0db01
SHA256

e64da0e9da3de1ade07875641ca339675539de5539b3535bccb5b579eef5ea34
SHA512

7021c9283ceebad63f07e80d463d9064595447d21a9b08740725aed6be1caf0799e52560ac5c4c9b278996862099ffdda26ef9752ab1269630258e87ecc04c9c
SSDEEP

768:S40hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/VZ:SX5Ik/ptnwOHqN4ucp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C4AF9B1-A2EC-11EE-8B00-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
536	iexplore.exe
536	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2736	536	iexplore.exe	18
PID 536 wrote to memory of 2736	536	iexplore.exe	18
PID 536 wrote to memory of 2736	536	iexplore.exe	18
PID 536 wrote to memory of 2736	536	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\185e004f2805bfe497ebbebf81af1d76.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:536 CREDAT:275457 /prefetch:2
  2⤵
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
395fdf6a7d9d63a466b36973d4ec547a

SHA1
8b6f91c651fafb83bce15cd65f1bdce3f5a45c50

SHA256
36d49e68df35dc3d7b2fe0de9a5d15a2c3a5824c6edbd38e9ef72cca9877e2f9

SHA512
dbbd5029b7c00939defc3fc8ac3cfe0186b46860ad892e1a44e3412a49bf387919210e1115d354b2a6483f1a3073b935ae1d90b9ea2e7085f12e8611435b3627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b64c116196039062419d76caa60cf887

SHA1
87c801c23a536a7307334989a9e1a8238aa41f0e

SHA256
de9bd123e3e56653fc465ce79644609e205616021647538c78a81c1ee3c84a33

SHA512
a7fae74b42d27f7c976b9867e1f0c2189292824fafb924dc21cfd0bc26dfcc8e131a05d5475bae25fc3e36b87b3df6c36c511c45cbf8117eff44d84033de0f34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d18a72d9f9e67a574109a86c69d7e6

SHA1
6153363cf00886821e6c47ebd272a982a6b1dd05

SHA256
d4c576f4cf8f67430b6129e82b07b7d70e36353b827717bdfc2a3cee8784023e

SHA512
da30cda667bac81f094148d7435efc7ee3c0a12006e868b59f28ab44d5a0b54870387d9ffcd22f8295db6a47be0cf2bc624ffc294ab963dad3e67e2b48a5f5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d51c0b3256eb4658b448b57eb15c77

SHA1
09a6d2eb47d42e4269ca775fdfc8d981ab6d012a

SHA256
568982215373aa837d4fa61575ab8e69d723db450b1ac33beb8d6c8c81b8f0ed

SHA512
1dffe9ba7530b30012a3de7778b99786670bdb74809707b95ee269821d2e34951f81e8fbaea4611291f03648c033285a56ce6ead9125f3f4777d3ce017ae4ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053bb3ed34155200cdd73138ef24be12

SHA1
b731f7f0b41a0ed91f08de8f00abb4df3ef0fdd4

SHA256
e72ced80cacb8d7ea3228ba2fe5f6ad54290d6417ab75d75b103ecc904b1be20

SHA512
1ff175721f76e1c070bcb3457e5966cbe62bb42b123fb6b5c103710bcbac2b0bf9579160b810f0f2c13e32f413e893358869f2c1d95d9c54a4be08257227c981

Download Submit

Analysis

Sharing