1ea0c38b80773393c173042f95f84bed261146c6c359359806ff12647ada0842

General

Target

0aa0b947709a2bf39426b7ddef9e7984.html
Size

44KB
MD5

0aa0b947709a2bf39426b7ddef9e7984
SHA1

4e739c9a50d1c511ebcc3c19ad178bcc0f287b88
SHA256

1ea0c38b80773393c173042f95f84bed261146c6c359359806ff12647ada0842
SHA512

593751e75b9574a955781db7e6bb187d5d90b853a7b25717daa7e003617521de1f348af88bae8ea6456cefa38d703ff2ac08d01a6fb4090574138b9cd70fba49
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2o19elgVrRPwaG9k:mZJtX9elgVN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEC58D61-A2EC-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2932	2140	iexplore.exe	16
PID 2140 wrote to memory of 2932	2140	iexplore.exe	16
PID 2140 wrote to memory of 2932	2140	iexplore.exe	16
PID 2140 wrote to memory of 2932	2140	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0aa0b947709a2bf39426b7ddef9e7984.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b570059c36fe52f3a33619573c6442e1

SHA1
f3b617e10549826285c1ca93fa525f7730fcffe9

SHA256
64d9d4a89015336436a21e6857e0a14530916109b824db1419f5ffee6cf80147

SHA512
233368acb203cea26c229e68adaa21efaf5cb0329285e3edf0c70f17c3d5a015de9e9a357be1126b84889357fc36b2ba6f37a3c9fee91fbb2b76063b5e31de37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e48f0ef12798cd7c3e29ce5da6de44f2

SHA1
6677058d1141b747f3ec4a34d407bc6d8dfb408d

SHA256
0bd0642b09eb2dec95f295da51569cce2479f8fbc234529f9765fb978eccd5de

SHA512
1d0505c5e1d6364bc3fe3237f9e9029f39d90aad7613e563be98f28ba20e69a8c78522ed55e47c3c1615cb7cdded3abfae69c09c2dc49db25819a33df8b267f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cad7028e82b474c2b71e0d2a5db0278

SHA1
5fb0b1ef5ee1cf448e1dbc792b5572089866f306

SHA256
a4718e139880efda93a8acb95556e1d5d353c48ed9101cbcb4798b48991e86bf

SHA512
b786ba8114180f74b950a1f5fc05db213d03ddcb5dc3d28cabd0de6980fbe10d0044cb1a6e6716c84c8620a717157490067289485de4bf2c673b7e9738f14323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aac2cf1cd10a99dc01d88d19af7b64e8

SHA1
ff1cb7a96269d43f43a7707267796b7b05a6a7af

SHA256
d8f1bed79bf851c29f0fb23c8a76b9f03010048758dffbf68da6adfadb032631

SHA512
c7dd299d6a018602d97519793cbb9e6e0a2bd5d09117f8650ca6a4e8d4ec113314f54277484142c792bacc9a980c9449219a50a3ac4f1b1d8e502af66fb3abd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D52.tmp

Filesize
15KB

MD5
0db93a81166c5a4abc01218b55023fc0

SHA1
1a3a8c6df316e7e864d85e23b6a82c9619095d6e

SHA256
74daef09b60dcdb82c24d0bbfc4cec11a511aa25c3ce99d605fa2d112f040590

SHA512
9d3abd4bd76beaff1049ad056d9d8379166b1599c82f5027a77aca260c807a3fe5166222e27b16953ba73950e80323953bf9e3aa54ac2722fede281e8d8876af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D65.tmp

Filesize
14KB

MD5
c9c65fcf316cb068b1cebf87a7f9201e

SHA1
08873c760943e8ba4d60af9123491cbbfd065c1c

SHA256
19c452acbdfa55c3e078d99230a840c3e054c382d8b4200f831a6baea6a4ce11

SHA512
07947ecd5cc3ea7e523e2e3ec3642f02c01399fcf65573feb4474a3fa360bf0b4f83a9fcfcfb5f3b8afdae16b34743c7456d799567edff18d3546b2d6b56856f

Download Submit

Analysis

Sharing