f97cc658479a7a78a0b945950f7baf0e9c0faf64b6ebb29ef2b7c567d00719fb

General

Target

0b3e7941de80d23b881b98a098120bdb.html
Size

7KB
MD5

0b3e7941de80d23b881b98a098120bdb
SHA1

1aa30ea26fc15035ae7eb2a3fbf48b79b3160057
SHA256

f97cc658479a7a78a0b945950f7baf0e9c0faf64b6ebb29ef2b7c567d00719fb
SHA512

849b404a99d34d8588f1b11d1a4ceba715c5f76e8dd08f167836feb667ff876c656df69dda845bd75b8b81bb60cdf86e35fdd17d6aaefa53a01f6c5a79f575b7
SSDEEP

96:4zWvP+YzYiggpMmNTrj4Vj3ViEZIwLN0uud3xHj8nffc8uj3vg:4q3pvJNoTViIhuJxHj8nc8q3vg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C2CF7F1-A2A5-11EE-8D71-5ABF6C2465D5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2984	2852	iexplore.exe	17
PID 2852 wrote to memory of 2984	2852	iexplore.exe	17
PID 2852 wrote to memory of 2984	2852	iexplore.exe	17
PID 2852 wrote to memory of 2984	2852	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b3e7941de80d23b881b98a098120bdb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb0debf1530440cbdbf118e64c5f131

SHA1
31e2551f321170fde68dfcc376802e6d2b618a7a

SHA256
7be36c9884fe372f655712a42e482d89c24b2cefc196d4d8773d1acc6e70642d

SHA512
44ba9c681a4160a5b27c92dff8c177b2b6378c27f21ba863c0be070d139891aa9bd2b5923e2c7ef7e2137e7574192e48b693eb0bf501569089d2bedd41d6ce12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3ac770a17f30348fe73dc351beeb5db

SHA1
b131b41acdb82e951af6c4db3d8c4bb5a7502942

SHA256
ba02cf491b1eaa0d0c7f83c4eba258718cd45c7a215d08936090ab628e9f9c08

SHA512
2afc8072161b8e66c91e3ddddb281c680ea47777e96895e7c6f8f3f2c717d4b2f4babe55a624063962e02753f573f378aa6dacd1e5d0a675f6645b2a33248713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6820a91f86108cafad0580ab3d4cf240

SHA1
4def2dad221621d62bcba783140fd030e47ddeac

SHA256
2e33a98be8f824a1884174baf72c8081ffa8783b95a7c706278e98eca4a2b6a2

SHA512
0578983a9faf05504dbf453033a57c27b778eda41c4ee5bce3978e498711acc6862b41fdfb661088c59c386fb76e35788d80ac9da71a3f9ad1b7cc8773794aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279baef80940a73d9b6467e581c3d2a0

SHA1
e4a347034ecadb76741d16c91ae70aced4f6e77d

SHA256
372beeb8e5e5cad9c441184e05e6e14ab89d46a0c165360c28de359a3ee3457b

SHA512
9c8547873b7a97bbfa9979178c0de6346df3e8910f1584892c140b5ef9b1397de3d1f9f64fe0c7b4ca3b3a9c70062a3fc77b1d0412855a5e14c3aca6783215d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3f8383ca32c9b521d231a4a9a7955c6

SHA1
1051dbc13989ea82c0d3c32495b6dcce177e5059

SHA256
211b9ca27d7820ba05bcd40f3c4b235761d9ef3359dbcb7d817c9bc859b91f70

SHA512
58aad52b5ecad0090ecc505718fbb2105e97f287b318061e4d310849d99c411ff37d5cdb92defddba6d5ee75367693229cf1cebc07e30713264974d5919fdd1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cfd8c89cb29819b4afffad6d3164a38

SHA1
599ae290d04f744b195520aa80cdf62044bbf387

SHA256
bd32a461669e0c23d5dad6106c18eea09638a018ff1fe2050090ffa030b0489e

SHA512
d7fcc1744e4c01fc20c06ffd6cd366f78f52c3f5922ab73e99eb1fa3f9d6e2826dbb0f7101a25cff6b5ed1eeeb91ad466aeb48c50daa2620453a5efff1c02af1

Download Submit

Analysis

Sharing