8908dba56fa9ce7120cd261e9cc311b5eef996a7fe5f03f372bd68a0a1b3877d

General

Target

423522427e30b8871f6b370ae42748f2.html
Size

3.5MB
MD5

423522427e30b8871f6b370ae42748f2
SHA1

0cca4f2d9e4ea4c4f7260b0f6a0b5bc2367a8652
SHA256

8908dba56fa9ce7120cd261e9cc311b5eef996a7fe5f03f372bd68a0a1b3877d
SHA512

dd70aaa3c9bf10a165d3d37bbf3f132319157ecb7bcf87ecd9670678b743baabde06c941b9894b6b594cc6d9f2fac26b863dae188720034dd162c90537a3f8a9
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NfW:ovpjte4tT6NW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15F66CD1-A445-11EE-95F4-C273E1627A77} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 756	3036	iexplore.exe	17
PID 3036 wrote to memory of 756	3036	iexplore.exe	17
PID 3036 wrote to memory of 756	3036	iexplore.exe	17
PID 3036 wrote to memory of 756	3036	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\423522427e30b8871f6b370ae42748f2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
355f66a83f48267cec0a3479fcf08b02

SHA1
a0dc8117a5e7071d2a9989312bea51d5fb5755fa

SHA256
3322522b5a95d8d1d3c5a05b486424a285f68b6899d36cf4f4ce33b298ca8fbd

SHA512
2ebdc0ea2ef5cfb6f9dfcbc13d55d2b547508c560cb71afd8f9f69755b79b8efdf1e83da6f0a4463d1642dcc9c0438d152af4e36c8db46f4bc11ba3cdfc17486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7491c376f640d601eb62b18b9fe61a85

SHA1
a8f039a041fddd88f354947a59d76f6fe757f805

SHA256
ea650654a9b0eb9c3a88a717fd60e2d544cf3afb5bae172e3b2fd2ea76b4ec5f

SHA512
5f2cd6379a976a3b0e8bc2a9521ff746bf1b2eea3df0a4fd58dc8842dfd30d0e0861c8fc9f2c528484a768181e9c9a1951921da38ae54cdf937913489b77a2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c5c9c05c2ea2c2fc4a2f0efcb6d269b

SHA1
f5bf5bf05abeccf36a534990310b1eb1b89d0a70

SHA256
dab6d5582b0e53ab7ba76ffb341e947bbd4dba61f98d92b8a0c8bba94e7fd2e4

SHA512
4fe629113f547daba9785b25e817a87050d98c3a2d94a9641275d7fc763fb7a34ce0f59e85f613ce9401196ea95144215b1d50d4d0025f37a16c8cd9e2ea7e7e

Download Submit

Analysis

Sharing