463483d98cf7b40de6cc7eacd03901cf304d4af4efcefe9edd27d2bf153ad481

General

Target

sample.html
Size

28KB
MD5

cc22e09f0851deee5717db1297912a2d
SHA1

c4147953a99907d2903aafab933f781c79f6bc26
SHA256

b1035bcd19d3b73f2f076fc4042755886345d87e274d51e8b90ba6418de14dcd
SHA512

302f1efdc54f967e790a5dc1ee94d3f5e331f1b25fa77d9095db475ea2e71531b5bf543d3c4b3078c45fdf56b20d2fe3f0fd04972475fe1eb29dd825d18e13a9
SSDEEP

384:SIKFpv1aowAP0AqfDVoGMWh/1RFgvMotdvu3hl:Sz9YAP0AqrVOrM+dvahl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D774961-A66A-11EE-930F-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3000	2332	iexplore.exe	16
PID 2332 wrote to memory of 3000	2332	iexplore.exe	16
PID 2332 wrote to memory of 3000	2332	iexplore.exe	16
PID 2332 wrote to memory of 3000	2332	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebed1c00a4ffba823425c12efe3b6581

SHA1
39959247f7d5d2655956e5fcaee308fbfffe6c3d

SHA256
a4aed092835fdaebb9bb1358bf063a08be6a442b3d6f52c70b2f3278678b34c3

SHA512
19cb4c5fce400647965d3c5ba0548109515a924f3986d6d815a901b2603c9abbed2ea420887b17a60b427672e422a26d50e7a23257fab909088f001ba463ec44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
845186bc311da18fc70d7aaed5d38d71

SHA1
e3c13a4fe80940fa74f84e277381a953ff899b65

SHA256
4b83d949359e33e90be69cc041e06ea3ef361aecff48e1f1be278b1d0910b71a

SHA512
3fcc6a38e8831630f71db7593aa42ceddec71d620a782846c45f287a2aba42cc610d218c03505efdc9e5ddca8c3ad7fddd88131c06bc92e0f873d029febb22ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
262a2b0cc1e1c7dd0a40e6b5c9033765

SHA1
13f256cfc609b55bef60ded3c78b57115a708ac6

SHA256
5197c58edd9ccfee2a7107dc78813153621bc16e0dd764333ea68810900690d7

SHA512
b9da90db7b5d42d17ebef59e5f7c1f1352d898b35a1071cdf6e0a775a73189199878553b9c13f648ddd9967cb620d23b68b7bad0255d7e8770df70093c95dd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f32ef3ba59656507f6ce7533cff88eb

SHA1
629be69c65a94bd57391b79ab5b1a31213c55043

SHA256
04931093521ca143affc96412c78d92a78f4479477b2c09c5ba466e694ca272a

SHA512
003b904902a76c06d437e0a8edfb9d5735daea713febaeedb9c4885b1ef4fae9862258f7accce4ca40cb4e610f2d5ef86e41c0143aa6aee89ba9d3458f61c3b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bf71bfe7e37fce2c274f6ea244d5dde

SHA1
ea2db51f0b02f56236e8d9f3d2bc2434db7d7ca2

SHA256
7027ea9ed3fa0557ec01a44c8fc89b1efe8331abc15e01942a0196feee87bac9

SHA512
30d866cc2061325dfd9bec10ed559f927d6472c13849cdd75dd7a14bddc931b30605f51fe292eb67ecf82e547b1d3ae6d4c71cbcb2ae54d9e602904f31b0f376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab27171c940361c6989308a91dfd6057

SHA1
a5b75d1a9063ba782356a034aa9802cf41e2e840

SHA256
280b4034e3fdda2d1e2879548d832d3067ba1e0ed73b360d8bb2afbe5b4044c9

SHA512
1e483ab1989fc616c2234b03adecc23daae4ebc9cc8221c64b8092a5765df12188d7da8b6e4ac331c8efe5a1a250c1119ce9d7b450485467ad1d19b3aff31ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CBD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D4D.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit

Analysis

Sharing