d0ed73ac07ec4ec7ac04241f926a3f3c2bf97607f9f971b632f805282df927f5

General

Target

1e8099ca80049abed5c17d24461eb8b0.html
Size

7KB
MD5

1e8099ca80049abed5c17d24461eb8b0
SHA1

b3ba43e50077add42deefc9b6f6d623f7a627663
SHA256

d0ed73ac07ec4ec7ac04241f926a3f3c2bf97607f9f971b632f805282df927f5
SHA512

f103352bd9f14910a226efbb767ec689a98342ebbc20710138e0910eb4874d15226a77f90d34784ecca8375d320c0e8cd63e2aba2f5b6df309bfd6edbe93d65d
SSDEEP

192:ln8uqnGDSSW0nqFwj2oC0t8IlwFDa8a12GnJvPRV6FGLtM:ln8uqnGDnW0qFwj2ott8IlwFDa8a1vnC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB5152D1-A307-11EE-B5B2-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1880	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1880	iexplore.exe
1880	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3016	1880	iexplore.exe	14
PID 1880 wrote to memory of 3016	1880	iexplore.exe	14
PID 1880 wrote to memory of 3016	1880	iexplore.exe	14
PID 1880 wrote to memory of 3016	1880	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e8099ca80049abed5c17d24461eb8b0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
088aa9cc8eab4d43fcf6c398da97803c

SHA1
081cd256afa37edb7102ae29ea4c78478fa2a46c

SHA256
23c26dcb0d8e3ac30674cc4febe2640ec88178b5665d383c5cb2f97e51e93f56

SHA512
72b8fa3fbce98df53c84b953e78d0762ca9417e5a432103e18f95881d1bb9be27d98866a99febdfa423384fefc866186b34f45eafef61c6a34ebfe62b83c8603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25042835c7c01491557252cea177b455

SHA1
8f571a849da3898437ee1a1af48bc6c7073b9fdd

SHA256
aa19928d02d58524143c39511012400d5180345ced312bfffbddb6cdc45c30ac

SHA512
0767639cc39e444faf05d1d74f9c12f275104705d1414b20e0db0c39538021425a8e4ddb4db5d42cfdd08d9fa5c6a4d532f45133ea3f45fff5754e6f78bea961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546251658d357c3ea68e9bf715955856

SHA1
71b4fa20d80a4608e8fac1479d0fb9a1b6eb0b39

SHA256
c89b27969cdc2c577d5f730355c48873c4c0fbcba2e7fbc88157deb5ae570c74

SHA512
394b3411a9ac28cda4f8b3e624935a8b4a1464a5aafb1e97b034db27061a20d66001ebb7853eda133409f5f34aae7db707f5a56528a7d6b534959e4a4401e7a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a1642174ceb932d26362b88a86f152

SHA1
de358520345d2debf4356b5d5a87b2384650feca

SHA256
20e6ed0cbc1d8579e944b2867e6059b8a22177a7848c3ecde4cddc6dd5b988b1

SHA512
47c0b23b7eae8c1d44d554431242f1e78253180a50ef76094580ccafa8b2d25a1b3791e581331d9247883c05f31eac1d37562495528ab753d94bf60cd132168f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27a5b76f6cf46bb996ce20b3859d6194

SHA1
8db5c6e3f8a140e1bc2f6b1cd5d066ea177146cf

SHA256
ee3b45b4f427d19c1842ffe55d04211c33ac0c6b8e869765ca2444a2d73344a7

SHA512
6db3a13e9a8b8d70c0842dcb1293b2eea55a830210e73db7df748727f28979258b8c8f0d0b25a6ed3600fde53c159e57c8110a6734b5a843e2aa38f5f991a0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc6619dde69be1de298d4d593f5a2ef3

SHA1
9b7ec6545850abac81e36b2148baeb26e7134f8d

SHA256
a03217ef5ae78886abab3a2a3917e79d8107fbe52e0c6e4443e927d4af13a76c

SHA512
d01467f3fac5aa795b0628594f7212239f1a83bd908ff41adc62b903e55d07b388b17dab7474e138bc2c37fba2561418923da33cc8b5d4d5f7e164e1e540545f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab01781de4976711f671d56b92bd059b

SHA1
7033cd5d16177e02a3d4624f660d82cc7fb1bbe8

SHA256
c47934131b3b4102d389eb9b51a71bdb1c0eb1afb7a0c39c469d1d3ecc1dd3d1

SHA512
206defddcd04c97271055f67ca711d4600e0ddd30f790985d9de3eec53d47efede68eda48a2189b2a95781e85b0592d21ce3736cdcbf16f28305508e5db3a85b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
673d7da5e56456a112fcee25c1aa621c

SHA1
19a15f45d1533572003cd7d0c23fe7113818599e

SHA256
cb2ef68e13d8c6c86c548273f848c93cdc84da6c39e61f067bb0c2b2efc62bb0

SHA512
fc434398f80c10ed71cce105897b7d8afc630a4a79f530ab309c7c227a8254977e2b51d08135b35c7204eb56260cb91233684cee30d5d0733dccd7f276bacc95

Download Submit

Analysis

Sharing