e27fe8fbe7a2dce98908228959026b78f52d89afed8557808f165751abaa79ba

General

Target

1ed05928dfabfd76d72c842d0438fde0.html
Size

57KB
MD5

1ed05928dfabfd76d72c842d0438fde0
SHA1

43f79c68cf196aaff71d8bc91bc7ddc01cf221aa
SHA256

e27fe8fbe7a2dce98908228959026b78f52d89afed8557808f165751abaa79ba
SHA512

f6d499049e843acaf18403d22dae42243323916365635dfcf3c2d713654d20eef07c34cf25d8debbc3743ddde671f1c61a7bcf92175e37d68b4afa808d1244d0
SSDEEP

1536:ijEQvK8OPHdsgjo2vgyHJv0owbd6zKD6CDK2RVrorFwpDK2RVy:ijnOPHdsD2vgyHJutDK2RVrorFwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34DB0C61-A309-11EE-9028-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1432	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1432	iexplore.exe
1432	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2184	1432	iexplore.exe	16
PID 1432 wrote to memory of 2184	1432	iexplore.exe	16
PID 1432 wrote to memory of 2184	1432	iexplore.exe	16
PID 1432 wrote to memory of 2184	1432	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ed05928dfabfd76d72c842d0438fde0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BED28547CD88D26CC5D20663CC60D70F

Filesize
727B

MD5
112429a083f049da53aedeed36789a08

SHA1
69fb5878bac60171a8615b84480d69859c33a902

SHA256
4d5536b0d717352e99888f5b2331315ca41e8040c992cbc02f1ae9a576117e92

SHA512
f25c12e32ce7ee6914c3282544dd5587618e31bd30fcff790aaa4d9afb9e1e761643e40ec5b09873962d30c64da8f51a99d8096f5755afcd3a7f33c48abb425f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87533b850307e4d84b7fa11c1ff90aff

SHA1
a909001dbd90ede1702f033ae2a7792084ccf1aa

SHA256
552d6769e58cd57608bc98d8e371ac53236a71a4534c158efec07d45443c1f3a

SHA512
f09e51a421adb5559e413b3c7f6485c440257892f2861cfe38df4ba172f2c621925a803e433081c056019ab91d07e075c9b23a3738f0c837743d05e16f07b22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a45566b0608ef5ddff6ff53cca512d33

SHA1
b4fdb5143a843741ea93ba8364235dfed6c66039

SHA256
fbab83dd481671e8c86242fbdac2a601c2a2b755de186921a834f725e7253c5e

SHA512
ec2f98580ec8c60431aab42c4b64cc6deea403a0b03ac9ffd5f089251a2123ca6540bb0f0f8abb6fe585d4b04fe8603207c4ac8ee3dd22e8a7cdc3391cf57adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf7b5d8d2ff8860105a8b96ac7db0d1c

SHA1
0cc5df93555472d2742bc43f4fb4c35fb1c026fd

SHA256
d06460e7af4c37940b8f8846c13b1dd05f13fab27ef5a7a6bdf1a985777e20ba

SHA512
2b2d40efae9c24d0b86ec79dff78d6d1b2d7740cf90665542355a019d12d34270a30eca2479368ef42e3d1dd09e78aa525bba204b610e32bf212b5560c32f5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6090f8e12f2d45c8a7ca769e679ac7e1

SHA1
cf882868e97eb94ef2a9be63f6f537a5e27cee88

SHA256
eb53f20a129d49060d9e651712e0e34dee7923d1595a81e9d374668cd5318659

SHA512
8cc29ba49d549f1634af44d8fcf1d43dc5385781b2076215504e43ef07bf583c52c477615ab114877f480968c577797715dc170499072f57df4cc6cecdbc1a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UQSMARFT\www.dailymotion[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\f[1].txt

Filesize
34KB

MD5
177f413f34f6226df1a1d91d2958ea4a

SHA1
0f70736bd5035ce5f3ac9d3cfd65299cd92d35f9

SHA256
71c78f0184044c0b81f320c30cbc41136049f84b951901edf9c36ac9949a3d5d

SHA512
a2348d8193fc1a5fc76322956d9ed7925fa7af7e0aeb5c43a7151fc9974b3b5af7d815486551864b9404db36611433b70d4e7f3f5876420ffa7254840b4f050f

Download Submit

Analysis

Sharing