e7e7d4c3668d0b973c69e375bb1753f93a71792795a0b73e1b6776b55c511d3f

General

Target

1fa7381d8d4112633acbb04de372ea69.html
Size

44KB
MD5

1fa7381d8d4112633acbb04de372ea69
SHA1

2bc3b476aea4aba3a8419471638281c45d3a8ae7
SHA256

e7e7d4c3668d0b973c69e375bb1753f93a71792795a0b73e1b6776b55c511d3f
SHA512

e1e86922fefb1d9ff5b5ddb4d95ead74eabfba0f8fb113dace5744650bb22cfe897f299634bb827ee5bdd91f009e850f2e1f2fab5563ed0f634c8e6b18e94ce3
SSDEEP

768:Ss8HBiOTi/TDuLX1Atk8vjXltVmhVbDi6bIo/EnY/3CMqk:SxbTi/s8vjXltVMVbDi6bIxnY/3BB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C31BF361-A30C-11EE-A2F4-62ABD1C114F0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2988	2224	iexplore.exe	17
PID 2224 wrote to memory of 2988	2224	iexplore.exe	17
PID 2224 wrote to memory of 2988	2224	iexplore.exe	17
PID 2224 wrote to memory of 2988	2224	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fa7381d8d4112633acbb04de372ea69.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86781783e626b970f3eade5165baba3

SHA1
003b77bf93cba0dea7bf3798e7c8fcb87085466f

SHA256
74a7c113d76bbd894c7bcf5f52989d21054f3a4e4f5c70738d4f9a9d2d866eea

SHA512
9c526ba8135b30df50cffed160f659393e27024ea483c6d3c9330bcb97ee3e395f536cdf392470e08b98a449608701ef09dd5e85e873c3fa11a018ec6f0baeab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9329db20e6a4cc8ca4e451f2aece019

SHA1
6e2dc76483f2a00061dd433437a82ee99e4ae432

SHA256
e91051b8c190e4a519c9b98ebe3932d2e1eb6250304bfb7b6519c730d42f9027

SHA512
8d1c3af79d9885b0b3da2791e47d51e9c2a1a5c0d5032a1b21c431454bbb68efd95a2ee3c006f84966a60024cccc5c020aa1b3e547a8f970b0d3ebcc95450532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc2229e3e89f7a4c40d091d894ef85b

SHA1
9341e24befc7851ec52b02e509eeed980b26049f

SHA256
f2a24b445fd7978298e25832c2a05fba057aa942540db8cb635b7ec3327852b6

SHA512
8953ec62fcdab3e921e451a4ca78da731294ce3881ec076cadcb86340ae9f091f5a73caa6ad2aa0a4746b518bca1e74c92cab6259ffb2c274b7b6525ccf88b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
158fbf5285e239ef42e529b5dac011ea

SHA1
bde02aacec77b685f3386367907b03a5c036be60

SHA256
dd5e1a09562acad2e73d8c3660af51ec427943c7ed0ccbc1411a98c7a1f72194

SHA512
758a743a4469fe11720a1784712410e0606941d75547fff19c8844693535204ec81e362ac0160e632b035ac16f3b3d00278167a8ee02f8b07035dd9bba9e3d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23eb85f4cb40bfda0795d67a899c24c0

SHA1
cbad842cd3466f927e31fd3d11da550211e892ef

SHA256
4287a2f5e2c6244c09ede2000f1e1baec983fc2d3a19b735b1c544d7d3442fc5

SHA512
6a413cde281d77c85906e08e8c6ea8fa9df3bb67c4ab839efa24b1ddc62efae919a2d759986ae6443a66f28a64fd2a1065b4d2add67dabdaef5339e9784309c9

Download Submit

Analysis

Sharing