85f6d912b4c9bebddc4607c350f7e5ef48902462c174460aaa7dc743bf934e06

General

Target

003fbca0de3935d83f4ce5333dc4e4d1.html
Size

15KB
MD5

003fbca0de3935d83f4ce5333dc4e4d1
SHA1

089762f810f8a3ed66d00a58d2fb58fa10ade980
SHA256

85f6d912b4c9bebddc4607c350f7e5ef48902462c174460aaa7dc743bf934e06
SHA512

af612f7efea7cd96b2b8ffdf3c208afdc86b3992077e4bb7ba7d2a5d6ee7cc8c39a35eab40aa4792767c75b7c0bf5b96472e73d3eb733ea8d61f9f7c1a52b72f
SSDEEP

384:ln8uqnGDnW0q3FJdiXIWZg6x8W178U+lsA+LmYM70JvbjzxaNmKTqFwDjzJ0rcQt:ln8vGDndj3F/OIj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EC8E321-A313-11EE-9776-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2788	2536	iexplore.exe	16
PID 2536 wrote to memory of 2788	2536	iexplore.exe	16
PID 2536 wrote to memory of 2788	2536	iexplore.exe	16
PID 2536 wrote to memory of 2788	2536	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\003fbca0de3935d83f4ce5333dc4e4d1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af82e39de7fcebb59b9572dbe1f5cc6b

SHA1
d9b6a2bcc07da32987f0c9d98eebb2b456012672

SHA256
41f27ae8cc1ce7ae8b58e199d958f36c02794e6ad8a4d430634ac551cd702d47

SHA512
854143f27685165307b78fcb04118c696deb3038a8156096b262e36d602e1e192d00d4392e49f9372963699d10ea4df5075424146cf098d1d309173b7ad252df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2afb88c2ca5634e57d6c3a65702dbdc

SHA1
b22637af63d3436df7c9549ddaf7fd3155b1a344

SHA256
2d8a3b456be603273863338926c08ef58187544bbdf92c4b571260c98b79dcb4

SHA512
69dae18caf3f7aab9e04d1c770a357860fb70fcaca6b25d6b7a62dcd75b50568cf9a20c2c613043582c77477b46861c4d40ac8c9f6e5116b20c4cc90e99241d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e63e61f5b95a01182ad01ab085ae35d

SHA1
6347bea5d9470d90d4c3ce3059f3bcb3b5a32003

SHA256
cf795fa6b5cdc6af61a570d25a6cf63bbbf2b412dcce7135dea5ca4215606da7

SHA512
271c6f2240abb40f03af64f121c43abd04f98c70786fc1611120974ece602391b543027bd5691331dd6a529ffc37f1373a59e7a1f13c4357fc91221f1033b200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
822f78d8277ac5217766e2de148c057e

SHA1
3e59db51d8bf1557be1e31ff9d1987320e0f9a07

SHA256
c0b6cfccd6d744f289a0c271dd909b9335241e5419cdfccf52c99c76339586c3

SHA512
b3aa978cc630afce802eba8006d08fed71cb800660396e45709f12fbf64e8b03af1f72759f846490983b38c1d4327bf1626bb71368bac5e21d0d64f87a414be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01199110e6050047300bcd395fc2fa3b

SHA1
8fd9cad5c397b971d00da437efe212fe09c28a6f

SHA256
c637cf0f05d43d8839e9b01357a4c76012347666f4ea327f8ff1313c0a015e09

SHA512
aa5aff274e41efabeda1bd8ea1ebc8afeb68fcefe4bc12fed020c1294ff579aa8da86d59fc5adfe6b4a9a3133ccea3b07ea58cf2e4563c5e513b737d8c7f1ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b89d73d5a30ee8afb5af37560b377c5

SHA1
c88a8eac041b4b1e392b7726f02757b343705929

SHA256
d17b0ef9e3c9ee7a22fec6603238f64695b665f9128239b9422b8a457a87e7a7

SHA512
748b4f8e527cfcc25f6943097e81931a57f86f83399b3e6540620571190088f03b3970039ef2ca1389247d131a64eba9a94accba8a1125bd9fcd5d74f315dfb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8057a20ad63155cee1cf2f9f5ef2cdd

SHA1
cd1fece8e37e7ad5e6dc1d3b8a4751200df3e619

SHA256
2f8d4d1cbd69584815e5c148782a5d833dea57e49cc576e2f19fd4bbd44a5cb5

SHA512
c7625b7406a08c7555998921b09bad6972a443f313503fc8bbf1bfa28870b23bcdbae09f678c4d89c9c7ab124e2d2e1b8dc7bbd998c21de046a7d54197a6d9a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a8eedd2f22fe8a3d35a8858c90dc71

SHA1
0a0afd860b87d19d521b2b0388b58dfda73be3ff

SHA256
1cf8d6b8021aa2168eb0f816b2ad9f7f2fa5091a589ce1a6ecdf29e038596587

SHA512
a7ad1141cf40eb0dd4a61a9c2ed5515c9e21f76b06f23807c294bb56eeb51ba57450dc039919beccf0439b2708d7233346280fcf10cb039f7f1119d888498995

Download Submit

Analysis

Sharing