a2197c9797511de21a63a7e1b2cc52ac47eaa065c88194fa66bbacff1e84932c

General

Target

0d761764c7b305d61e4113b401eec28d.html
Size

3.5MB
MD5

0d761764c7b305d61e4113b401eec28d
SHA1

de1b6714c687953f0c152e3a92a4c275fac7e11c
SHA256

a2197c9797511de21a63a7e1b2cc52ac47eaa065c88194fa66bbacff1e84932c
SHA512

34ef46021a7e928af6eb493c22347b2ee6e719332de10ebee1d2e51f44df299b82a21e3c9965aad9c7b42426026830ca2a4cc795b406915b879c21dc361170d1
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfy:ovpjte4tT6Ny

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FE107F1-A357-11EE-A5E0-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2384	2404	iexplore.exe	15
PID 2404 wrote to memory of 2384	2404	iexplore.exe	15
PID 2404 wrote to memory of 2384	2404	iexplore.exe	15
PID 2404 wrote to memory of 2384	2404	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d761764c7b305d61e4113b401eec28d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee980d3d1f51a82f9b0019b3abc033fd

SHA1
391c84e071ffd66821b86b7d108cd42a06b60b67

SHA256
a55628d9fd5dbea601ca5ced4143918b439d74b5e7ed9080ed98d470649416b8

SHA512
9cc902fa1bc39eb47b5e9a4917c31952bff01a36acec010f97545a8ed84012de4635c1aebe926d837472a117bb0efd82e234a0813f2ce4d7188e7215b6b2042d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c42915246b1b4af69dba0a1388213f77

SHA1
d9483035ce0924de1784fc034abc8b0874160149

SHA256
927f802aede1c65cc8293a7181b847df49bb74cd4c8c885b817be7bf286f90fe

SHA512
05654807369abf984e7a3d16672363e085f3a629ba10bca3cb81cb97de227c092be33bed446bbcefe7e53611ab111422478a6615bebb74a81b0536e0ec852e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1afcf9e31bb0d37435e52b1d23adfce9

SHA1
34b6d117abf86fcdbf813c9ade4d0dbca27cf2ed

SHA256
68b36678e43941bc4545d0ddb0c082b715b2d87de9588f0267c25806b47b06c3

SHA512
4eed7023bd594f6222d99dc776e6d582c8812fcda713d20867545149ae3f1b0a7e8d764b47208c0fd78eb1840013ebde7f93f1ae88146d9f9f7b304bed705dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d8bf35d235ffa080b2ca49dffdd2e66

SHA1
5aa037fdecdd42db219bfc2ce5b0dfec245aada1

SHA256
0756cd3932a9e52633f5e76fafec5be499efb187ab2486cb1204c04c7ea2561b

SHA512
0171666684a64401c6ac7f5b565b603444cc8d55b2cea9f5ca134c991cc2b59f99656bee858311ed6bb1583dc60f7f15a73e73a0013cc07143b3d49c3950aaed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b68734b7e97c007b637e8b156c90472

SHA1
85a51dd7b8260505e8bf1f05da94759e21074ba1

SHA256
5f5d148c922aa9e71ad0ae9cb9900b5863f5716a92061b46844d27a79e790b5c

SHA512
e7bd24bc9126c1fad5f5319a240060a95d4fd89b95d06bf29a713938982903364693448e0f5ea06a902db361babc4222672e90c1468ad1ba49b2c5efb073a5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4369500cedbab6fb678f9981390feca1

SHA1
2c077b487e32546dd764fb6fff6396fe3107a438

SHA256
00689d546445d1dc16a6aec5799050513e01ecedf61ffb39493447933ba39f66

SHA512
b577857346325b0fcc343cb200e7b0be1216fcf22b2597eb163acb13d6dd1c49af6591c3cfdbc919db6b831c6455003ac5401eddbb0fc77f40d4d48010a45772

Download Submit

Analysis

Sharing