e3a366e0eec86c6a1deffc43fcf0a506f42ec2cb71c98331c06cd8d7a10c22df

General

Target

1623c80dcb57cd45b32252fa0bf776cc.html
Size

9KB
MD5

1623c80dcb57cd45b32252fa0bf776cc
SHA1

71da9bb2b1875bd5aecab361f09f53821d4042ab
SHA256

e3a366e0eec86c6a1deffc43fcf0a506f42ec2cb71c98331c06cd8d7a10c22df
SHA512

5f2a8270d97245144c4885435b3cea9cd0092d8c94e89c24d8218595f70b6f7f05a8c05edf9b69de5ec3045b2cf5178fa9a5f2c39dde7e6ff616f8d6773c8292
SSDEEP

96:uzVs+ux76eLLY1k9o84d12ef7CSTUTGT/kPscpUlVHcEZ7ru7f:csz76eAYS/yxUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1784A861-A507-11EE-B49B-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2220	3068	iexplore.exe	15
PID 3068 wrote to memory of 2220	3068	iexplore.exe	15
PID 3068 wrote to memory of 2220	3068	iexplore.exe	15
PID 3068 wrote to memory of 2220	3068	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1623c80dcb57cd45b32252fa0bf776cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f9fa378fa594e103c14ddf2c55a476

SHA1
312b133dd9f7239f550a3003b6964e9dc9d58d5a

SHA256
ddd3a4b6469d3b0bc41e03c1136b9ecdccd30928eed296fd5c6d1b968243b8a0

SHA512
2823b39fdcb4a9fe19ad679f273f54ffd75ddc3a230c2df09bde97e949b9be3beef43db9ea3828ddf5daf127810cecb7f8138f9343ded11f8677c20ff980fed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d16ec076b3a303144ef82394a49d385

SHA1
65df1abb58f95685601ec1aacb86c057725bb691

SHA256
014032d2c3f8f3c4578c3cdf3f9601ebaa0061b9e654353962f0b84a644bad1c

SHA512
c86c8692ac5a46109cab537bc5498513744cc4537e472208b0805fa4539631383f5afbcabeed2f59bde16915ba8c74e5eebf032c2fab9e17f6dff200dcc4cdfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf5d58a3710208522a68a37073c7918

SHA1
48f745a1811a4c94ff23c0dc22a3d9aa79be1599

SHA256
bd9f5a7211b8e53280a8bf7d3b2bcb3d7f1b911aaa0e65e034a8ae7a2a613669

SHA512
8eecbbf05e88a9f7c4284b4ba7aa2d96be3a125dc373fafffc8252bb19a558da26f1776e6e22c685335a92c30f0c892f818b35d0c54cf839c172135f2d1f06a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ff333cbfba14784f2264f3eb6456be

SHA1
1fa27363b2efc8750f88e032bcef1358166cc4a4

SHA256
256479de5c0dc512df9c0d38427ae94b8909e30d71f483efe16381218b0a8025

SHA512
fb933f9cea17a59d2bc56723623386ac15272fabdde22fdf8fda958ed6f1fb52bce8dc3de65d1a93150b624cce8c72440595f65936612efa51823081f2ddef63

Download Submit

Analysis

Sharing