6fa4d33726a0ca3af6ffcb83d7a3c64216832573a81bb16a6d0468a018a853cf

General

Target

1838fbfa65c56b3b08929ba48184746b.html
Size

18KB
MD5

1838fbfa65c56b3b08929ba48184746b
SHA1

a021d49dd052d208f65576e4d8212095c201440e
SHA256

6fa4d33726a0ca3af6ffcb83d7a3c64216832573a81bb16a6d0468a018a853cf
SHA512

820fa94783a988a3b524d895666de829372820117896347cd29a286f6a3e370d521b9c9ce67130e2de3f4f070143c44754a695d32b51f10809bc63c856605fd9
SSDEEP

384:OUs7/9Mahr1AgdGgs8jMaztTLPAuz68MMv07e:I6K1AgdGgs8jJO8ts7e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFC04181-A38B-11EE-9E06-5628A0CAC84B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1964	2320	iexplore.exe	16
PID 2320 wrote to memory of 1964	2320	iexplore.exe	16
PID 2320 wrote to memory of 1964	2320	iexplore.exe	16
PID 2320 wrote to memory of 1964	2320	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1838fbfa65c56b3b08929ba48184746b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b3b7ad1218e72b33b4e809e26e1a21

SHA1
f4704b03b38c9290d476c8dd6757098c290ddb6e

SHA256
f4895877a4258cb3c76e3f582e8112724e4bc26e369308194da51dc068964697

SHA512
fe3209f10df8c1523d6249dd94c59704ba1f1c8a0e4424da64ba6f04f0ec8a65bb2d73e72a5622b52b802be5c951b3b532f998d75538cd61bdd72b96ebaab3e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3de62d93375bb577d31c3c553744a726

SHA1
1469cc1b04ab8380255533c89921eb1133d20e8c

SHA256
8767aefb2d34a32e0a7385bdca275c6c031e5368a791044f2c672c6b4cb8b766

SHA512
ef071521294b889718ee3428db32c8a82a967874e6809e687fb8d11e02635398862967196715b4dddd486eeae69ef58cb9983f59f1a3074a6aea7a783c2e86c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9742b538e6883bcd307de35be2afa03d

SHA1
a839f277e10950902b48ef473b86d595946c671b

SHA256
e14d65ac86dadb95116d0ba6097f7b1ac5800264360835d3ad52816fac122f27

SHA512
d302574b6ea552b230961be643c758db77e2b734b3f6e3d9b79014da69ec908acaf499154d44f16436953029370a9e656a99df161ce908e223337a149db86b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5963fc36048581988f68a4dafcb7191

SHA1
6264a0a505fecfc30dca3b304cd0aebc297c6060

SHA256
99158da016a6be374f8d3c8e6e4456e0106f33031ee0e8acccd96cf10041fd24

SHA512
bfa43df55894ec81c9ef4ca474b520966f96d13c811377a751d083e761c30ad1bcf801171bfc23a7363145a7ecebc22fc922ab468f8b417e3f2373786db50a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6d946ba80e4b65777100cfc2b14146d

SHA1
5f2e48e70b8ae259c1eb91d1c4574b52889ba62f

SHA256
4dd52ead6b07aaec14a7acc16d69dbff0f1237b4f77786d119b698dee644893a

SHA512
6364f0a8e897fa13f3d90ec1cbc69f312b9934d463d9102781b5f6bc67f5b28ab0dd8df2b93f9434adfddcc19708b38006e11358509c116d56a9f5c3295cc689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
590112d835382def886b89c9e666932c

SHA1
5a4429de4ee0d5dc0306035b9c9a511a5cc5942b

SHA256
c88f550026c4d5720f1f5472aa6cc42dd3dacf1d24309839b3558e0a5607e09e

SHA512
7f5094cb985f5c18d18b77a301e161764292c422c96dad0d2b7a79282b20d2d71c00a5155403134d84e8ec8358c82eeee845b8e35c782468f74f715b8dd5244b

Download Submit

Analysis

Sharing