e9b14d69906b4f64c22c42d469b3cafe8daf4e034968c7d1a5a981f6d273d3c2

General

Target

2937cdd5761f650c69c7beafc61e9b1d.html
Size

57KB
MD5

2937cdd5761f650c69c7beafc61e9b1d
SHA1

5942b41344fdbca2c5e09e1ae0dbecc39efe7b10
SHA256

e9b14d69906b4f64c22c42d469b3cafe8daf4e034968c7d1a5a981f6d273d3c2
SHA512

e0ac7dcc94460618786225d60dbd0f03f7898f84d761606920aba9cce581688a0edc43b496817b3f14c90ab461dfa93d1b8a458a958918bc7239bd324e796a73
SSDEEP

1536:gQZBCCOdH0IxCpT8IfjfkfkfufKfmfNfhfJfYfNfefzfmfWf6fmfrf5fbfE7fdfL:gk2l0Ix0Lc82iOFpBwVGreOyOTRjs7Vj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DE0B8412-A3D4-11EE-BB4F-4643CEF3E9DE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3840	iexplore.exe
3840	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 2848	3840	iexplore.exe	76
PID 3840 wrote to memory of 2848	3840	iexplore.exe	76
PID 3840 wrote to memory of 2848	3840	iexplore.exe	76

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2937cdd5761f650c69c7beafc61e9b1d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3840 CREDAT:17410 /prefetch:2
  2⤵
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5w2ovpd\imagestore.dat

Filesize
1KB

MD5
414bae7e6891307c3d061246f755127e

SHA1
0ec416bc990de6bb8a48d81b13dc15c7f57ba826

SHA256
00950df23f785d657e5f89f71650359b27a8cf1c00a1573af7e3bc0eee0df49e

SHA512
228a5f60944db14d951620eec0c988d7d446d30e10c385d343d617665ab09393b55218d60e4238efeb6514ccbf4cff382a5ecb3b384eb97cb20fc6d8720bd37b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\58G7K3A9\Rockwell_400.font[1].js

Filesize
17KB

MD5
55a0d8277a94894a8b40f72717adf869

SHA1
84ec2afd66e38aeaab8988fb18787e32ac6e3bb0

SHA256
f8bf624dd3d3247c58ddf95b43c5bbce5c12404158d466ff8235af41e595f29c

SHA512
152d99198ebf5e5ab18de1bd1ffb804912934a8fede44826a08c4b7b30e17be222acdb406e8e005819f1e40a4e2d63c91a01a19e672c309c74f2ce19b09efb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\58G7K3A9\jquery-3.5.0.min[1].js

Filesize
87KB

MD5
12108007906290015100837a6a61e9f4

SHA1
1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3

SHA256
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

SHA512
93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\58G7K3A9\js-loader[1].js

Filesize
650B

MD5
ea5a5798612df63ab0532174aaf62634

SHA1
0f4713eef39ab07510d3703ef201885475ef0b42

SHA256
ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31

SHA512
8cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\58G7K3A9\layout[1].css

Filesize
42KB

MD5
e57c81f3a17073a78a7c3c865f74f89a

SHA1
587d7c955432f1e5a87460ecbf9086ae2589346f

SHA256
e36f1f796e538f826beb42510edc0354133c61c7f711b827def7f91d3f7c8bda

SHA512
630aa9dba2aee1125103954b093af8b24907d98761e1a9b93fb6f6c43abfec3afdf53825e3f12fc3cf87fa14855daadfdbc90b1e49b503fb2917599dd77daf52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\58G7K3A9\roboto.cufonfonts[1].js

Filesize
20KB

MD5
301d51da906e6cd41dea529d764dc504

SHA1
15dc16d366325aea102fa46c11edf04ea83a0283

SHA256
d49065ed2e4f7cb5eafab0fb03611563146102e514a5946bfcf08de6db58b85b

SHA512
6d50fea1d52b5bf19d1c758465d054dd3b0f03dbd754c29177e7f7248c275dfea2f61368857b54da914187966539f2eb5dead4308dcc331980fc26ca42255ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\58G7K3A9\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUTCV3OF\recaptcha__en[1].js

Filesize
56KB

MD5
b38c66b98259e08192f5fede79fd6090

SHA1
5dd3be3830fbee123a5a823ce7a5b5105be29108

SHA256
4646370e3e06c749da4e12cc8b87740055567f8c2cef8c96f37a4b71bf830368

SHA512
d8205af4437d6af32186e50adb8205f79a33504ce5e5e903dedd051abdb3e177b0c6db399fce6ee61d1665a18ca7576e8f81a510f0446319946a4bf1f879470a

Download Submit

Analysis

Sharing