283019f416c00ae87d2f9901cc67e5bdf19ed7223cacd0250c014957191b3ec5

General

Target

2c62258115f4992931c2feef7306f027.html
Size

31KB
MD5

2c62258115f4992931c2feef7306f027
SHA1

172764dab31b05314bcfd361b538d0300da1741c
SHA256

283019f416c00ae87d2f9901cc67e5bdf19ed7223cacd0250c014957191b3ec5
SHA512

5680fd954e1f3fa49b1f3347b71ca46bf5e48ce9a80631ae3e0eefc4281448bb90aec57172eb72bbf852da05bca7058dedc9c66fa305b32289e3cbc4ba8c492e
SSDEEP

768:Evpm8BmTmXSmXImXmmXTmXmvQmlCAq8XeKOq5O3RcN:kmWmTmXSmXImXmmXTmXmvQmlCC5O3yN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53890991-A5CB-11EE-A5B7-EE2F313809B4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1392	2424	iexplore.exe	17
PID 2424 wrote to memory of 1392	2424	iexplore.exe	17
PID 2424 wrote to memory of 1392	2424	iexplore.exe	17
PID 2424 wrote to memory of 1392	2424	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c62258115f4992931c2feef7306f027.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
368230893f87322ac19dce5983c6c9fd

SHA1
c598fa5f3720a5dc83f04b5a1e668b8a247b76c2

SHA256
02b83a73e199af36828c2df08bca65a355aeada199fd9fbe02f0139af5990b6e

SHA512
453a9bd5cea43b7a969f9e8bf07803ef512f9ec80f67e2f9da25e6fdc3a89ff34b3362d6449ed2847192e91fd58926def9aac61dc87fd5d8fedfff566b80227b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c4dad5b957babedaf43704ab9d9bfb1

SHA1
f82bbef99c6254aae51f5c35acdc8c6cf112cdfe

SHA256
e022265a2b80f8576771fbf1bfc2d74a73107dc8355a79db9fec2836bfce0d27

SHA512
f12f3f0492c6d37d43725a8bc0bc112b5f96575563d359b34adbc6c941606371310a4d666f5c00764a833a92df0d4ef09ecdee8dcc014fc4cd4ddaaef827502c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c427ec313fd63dbc1e3b45f248fd6509

SHA1
d6c5dfb6e7899023aebbb41036b5414044c9d6ce

SHA256
3ea3e1b32296cd803f1b475c836a57f11278456ae26d1a4b6b919c7aa096e4e1

SHA512
a6d4fa035a6bfccbbe8851f742cbff87361eb4c3b2ea0ddeb103813a0059143d13332c530a277fe4b309d339f10ea36e25970b68fed41d38dfa8295aa5ca9f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9284ec6c6f124dda6451646b298a94bd

SHA1
bf2780f04ccc99b5ce63ce89d9a664085dbc20fc

SHA256
15b4599aa56188703a4bd51157b87d155a15b801de042aef5965be2df09b25ae

SHA512
3e965ea7c5abe2dc8575e063a835632560a0767500f784eee6a038b82ad9c74761ed47ef7ccb207d25114e7c98b0a5568825dc0bb34d09b3b06c4b54bea36817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7043759e93b93e56720b828cb0cbb091

SHA1
c85793c969c507fc737d5e68a400fd5d1c0e36f3

SHA256
a94572091b6956b421daa3369b3808e3391abd2bb190b3dd6f527edefa4721a0

SHA512
91b939bdf456ce92f6a3fa939b0743fe523ed7c898c7e13fcaa5e085052dd39f47c928b978bf920cf237adaef852f65ebc0444a038c012c6224cdd453eb4981e

Download Submit

Analysis

Sharing