0bf57dad274e9fb6777dec2e5245ea61c49a769e17a466e95dfe484ff67873f6

General

Target

393fd4f81b3020acb9b5a69be1a396c7.html
Size

6KB
MD5

393fd4f81b3020acb9b5a69be1a396c7
SHA1

656a4e6a6eff24f3fd94eb540aea25525280206d
SHA256

0bf57dad274e9fb6777dec2e5245ea61c49a769e17a466e95dfe484ff67873f6
SHA512

ca234c85cb7940f38282174f7b2ff10b3f2cfbd05f251734c35be4b53c316665783b3bdcf5bdad8cf6200465ee044aa83defffda72a3ef41b6c3d810d770854b
SSDEEP

96:OrWNLSOjIwklrH1wGXMm5iaiJ9LtbuMFGkdVHdoeTp3lWZswnfPLbnM:OqNOOjI/JXfiH9tt/hOXPPM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93099E41-A41D-11EE-B49B-CE253106968E} = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1756	2052	iexplore.exe	14
PID 2052 wrote to memory of 1756	2052	iexplore.exe	14
PID 2052 wrote to memory of 1756	2052	iexplore.exe	14
PID 2052 wrote to memory of 1756	2052	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
1⤵
PID:1756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\393fd4f81b3020acb9b5a69be1a396c7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39892cbbbb3b58110d53d1d4b6f1b16e

SHA1
74f2dcdf12be3b9a4b8f2134d9c7cfea26bd21eb

SHA256
453fd36ff768116a007b0bf31f4cc647706c9e3284d62e9018ab437e6586d3a3

SHA512
69fbd79a09c275e4d8f9e03ad5f9c4fdf1dcf578cdf3bdfb1e678107c3253a0e84ec98a4f71db358a981dcfbc3cf623f4c09c43bf5667545b10620ad2f28a243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57e595b954acc50544d17916b6600f8f

SHA1
7c78115bfa223d5e6111c5764d9a80a4c1068b02

SHA256
54610d92efe9f463d1688fe453cb1948069d32852e65a3722257c4e906421253

SHA512
d0e7b445495b486e252672c1f873cd71ff23c02a755c2087649c0baf27ddccdf933185e2171bea3f8c4381d4324aabe8e4b43213d5f5d8d25c6fc75e6fc682b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
889e3077b35eb93ba6a39718740469ac

SHA1
4688217f8eefa1674a486d78e1b4aa13af9016a7

SHA256
c063030825ad8d1540a2cdc0aeec75d7772116a04b0dd0f3a51e284f1cb74606

SHA512
193ed4631158d0b54f0cdcb14421357e02a7e17d021278b5c6ac58dd4ce735b95ea4efd17d81e38003eba97c20a95b652ca3266de2387d696da71be98052d5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db9095cfc85a37479dd4c411bd6389db

SHA1
c913a11ec3a44735cb935f807a22e3bc83220b34

SHA256
aa064fd4c9912e6b27be1036ae9dc6e29de4eb735062a86db146ba6db37022ee

SHA512
e6e1dbe119dff7b663c583f8e31979cf31999baac43d8b9d6aa815664b5713ef531822b39fe299d2be11816d5cc7f8010a14a54db01e250420b84e92dceabc43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f4920310fb917315629a7fa581d085e

SHA1
9aaac3d0ff3d2f45829bc9d24ca6bdf5c071f1a8

SHA256
3e90e5d2deae2d5270a18380e4dad404090968eed7bfc8203c45e425e8c4ea09

SHA512
a0b045f4ef68902664ea08feda978b915d56b85dd4a2272f90ef7177d5b33674f017fa0c180209952402df636017423cfdf8f1ad1cb8bdaf315f29ec8d94ac0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85b5a6571a1ba1358b0932b88483b39d

SHA1
6f1ed3d98c253219082318986739704889315ca7

SHA256
2e87b6c812a5097838199e90c86b95554c47fa3e68965abe8aea11cbbb637479

SHA512
b33cffa97b53f60a6597b1ee6fa538c50996d26da956ddbb7170c53fd8b6b39425093b77ad0168e67f8afb37464ddb2a81751c4f838902cc840036303db13638

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar372D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit

Analysis

Sharing