c8ab12f5c87079d95529843ec68ed55f895239d16f8ffa40ad4e456cd11ddf83

General

Target

4ae6d97126e0122fa79345d35bf30ba3.html
Size

432B
MD5

4ae6d97126e0122fa79345d35bf30ba3
SHA1

21a868dac771307817c94f2e729510a16a86bfe5
SHA256

c8ab12f5c87079d95529843ec68ed55f895239d16f8ffa40ad4e456cd11ddf83
SHA512

01f0703a3c4456db71bba14ed8a2d6d2ee3c0db7b14eeb3f0e1fd5c903a87518e148532689cf408c71ec152589f69dea87caff2ed0a521123f3b4050894fa864

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8D4B661-A468-11EE-9066-F6F8CE09FCD4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2144	1680	iexplore.exe	17
PID 1680 wrote to memory of 2144	1680	iexplore.exe	17
PID 1680 wrote to memory of 2144	1680	iexplore.exe	17
PID 1680 wrote to memory of 2144	1680	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ae6d97126e0122fa79345d35bf30ba3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
238a1a636471b9f3346ca960daaf7b8f

SHA1
b13097e50df438ea6f9c45bf8319df61b5f663e2

SHA256
80afbe8b0b788bb6540bd399cf19ae595276031609202a725e80a876e1b1ba15

SHA512
b611f3ccd49ddef162aeb7bf9bce297572a420dadebfd5bf80b61bc5dfbcc3df2697b990725ca7ecdbeae8c2d5fead4952b66b2c3d75e18a97e285f6d7affc50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab06a4da9e12fc95d1921f42299db632

SHA1
5bc6e01bea893f806d9e2acbed46af7f7d20c03e

SHA256
bec2b1baa2b907531bf7101b3317c0ec1df323d7357c47eb843713ca7ac33ec1

SHA512
0f665c012d5c659bee586aad96b348951f492b2127ce5817eb4b7dcaf1ae1d1c7ea8a4ee6599d2555dda9731ba9e701a15fa0f15a2b00a640c4340ac1e6aca3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf1c0431ab6af9308b8647976a754bb

SHA1
bdf3e3dff44ecd7ff950faef736c286ab9798bd8

SHA256
5e3a9c3fddf22690d054b9c6f4d04efe66915e7511d7497bc754c248259bc33e

SHA512
80bc2dbb0211bc636300b28410d5749b982a78938f9db01eeda29b178f24f214c122410ef71bce82be50b564803fb1bd1f20d8a1b8cf196217fbaa887dff7f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66260184a2a322e2b1ca7efc8c9dc66b

SHA1
29d18b3ffd8bf4404de0faa06e5faada4abac7bb

SHA256
acd7a2b98a870821515bb9dcf3593d47fd6ba9599b98417d3fe85e6c2dcfe1dd

SHA512
e6f2abf097d3c218f1581bdb1826061eb379fadda31f98c888fba39fbdba292f3c8315a991cfdb348772bf1d395120b74de8ff925193142385bec2a96867bdcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\s8rbov0\imagestore.dat

Filesize
1KB

MD5
ae08e20b68a4e4a67ff8527916d6cc43

SHA1
7a7d059c7c923e8486ce35e95698986255d4a1f5

SHA256
621e639c217420cc2fdf89c0ba2f10209f02e192c587d7a3c5fa98c71b860e52

SHA512
a845787e56fc3afe4d431f2b2c17f37f21b3f5be43179b59eea7e6fb60e472a8b6f4abc9925135df1dec8770d3ee670cd593b3d4e6d96657e07760392905a4a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0GHJGO0F\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit

Analysis

Sharing