760f1af8646a1df101aeaae15264e5a6a68495d160fa48b3c2a6f39fbfacf4de

General

Target

5ef229000c96e189c02c107e970d9a94.html
Size

29KB
MD5

5ef229000c96e189c02c107e970d9a94
SHA1

4e05b77d7e47777a172010bea4c95744d745e93c
SHA256

760f1af8646a1df101aeaae15264e5a6a68495d160fa48b3c2a6f39fbfacf4de
SHA512

361e026a91734562ff232f94569892c3733a0d0fb4b40303861008678014754299b756693bc41bf695189132f9d252ff1129edb043b021a55f5922de43410b25
SSDEEP

384:qLglNskdlTfdGxByIDlujjH8gX1FWSaBMhcW8aB4dSNBUMA5YznT4RNkXtXKrg1S:qaNskdlVHtlFW7ihcraWd0yMjT4Rv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E12D7B1-AC57-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2436	2900	iexplore.exe	28
PID 2900 wrote to memory of 2436	2900	iexplore.exe	28
PID 2900 wrote to memory of 2436	2900	iexplore.exe	28
PID 2900 wrote to memory of 2436	2900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ef229000c96e189c02c107e970d9a94.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78cbc835c612c35cfa4e87f93081af40

SHA1
8efac5f3606da6bb737aac58c4efa04350f12d96

SHA256
110d78401ad89c5401c3b9b449e6e3c678ecc395edad7098a23e4e3567ff1944

SHA512
a921cd5649664ef8f1e2afcff22f68c9737299a7111725fffcda8d274bae80a86490c66787fa6898c38724a427348645e035201ea6be667d7f6529a571846196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
174b50f7077e38be5085d2f27e72da36

SHA1
e79803751f3a907d5de06a22334950897fb3d67a

SHA256
0099907de731ba3a715c5e19abdf8c18078377b676dcc438c636dc3ff9dbcee7

SHA512
4e3d4a6785e676de8b5f094f49b5883ae8288c93502e2d323da198e9dee8cf85ffc1947a5867962349dfe9e1329da371991280b96334338095007d53eecd3e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23b6b37f15478ba08f8c4bc03d2b13ac

SHA1
a4f3b12981f464da99dd7284b0fbabb5927d9e4b

SHA256
9b1000e4d15c2e3365e2ced51f50e7923b344153875348a4980a4c0f3565ca5e

SHA512
b942095b5c9bc22d11e91757978fecdbec1cda560f7f58559c70bb379bfd797f4aeb068091c9b07953eb406e4bb54c01f5a92e7deb9b4888ffecb0cbd6ca4500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53bf6692edb53eb2facee44d385769d9

SHA1
f9b68fe720995b55c5dc40f94aa0a9bfa58660e2

SHA256
ca05743743e6b3d2300c3ac4aab12c338ec46b9ef18e7608df29b7b4d987e975

SHA512
20d83e88215ecf26c085cda66e372581667d17bad94e4cbb25326df7a8d5a80af5a399b8ab9b15a9d39567913928bd785b3695fddf98950fb7f01b08b90406d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87981954c6d2a869389a0998dfc766dd

SHA1
23db45d9e78bd9d683aa4e5181ebc60cb55a59bd

SHA256
1cd8a464f58327b162f3d7fb65b5e4359fac1807d93e49c9a4426a8ebe749603

SHA512
6a69fe9df961319c1bfdae8bbc01890bc03baa2c7e4b605bcc65776de68dae32ed1783e5cb8a1e74bb6d286ae270ef7033d46cc6cc1f0018558ec9fc91e53726

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E84.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7E87.tmp

Filesize
77KB

MD5
167fa36fdb1f973c7fbdde5ea0680305

SHA1
76dbf01461b5b23dcac91928fa28de71e5b05baf

SHA256
f1892348ef51e4ef5f94fdc80ee1a8c21ed379fe159dbdcace857653cb75b1ec

SHA512
9d9a61a3b3c35d3fd60d1651c5a21a60d743040fea14955fc681cd1b91a2a4e47ea00f6c6f8ed0f02dd84538517ff411e5ae438f198557be83ab163dbd6e2572

Download Submit

Analysis

Sharing