12bda788378e07c085fe5c0715a473faa600c416484a8dd360e931e2ce5b17ac

General

Target

6561863f0e82401ee22f8f5082836f0b.html
Size

142KB
MD5

6561863f0e82401ee22f8f5082836f0b
SHA1

9ed289e57888e181a8fe98fb5bf5e9082a0decf7
SHA256

12bda788378e07c085fe5c0715a473faa600c416484a8dd360e931e2ce5b17ac
SHA512

af4ced850032f09518a5877f97f8736874c425d8505797e33269c31059db75a54ac8f684878e93171cb9d773c06c907f27497fb6e977c0294e68129f0c72c557
SSDEEP

3072:+HWIHiCcUir+xmfuSyN5MBlK4zzE7Xzt8aNO9Amlmv+H9Ef29atNO:+HWIeigfuNt8aNO9Amlmv+HN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{841DA7D1-AC71-11EE-B5B2-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1696	iexplore.exe
1696	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2000	1696	iexplore.exe	14
PID 1696 wrote to memory of 2000	1696	iexplore.exe	14
PID 1696 wrote to memory of 2000	1696	iexplore.exe	14
PID 1696 wrote to memory of 2000	1696	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:2
1⤵
PID:2000

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6561863f0e82401ee22f8f5082836f0b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
204db52add4b89df85ac5d21e6eab564

SHA1
59bf689757c24e361211c692a0ed7654aaf531ad

SHA256
d1816244837228c5a9fd6daafbec4fda0039745434d1442d6af2071964bb4b0b

SHA512
406a550043129305af6f9c2c60703f2671d7d3b3d4c2a955567899de028a5c8f5fbfb1cf01ec8625f2a4db6dc9efd4e4df74de3857505a4ef3341248d3f6e9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f237be296cac7fb1ca6317e573227836

SHA1
12673870d7946443be4ab8626c29ba9b85efcc9e

SHA256
13070ed48dae25d6118f5cc72b572accc78d8241fb6d36070ca9c3ddfcf1f51b

SHA512
23ed8e82ec9725983d85cab814ab3cf9ea284ef6a03414dcf34712e805958a088cac61775fb379bafb8924ae7175c9b67c413c6224d4446bcbd6e8038136260c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73b9c66afc702f65e7275fc3620e0804

SHA1
7d399e498b7e96320686cffbba2bae834cd20df2

SHA256
7885ea1aea2bdc8d57bbb3a0896b59abba724998f7325b59e797a7adc3d52b88

SHA512
26b9d00f7282c119e6d691146c26cc7ca311a0595793488cae1ced85b36eeeaf7e56f7cac24433bfc5a3d695c353410ef5e100073a191820b7a14ab62e6c02b3

Download Submit

Analysis

Sharing