e26562504966cabf5a4373e47fb94d27b4ad8065a0b9152e940c2b7f18103c5e

General

Target

6b1a9765e8390e507da1229957799a76.html
Size

15KB
MD5

6b1a9765e8390e507da1229957799a76
SHA1

6b9e5232664f95e1140d5ab411bff02c2d34e5d8
SHA256

e26562504966cabf5a4373e47fb94d27b4ad8065a0b9152e940c2b7f18103c5e
SHA512

1e5a5c061c93aa6cd6a75f00b4e07921cef08ff5ae45332baf87c6e483275d07e0bf323a8f66432500193b143cf1e344aea51b9edd9b376ca433f026dfb95f90
SSDEEP

192:ryo1xjSywNTBwY+Fdt0gek0ha/ars5VlsW1xLMq6caL5kjQpxXfKNK3zwHBz91Im:ryonuy2gebQXFL8L2QplKNtN9ylQf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{598C64A1-AC8C-11EE-9A90-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1564	iexplore.exe
1564	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1800	1564	iexplore.exe	16
PID 1564 wrote to memory of 1800	1564	iexplore.exe	16
PID 1564 wrote to memory of 1800	1564	iexplore.exe	16
PID 1564 wrote to memory of 1800	1564	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b1a9765e8390e507da1229957799a76.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:2
  2⤵
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bddad7d7acc8c8eb3913218c0656651

SHA1
928643ad37e296862c657731ca845093dd6dbba8

SHA256
22353a4c9869de3df1ada9d5be5f33977145ad09f8bc2e3f8b13e60c0801b42c

SHA512
e2876553a978b3fd9b1f2aa7a948aad8403b2d59894281199d38a4033ad5f5baf6b9135e2781facb1fb82985766c1e5fcc1aa72576308a91891df8dcf0134d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c42f61198bbb29f97ec2d8280ef0f08e

SHA1
aaf9dffafc8c8afc871f13603cc1ffb538cbdf34

SHA256
2bc3cfc23e59d5137c0624c2d62f613a0dbd302de7d9cc2a334eac9835213ed5

SHA512
39cbc0682d6a427461107afd56ccf8763c4d3f07e5f04583e86f3753d1e280732137ec8c412439597ea6d814a32a228717edacc2ebbebb4e18eed303e895e6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccdce42f9f8cf5f908e96c8cb1b10d44

SHA1
cbac8c016f25751f5235887e503cd1d47f1761e8

SHA256
f5d950f92c0ad4047f5c7510d9339ca8d19bea758ca5c14146cb30db9b862f34

SHA512
f934ef8ebce7850dd20b279166db9509777c2eb7d4e8591c89341dbf5fef60ca05cbb0337a2ff950fb5f1af6f3d0ef8f7442d994838394ba754f2d854446bc70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c493c7590a1c45b5d399f9d752a5e571

SHA1
d82aeeef16c67af4280c20ca2c118c6027247966

SHA256
6b3c6ae5e01451d4ac04987b66acb4f1817a9e564a37b8a415ab71b61053187c

SHA512
8fce99a3c1b291e11a26e1c9f9c36fd1e84f3995aa6e1b2cfd4b3b39312ee8ad93874b75e3f58b7328f528a4f38257864385b4049018e80932ab01a2fe2a96dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca5983ee109a67fd8bdb573b9f160027

SHA1
14204a8c01d8bd269ac8534fcd16336cdb8637aa

SHA256
8ce224c598213ebd98eddf66875d71bca1282f0392b37df12256c809797b09ed

SHA512
160310449d1f44ce8dc3479bb219f013254eaa7f1fff7ecdfa2945d0850fc0a49ca0b237174ea712c28acc42dc2244c4205c92d98ba6937d2653dad95171d53a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9dd16dc5ef4a5f2de2e545d33e7491d

SHA1
4617a67680a3564e7f39cdcad1272c521ba0a525

SHA256
0b5f4e565688a84149ee73ac549418cd03adcf286fce396e03f646fb406e52e1

SHA512
2a9a6efa788ce0ded8b6a7408760864b43bb035561e4940fdaa59a9e13f08ef1abbda405c7bf6cd5cd866a534ea225cba909440bd9d12802be747c44c1c48c5d

Download Submit

Analysis

Sharing