dd801bd405e6ec32df8e3ad837b25be7c434c61c35cbc6fa625d370e01d464a2

General

Target

6d2eccf63eedb84db173cf7508e4c203.html
Size

57KB
MD5

6d2eccf63eedb84db173cf7508e4c203
SHA1

b161b33a2836f2fee090d54195df27fa23e4a2e3
SHA256

dd801bd405e6ec32df8e3ad837b25be7c434c61c35cbc6fa625d370e01d464a2
SHA512

30ff4088cf04d08aca96b17659b747bddc4f44a3fa2e16942e4155666870bc6f962e221e4e4e0b2ceaf89d451b1ff1d7a56008c167a5b0453b39f29c3c4c1c0a
SSDEEP

1536:ijEQvK8OPHdFAbo2vgyHJv0owbd6zKD6CDK2RVroBGwpDK2RVy:ijnOPHdFx2vgyHJutDK2RVroBGwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25738B91-AC95-11EE-9066-F6F8CE09FCD4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2172	2152	iexplore.exe	17
PID 2152 wrote to memory of 2172	2152	iexplore.exe	17
PID 2152 wrote to memory of 2172	2152	iexplore.exe	17
PID 2152 wrote to memory of 2172	2152	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d2eccf63eedb84db173cf7508e4c203.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
639eda9108b3c94271997d9cdd969597

SHA1
2c8f45a57a1f51c5a715bbe288c5d703bb514505

SHA256
079a14078da9a8f54494567fe723813412de0a65ab84b57f2ee50609790af320

SHA512
eaac14a460d6a2ef6c36afb697d7f4d3f935057b786ffa29f104492f7b563afd829e7acb4e8dbdeb03ff878b3a771d7f8fea186ee889d631bccf3005c3c62d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a327d53178ba073bc778681b9db488f5

SHA1
e794e5a13c7c22da4e213d371e9f90dc1ec8b51d

SHA256
3053ab63f981bf5cf0153cb97574050b617fb96f906a802d2b63be3180c726a5

SHA512
65f8decf7e985e93760f2e0316b8d7c6c93a9a7e6bf6a02a1798916378e464250fe06c789466a02e781de1db4e31d51b4e4d56396bb4c757edc5bdb6599feab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce52a69f09d236c39b7633e07b2c7fed

SHA1
52af6debf1183fca76975044fae0eb762cee496d

SHA256
3eb669923b2eff2038d23a4b6453b86aef2d8fd7fb8cc98eb7c9052e2a98c7ed

SHA512
fe102b0f2f0e85143c8982fe168dd609138b25cb62c4baadb6ed07d2ae6b219e59c4722cc93a837e7cf507063dac41f099713fa9a933ee2bf9a2bbb5c1d0cba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b7902a7bd4bceba671a3371af6357508

SHA1
13a9af5676c1b00f60d21ed29414db39f327950d

SHA256
7a12b8f1bf8b86dc442bd30fedcd593ac7bc448bf991f143f06da041dd87f872

SHA512
cd33af944f66910f5b2ad8cc5a491258991aa0d648206b484eba736ab049aa37fc95f0c7a6f939a01cfeeb216b45257c6b656c7fb7a204e16858502e72bfc3fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E8PFN5EB\f[1].txt

Filesize
34KB

MD5
306fb0b813b9206f465dd3a466978ce7

SHA1
e10b4d104b2d283f5243c0894ff18b7039f4a70a

SHA256
bdddc3dc3feb2985322ad5de7b1b93c431a59cfdd74449c0d37d2c25d8b59002

SHA512
649a20b7f7182be0cea75eaf3fd2cc03728fa33bc4757b1d4ccc38aea2e18e948201555d503df48eac70de0cab53a520ea9f2ce12097bc382493b882e5f6c152

Download Submit

Analysis

Sharing