3f180629728fe56d8d2ca60dc65786d1b5952734d172b1c6344f9ee93421964c

General

Target

71302fc8bd3f8b0397ad117aa20f9a86.html
Size

895B
MD5

71302fc8bd3f8b0397ad117aa20f9a86
SHA1

97b02493fb05b9b7f97983be16cfb3989e3a03c9
SHA256

3f180629728fe56d8d2ca60dc65786d1b5952734d172b1c6344f9ee93421964c
SHA512

d667321a9a72b6111dab096da16a091d446e7c78009f3e18f795d2491f689e0bbe39ce29f86d21348fb6face8958b6aa63a2adbe125f4a60487b578c14670ce9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A500B3A1-ACA5-11EE-B908-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1128	1972	iexplore.exe	14
PID 1972 wrote to memory of 1128	1972	iexplore.exe	14
PID 1972 wrote to memory of 1128	1972	iexplore.exe	14
PID 1972 wrote to memory of 1128	1972	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71302fc8bd3f8b0397ad117aa20f9a86.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27b42ae6be7306f60da133457c1ef04c

SHA1
e971086229a95fd64a3553105d2f83a4879be466

SHA256
16fc769792638444aca0065fcd98ae6a2e66e251369b60793ea822b33011ce00

SHA512
575419a0761dbae3e2ef698ee25fee253f477d44f67cc173c71db097e4223393daebc431ea64cda47d24615444734d4807dc065572a653574b302d04a08ad2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a76e327436d61f46afa549db40ee7e5

SHA1
60d10f6042fd48ef865be0a9a5da2a45f60a6c9a

SHA256
300443ca3e13b4827931ed6e57ef30d36eb68fa16bc9e7117b428dc364a2f31e

SHA512
6533afe8a3a2f4ac9d8f5033854814a57ed8ed5c7e74ab97a0a8d6cfb845d6b3b785f6a38772f23c87e0bd4275efca1e5991a6e9cf1d96de0bfc9b5c21eeda96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9235dbfd71496c2e7c17b1c6e0c8db2c

SHA1
7b0551cf0b1802d7aff7a507c320de9fb916b2d7

SHA256
f49f595c5e421f9bd38f4caf0a51bde7aa869f4fa3dca400f90edb0641df0e26

SHA512
a8a1a13a75a9cd9859e2d7c13218a05deb07dcabbbc84314708a50f1ba2eddd8b8e5b3f08a671f4ed5025a4fd7e5e71ac5ad450117d67deb76494482470b979c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f2d027671082cd96dd6d4a52ef4b1e9

SHA1
bd433e58016b42ab027b576eae62c2fc3dbb5acc

SHA256
f3495c5f196b39a741fe026bf17d80e7044a9ae5fb2243686fee1e01e05de290

SHA512
d28c81fe99438a1fd60f91fc9a59f68e63433ee105d1ae1da2cde10de1ed816b701557bb096f4bc4277b81e99d2b49d5a78e3c42b5dfe0c45d552850dc356cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9060946b21a7ce28aeba27a9cb83b00

SHA1
38515f27e334a0d76f7470c3c98ad273639bce72

SHA256
dc2abc5af82c97514938c24a72341c456fc3bb1571fe225c16e3cd50b9de058d

SHA512
56e44bb20f3a4ee439d3ecb1178afd7365e3db658c642fadd19e8af411401ab71c2dbb9f6134ca01614510e0a703abab7a4c80b9c68560b47bee04183331ffd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f1e99717c0d8123c82649d897ec43b3

SHA1
e5ec1d45dd057ab9c5fd3e2b75c5434870bcd359

SHA256
d33b6f4369b289a0e6c0bd36647836c266a114e8f1400e5aea5a9a3314fc9da6

SHA512
2572f1d2780176a3e8d20af18d8c907517086b14ff9ea67c08f9d947a9eb17d1b1e662e1e5a3d214c83ab40c31f41f8093130e4ddd0a0be49be28ddceff0d2f4

Download Submit

Analysis

Sharing