dcb7c2babf04ccfd767278fb6dd64958093c6660b0a288397a01a14b4ab46550

General

Target

75180d8a4ebd1ee0c420f98ce51fbb66.html
Size

57KB
MD5

75180d8a4ebd1ee0c420f98ce51fbb66
SHA1

12a8695510541924f58f9bbe535bdcf16021810b
SHA256

dcb7c2babf04ccfd767278fb6dd64958093c6660b0a288397a01a14b4ab46550
SHA512

ee08fd4f5e83d3c725c05887a888b10af1b92b0aa10d41e1dd390de0bce8d10436cf0bcfe40324c563309e93aeca5ec38c90a9a780c12e4e88a2141f86f994dd
SSDEEP

1536:gQZBCCOdm0IxCKfoXfLfc8fqfufhfsf58f7f+fQfHfjfff/fMfwfZfcflf2fDfmJ:gk2k0IxUjbymJESTmo/7nHkYhkd+rejF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8C427F1-ACB3-11EE-ACA7-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2136	2028	iexplore.exe	18
PID 2028 wrote to memory of 2136	2028	iexplore.exe	18
PID 2028 wrote to memory of 2136	2028	iexplore.exe	18
PID 2028 wrote to memory of 2136	2028	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75180d8a4ebd1ee0c420f98ce51fbb66.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd57c3b4fc838f8e0214ac11b4ba1f15

SHA1
ea1037c0f5b9dd6ea4a86f45ba048bcf9102c7d9

SHA256
98112aaa5c1015d0fe7ce13842e6d8d1fbd4bf0c83e3b895d756083f916101a3

SHA512
51e7ca4fea36ab36821a0cc6eac6dbbb117cf0f9de94cc50137ab1006fa5fe144f25fd226d161fcc89179ff0b81c47050fef0b56e03e879cf5ae45564aa09aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d5ca9af998dbc7bb542266f1dad0b9

SHA1
aa980a756204e7c89a2d6d4d5b6965cea511bf7f

SHA256
c7ebc9c43620fa765d47e64abb460664a49041e083fffc0a803ed383502c8405

SHA512
76cd94edd93402e29fca5f18546dc3ac7068198f35ba49184acf6044b7a1b1660b462ff954c3b8adbd6a803cd4cedb1d8c6a755cb233f5bc9aac4ccc1f5855c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3525ffde054938bd2bacdc19662316bd

SHA1
14c7c27707885c1fdf5fbfbd81444659be0b6e1e

SHA256
07618694d4dbc724e8675125eb0d54ba722a480fcfdba23de5334d75abe21937

SHA512
93c04efcd7b15fbb61eed36377ed541764dffdf4ae95fc34c5143355ce7b85da477881c3afdd0cc14b9f6047b5f929d3f7613bb4ef30412db669b3b9d65b783f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8af946fbcc844ba3bae6e603519b6c0b

SHA1
c5733714a81575adcc6fc681b335b916d85f0575

SHA256
35588b017d5960178fcb6819909a4fae0c9ec13bf3b15eec8b0456004b0228f5

SHA512
120d5608dfaac1674380cab80d6c94da27418803bb31c69be5f4d1c7ed97bc343b86314467f18093f72da5fd9e8091da70f400a453f140d1641d566b815a5b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41B4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41D6.tmp

Filesize
126KB

MD5
c5120e46823236c95b9c80892b61ecf7

SHA1
19f60f1fbcb99ceb0cf5b0b6730cbcd83e50b882

SHA256
e0cab9e46d088358b023b3d02a3f0570c25935f695aded476acc0da45d363e50

SHA512
b34276570529d1bd2778362695087905fe8c582dd6f435eaac0db3d3cd0dffee2ffba92051c6b503863d89fb85c4bdb613313cff67f9f636801490caf185714b

Download Submit

Analysis

Sharing