0fd8a85b7ecf892022cfd6430cd4cd32eb9ce4e3c2207c59c20d791a365eaaa3

General

Target

fc52181d75f2134c14757b84284824da.html
Size

75KB
MD5

fc52181d75f2134c14757b84284824da
SHA1

b01a4e092fefcf24402bf0bbc99a4b785379e477
SHA256

0fd8a85b7ecf892022cfd6430cd4cd32eb9ce4e3c2207c59c20d791a365eaaa3
SHA512

43aa7f7beea56d6190946ef945f15f195dd33066853559df008c7a52023be5128ec25a68564511a77b9b21d2ed8b6dbbd6cc7f655482c859719e75aa296a8809
SSDEEP

1536:qTupBkoTVvndR5odOhhVzZ4AkcAXc2vfIxetuuj:vpBkwdHodOhhVzZ4oh2Hrtuuj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87389EC1-AA4B-11EE-8AA0-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2096	2104	iexplore.exe	17
PID 2104 wrote to memory of 2096	2104	iexplore.exe	17
PID 2104 wrote to memory of 2096	2104	iexplore.exe	17
PID 2104 wrote to memory of 2096	2104	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc52181d75f2134c14757b84284824da.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95371f80c5d6589911289c28e56e98da

SHA1
d92c8909d33e51ecca221f173b7c39b2d76abd90

SHA256
15bb791cce5a94e456fb3a17dfd9321adc522ba472608bb982b29825dc657153

SHA512
e96ce5eb84d31175dc384e21f699e9bf87aaa57760539f0509256c910056d2100188f9837e0e6dea6812f4a4cb139c0603a9b92dbb0392be82d720222bc1ebc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22230b08617905540f2e97a486031166

SHA1
ce131f22d276abb9000c471c5894f36610daef3a

SHA256
5fdf9d7c9d3e6da5fa2bd33eab0295eb5727d344367d2e2a3a43df5f69444bd9

SHA512
47747e709e2fee60b92b3c549af21cc6be123762fb3f9f005985730e9a9874005058a43889193eb33bad63038769eda44eb683c118cf68cecb8a51aa69ca3912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c16ad083056b6d7d6ca9d359ef61a349

SHA1
85172051aa5d15670b3d0f1c4943e4584393e61f

SHA256
1310dd8d4dbabb9c6342175b0a14249c42eb2be5006641e7a441a965a79f2f4d

SHA512
274bf9b97f88a650c6018a50edc97633eebeeaba4880eefde2684a21c551278fed261646727ccc2dc799ff0513bb4e5852142b7fd9ff161d9de5866f8825fc5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5d8cf5f3dd05c2a4fec7aa55111dcbf

SHA1
545e224242cd44f447dae4f509745d0a07065ce5

SHA256
eb3383667cb8b5d39173cef366805f27abf70f1e2ac53f86e8586c849955b439

SHA512
2c4b7e948581fc23b6adbbcfcb0232835ed33778f52aa7f7303bc1ed6a6152d6aa49d4e61db1ebfc94d2041d12993200f9fcbd347b3403df831ac7e0e5fd0fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8aa88427742922b09ff9ad5b0ddcdbf

SHA1
1d8f18bce67495860cebfb8645a7a327f2564e4b

SHA256
484195668648bb5d349419d47b5295f898bfb8cb48c0d5b7c8b78541ea258c74

SHA512
47d90ac26f170295a8944f1e99f8e06fed270002e6dd4edccbba508f046a13fd8cbb4258f49f834b67d6874de718de91c87a3e443c36a4e8003b7f0c2142910f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIEDGG3E\478691279-postmessagerelay[1].js

Filesize
12KB

MD5
92169c8a0fbf6e404267d0705cdbdf42

SHA1
a5cd88b74ca5ced239cdbfb458fe25540d671f46

SHA256
dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384

SHA512
8c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\rpc_shindig_random[1].js

Filesize
17KB

MD5
f019fdda31635d2a31b151ad8ad56c7a

SHA1
6adcbec55f66ffaef83d9a134423aa98eb2a2189

SHA256
c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831

SHA512
fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64

Download Submit

Analysis

Sharing