3793850e57fe61462d731537feefecb66f9c486032f0226ba7a88d6d7e8da148

General

Target

061b1a5a1b6d2fd01550f2ae13e21d94.html
Size

55KB
MD5

061b1a5a1b6d2fd01550f2ae13e21d94
SHA1

595da32209e9663f0ddba0fb6afe5fb2f8c1cded
SHA256

3793850e57fe61462d731537feefecb66f9c486032f0226ba7a88d6d7e8da148
SHA512

9024f4490132884280bb69d382f99ce5a547b346e31bcd2edd5b85da1f170ed2a56ced45d7d86e64121843d0727fc3d4a9a5ff765017380dd311003f0e2334c8
SSDEEP

1536:zxEHv7o+gRWQhTvSQtsi5ySpaXnUZUeWAKJGFpKR516Z+L:yHTfDqFa3UZUeWPJ4pKR51J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A960661-A70A-11EE-B432-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2676	3040	iexplore.exe	17
PID 3040 wrote to memory of 2676	3040	iexplore.exe	17
PID 3040 wrote to memory of 2676	3040	iexplore.exe	17
PID 3040 wrote to memory of 2676	3040	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\061b1a5a1b6d2fd01550f2ae13e21d94.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
003c0e8ebe03dc48da20a189741e5ded

SHA1
6194cd304aad000fb823f13f2f562f258d97b789

SHA256
0fff9223dbfb86ff8a6333bac81516cfb22036b7c5e17e305f7a3b123f036c3d

SHA512
33a9ca813da0c753c1a7121ad0220758578b20a8c5402d4522b409613a9c126478d00adae801dbcc17189f849d9cb40e182171c57c1f2ae5a3cf430984dba2b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45f1a5116ebee6f017ea6b5646f07f99

SHA1
069ebcf78d9caabc0ded10cbe7824055267dcad6

SHA256
e3492b8d14b352fa03a3c1affc06778899856b737e47207345729339689233c8

SHA512
4f2f5ca84c897486db6becb23af16cc34ff1278d1b06c79185f23b8aef2015e14e3165e1fcfe62e68b62aec7a2d416d8cc4bbbaab308607ac70041be4a3e8e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c312f806124acb4664be39bf352a316

SHA1
5333515bb59e12a58635746832a93a11fe24b85f

SHA256
5887cf3e2e4fdd73398a5f899541c27a9640eeacb409ea296b1045d45af495ab

SHA512
c1ac2edeb49f3ad290c26dd411b8d9e2e286783c1f785e33a525dcce69b745e6dcfae193c4e1b1afa68231b3e37d6f082220194c4b23885ec3289ee2eab19c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5419cb9cf616a8b5de2fc769e13050c1

SHA1
c1e065d06e188f76f11ccafb7a0c2caf981beab6

SHA256
cd29ae42c9154d667e21e9b6936e52f4c51cff2b7e7a772101516ed0daebd4f4

SHA512
e36fcbdda291c0eb784574c50b121ff330b91d4ced7ccc2d9fd3af300de4a0c76f0f2b6fd679f230eeec26089ed2a41645733271aa2cdae6eb1c9965b7356c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd949b1b1771e47d7ffa03f77c9e3cf5

SHA1
c56e21ad871bc3e7b0499a4bf33b0f99c80ae2a7

SHA256
31cb6cf0b5d20b0dfe90bcc486ce52bdda07f87d18f45906ed3d67bb36f7fdd6

SHA512
4fd4ffe51e7c97fa8cc471d97c35de9094a16875fc3cba22d23db90b0c1f58b0f59fd4af18969e6a42b20768ec94329336dcb38d2207318f74af02dd6672770d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119670459fd332d0cfb01550c67dbe45

SHA1
6f4cd54be611dc1dc5813fc186aa663c29811e1c

SHA256
993132a1f0bb33e5529489816693f9aebf239886b783c4c28b06610cce9765af

SHA512
81b168a1f8ceb9d66722c63a4a5f88bc6d918030744f761c77a9b8b22c6788066fcd46b3ea89f263d8888b38e00d3cffe79f0030a0b931cfa3fa86f8122f3cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\cb=gapi[1].js

Filesize
52KB

MD5
2c1ed4d7622d67a86ed21c6821e8ddb6

SHA1
e60da2cafed83974a3132a7aa085b5d32dbeb12f

SHA256
18e8212fab67058562c09d0adaf2a0f6b32f0aab6f8df2f2be82a8c7df38f0b1

SHA512
9dd8d1f5c52c5d795ee914745f8375bdac945b446c9a895ea2ddec88bf7cd1b546ea1cd383402a0e5e851b4cd4d9be4119009ede7432a8a0a831d9db194cab15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar43C9.tmp

Filesize
1KB

MD5
2ac4c394986f7428d56e3324523ea5ce

SHA1
e4cb19dc7835661416c193ef0834e81bc193be5e

SHA256
de9a5595d15fcf185cd8946513e64500b75ae0e35efd653a65925dd36fcfdb37

SHA512
3794ed0aea21d60b07a3367d177b8ef3d03a0cbf4a3f283a9ca25a0d48c8363755de316f47bc2fc97e8bbbc389e2a1a747c2340937d3f1df566fd9213a64170e

Download Submit

Analysis

Sharing