ebc2a71bdf473f06f613f5760da84a6cb35396fd03f3031a140a24e7270a63d8

General

Target

1fa4818fa81c5e598da326561c9f4035.html
Size

432B
MD5

1fa4818fa81c5e598da326561c9f4035
SHA1

32a2af54c0d47a75e7ae0035503ead1c7ce62622
SHA256

ebc2a71bdf473f06f613f5760da84a6cb35396fd03f3031a140a24e7270a63d8
SHA512

ec7cb13d97f6b4404026d803ca0aaaea6df3c066cad15acb965f35e58a6b713a191b81807f539af19e880c32da6a6a1ad66908280eb06b0c842b6641c14d4fb5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FAF064B1-A898-11EE-A0B6-D6F9353EB06D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4404	2056	iexplore.exe	16
PID 2056 wrote to memory of 4404	2056	iexplore.exe	16
PID 2056 wrote to memory of 4404	2056	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fa4818fa81c5e598da326561c9f4035.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:17410 /prefetch:2
  2⤵
  PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
8acc3b78ba7de8434f018133a9d290a5

SHA1
87f444a01f8a532c62727f2853ab5121712bb780

SHA256
ff15f32a4d1de2092d82b34300fdf1c04606a69ce01a4e8d9dd1b7b2fbcca61b

SHA512
598d1d3c813599a562c4950d0781b05f2190c28bcad154555032a583334da5e0b4392e5e220959ac68a7b697e0d358714ce956ff8aa1e7f693692b271a15aac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
8b5967aafbb7a40630920acddd1833da

SHA1
640b417a297c4a526c0d9fe779797d0476ef26e0

SHA256
3c9ff011e3c06c9f0048d1c5f636b4d58461a8472a71a24c62a2dc42dfff9e8b

SHA512
33b943a00f2df4b990d2a13ec6eb0773a92aad891331b8e67155c9bb73e4209066eb63516cc17089dae11a9876b6ec1757fb2e6ab906ba264a578129fa294bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verCB3F.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\flj0k7l\imagestore.dat

Filesize
1KB

MD5
71fe0a04d064800260d0a5f075490140

SHA1
558d74e34e77941df5f8bc8cd8b8a37452fbb1fb

SHA256
c3777f68a26a651ab3aed2a14b97fb7059abcd23d131786950ed6ba6d0d943e5

SHA512
feada32e4e69c92be096c36bd44865078a5030ae3d14a05e58eaf2269a492c57597c3ac237bc303208879884f467cb20be0ee7101dcd00edf7d31b0ee3f19109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\flj0k7l\imagestore.dat

Filesize
5KB

MD5
0d352e8471234637503f67463a17c832

SHA1
7001fbbd4019d84f6eb0e5028188db4868813276

SHA256
bf41aa09b7a2e1f5100fcc67630c461226f773ba4749499d876ab50ac1206245

SHA512
7da13630ef822acf07a9b93f2597621966462115758e11aaee610d7b763a709cb8f82d2eebadc97b18306b5d324d1c5b71f838391763cc4327855a96de11faad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\favicon[1].png

Filesize
3KB

MD5
a75c230f34b9296e6fdd8b0b855df5d8

SHA1
e0b9e32053d44532fb4e8bb55b54c3211965517b

SHA256
8adba20b1dd9747ec8ac6ed5a26a8dfbfc7ab82213d8051b76ac771c76b87920

SHA512
950b94afc397ac760f38f4c68691bda6b541832e1d23f496e36568def2b9f9dcb6984c6a42ff6b5abef0e19b76c37e40baab22e9dcc9360091b609333029b24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R977VUU4\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit

Analysis

Sharing