f0ef0f9d45abb2bcd89f21f9296d3b767b673bc2078211c1477f295484e39b5a

General

Target

1e8d78d0f98fda9db6047a815f50fd57.html
Size

105KB
MD5

1e8d78d0f98fda9db6047a815f50fd57
SHA1

0c5dfd555b678e30deabfa62dbc77c85e61ea30e
SHA256

f0ef0f9d45abb2bcd89f21f9296d3b767b673bc2078211c1477f295484e39b5a
SHA512

909fbed277f1fb9d89a6e6be659943f0a623d63581a2efa3af5aee6b6c2c01ef6b8427e32d0cc8ba7e834cb88f31ee41d3b4fa2ac270cd3a65d9e5642a433ea2
SSDEEP

1536:nu9dy02qAoRVQ4EqfVhmQg4ZrfWq725e3lh5UaR9zffmbrgqpGpTc:nfRwVQ4Eqfz1fWq725e3agqpGpTc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F5BFD11-A886-11EE-B6E5-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2356	2212	iexplore.exe	16
PID 2212 wrote to memory of 2356	2212	iexplore.exe	16
PID 2212 wrote to memory of 2356	2212	iexplore.exe	16
PID 2212 wrote to memory of 2356	2212	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e8d78d0f98fda9db6047a815f50fd57.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
f6f8b4b0f1271ad09be8ecd9728bfef6

SHA1
b1bab987ecdb10e752ec0ef815181277d9b7020e

SHA256
32e7864ad091668ffd0db8cc47535c98dff77f6bbd24c1f8d2ba676b7e2461e4

SHA512
d515e41e18081055caf1af288858a6a340526f3078136a1407cdd995e350295edbd61e561ebc4685bba735bec07b92727d583c46b7afea59784fb8965c66530c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8f57807776972f3fef7ac68ab7a6ee2

SHA1
aa85b8e00ed918b8bc4f6f276fa1befb91842a72

SHA256
c1d534d0a492ee7d413302f791920514e24dc8dff8244b78edd5e0215f8855f3

SHA512
2b9217b7990118f7e5ba92a17a39ac416766a059a71fdfb6d03af10bfca4468cfb508579a9c5c81fedec1038baf8c3146773b5ce06eb584ac31e602e9a1c3abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43a536fda8365e776a9c2a5b2556d4b0

SHA1
c2276bb2b1cd3efe26d20dca17474a583ce5a9f8

SHA256
a6749178fb7a788011128c7adbedad9c221cbce7058d68120895ac3bf90f6fe2

SHA512
216800e3a5e9018183cf36e12c7545621154653d8cc155f065416b83b89dcbc4be248a5f8f4af65c5817110e3b90ddd0b7e85db919a5c23e4388a1649437a2fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c68e1903e81eb5febbe6836e0eda4877

SHA1
19b13fb636e1f510d1b8b7676750a3e422f858a1

SHA256
a40c1ee54466a7dc2006288577bdba1bade8155f12c5d544a3a2030a1fa6e8fc

SHA512
67c2bde0bc741e30f7d22e066eda43c03deb48dc3403dbe24bf0af54086b51f27b51daad4b8305d70dba12a48d53613a8c25c7c402e4ce0a037378805c9822d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a75f9d2ae7e18bb4546bd526af43033

SHA1
6ae2b361aa1b1753a138c0639653e376b4df97c4

SHA256
42e0849d90f64f177bf69246cfb40f2f6f8f57b5579fb09890e50d07918e776b

SHA512
aefdadbb69dbf39017ed5feecaf969d211646b76453ac149bf906923fa2d7ad54c9699165b09244a50cdd50bcd05f76269e9c918fdab1fc071b7b6d6bb0f1b14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4202.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar432D.tmp

Filesize
155KB

MD5
761e99360d754ae14ab9fdc2ef4e6b05

SHA1
7406a1844c942b15f57dfdd8091334e86a59c3b6

SHA256
c546121c42a28ecf9905805a2a94a669a4b22cb02e88764076ba205ebe657cf5

SHA512
fa8a673c9435b4361a97eec94855b065240fed151e862fbd7d130c652d30a81f96af7a7b0eb1f350c88cee2fc2ca74d87c68103550fdc2c3c7764fdb6f7a48fc

Download Submit

Analysis

Sharing