cf832f9d5346f448cc094fa3089ada2a22ced2c6942b05779d9acdda0b348ed3

General

Target

0ba208ff2ac20e3c619a0790dc905337.html
Size

10KB
MD5

0ba208ff2ac20e3c619a0790dc905337
SHA1

755957a5e6a7570cc20bbf07cc08a50dc9dbeb9d
SHA256

cf832f9d5346f448cc094fa3089ada2a22ced2c6942b05779d9acdda0b348ed3
SHA512

81609482c4c2ef39bf87be66423d0b7e07da5f18f1993268772021f182019f6a649651c72933838458caa6f909492136e3bc3c596396ff5978d924b53e8f94c2
SSDEEP

192:SyS6Vw1x5Ou4qk0N5k4QXVROalaZC4siQx2QMRQrDQGVQi8QgHh0QHPQzEiuQC8h:SyS6Vw1x5Ou4qk0PPmwNC4B62dRgDFVn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7C63721-A730-11EE-994C-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1188	iexplore.exe
1188	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2688	1188	iexplore.exe	18
PID 1188 wrote to memory of 2688	1188	iexplore.exe	18
PID 1188 wrote to memory of 2688	1188	iexplore.exe	18
PID 1188 wrote to memory of 2688	1188	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ba208ff2ac20e3c619a0790dc905337.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1188 CREDAT:275457 /prefetch:2
  2⤵
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e1e948f6717e7340fb83dfd09b8acd

SHA1
2fbef18c1ffe69d74d3dd6dd5aad5ef21e09f987

SHA256
8601b4f4c95e143ebffc26813ffbd685bfde0d54eb8c9153211a6065efb237be

SHA512
176dd7c5996e27c94164c24a8be104aa9d02167be13a2818804011c950fca755a9aabcc00c9d6dd67b087f87d9269969f54c41774354df08f1bcf6d675e6c05a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27d150c430af413ad1451bda80627ed0

SHA1
17f7397f400c60795762cbcf3674e3246571d415

SHA256
40f7981876cae50a041421e20c642a4ac123f1aae18d8a8855443378e305f538

SHA512
2e5828e9f988637b15dfabc9a31c64317df001f4a19c03fd9d1fb864e7c5f4520541434e58bb694076fe67d4d7cc3ebc7aaed742134930b3825953758d2469fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e48455883d71ee08ebfe52f2ccbc84d7

SHA1
8f2d610260562319239a67126eb517b7867f290b

SHA256
e26406283c8039efb3648ed38f7948a223fd748cb4be56bf39da783f181d2cab

SHA512
25602391c42bdc7fd44316a3b93bb1c5d531250b137e472b206e7fe998cf0c722c04cb9f7d2ef86777449262f8f3a76b4672b5d1d9a32a83f809b5e035f1eec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b248e8dfcf3026ad38a11f0de5545620

SHA1
afd00dac8beca69b774b0109f3f71828ba9bab54

SHA256
b0f5efe916aeae96a0ddb7fb04a76a377047a675a9a1977a1364ef16084f4d82

SHA512
9726032080008834b2613e9ed3301a51bca436d2f919ab716e910673906ac2b357b8c7a63d3b39766a71ced43734a3021d47ee729aa7f13716aac248914dc324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f214d2adb0ada7153e8b9ecc9f7648

SHA1
fb79fdc9683c9a3690a23c8e53849e08484e91bb

SHA256
9f8115eae7d988144f10707b89f31765d79496ba65a4e59db6877761690befd3

SHA512
8013ce1b49e2d2575827f925c371c6dc3767a53964d034f34b2d66e4e0b93b7e63b04821ffdbe60fe5d31c414ac00bee770d9e8d2764fcd317585409d1bc613d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9FE9.tmp

Filesize
13KB

MD5
538697b5bb3cd2cb3e9cf9b1b760b1c4

SHA1
13b6aeee93c3fe5dd797d2d811e5d77b5dd4330d

SHA256
4d17363663e21b4f6e73308dd7d2a893c44e29c868153f06d457816809b39390

SHA512
cc023a949a9db5700e7854141d2e2b357bd62da9ac253f18e4975a312b7f34471040f4ddc2ee7922b6f3b43d1442de6c965f9aae468c8c6aa9b34254131d9155

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC94E.tmp

Filesize
15KB

MD5
bce50c705cfe6543b9be170789a4298c

SHA1
1acf4cac58d0a76dd3cfcfe36a24200e57c10c22

SHA256
808ef5f007035540b3ec2d5f9644bf1c17e7e91f50562165fdeab26e84ee2b28

SHA512
24c6688425f2668ac430637f972323a071f403f859fc9842e75a58ef14d9c56cce8125ee608a323d832be822a5d1453c94f445559da5fdd7911420eb6f799ebd

Download Submit

Analysis

Sharing