b368ebfefcb302d0ec1c0f4a9e98554b0501de98d5df3b71a1dd27bee59dff7e

General

Target

102cfa5a140354a641dd46b501bca2ff.html
Size

3.5MB
MD5

102cfa5a140354a641dd46b501bca2ff
SHA1

a3441b4e71357fccdce5aed9fc6cc28c36f1f486
SHA256

b368ebfefcb302d0ec1c0f4a9e98554b0501de98d5df3b71a1dd27bee59dff7e
SHA512

85e673fcf7173dbb5cf634a4b11d16fd3bb32ee0bf2e161c6015fc73a8ba9e7d22328fc840b38b4d2b590081a216f1087e44b5fc5104aa588a31229e1b5030f6
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NNq:jvpjte4tT6Dq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82560EB1-A77B-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1500	iexplore.exe
1500	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2052	1500	iexplore.exe	16
PID 1500 wrote to memory of 2052	1500	iexplore.exe	16
PID 1500 wrote to memory of 2052	1500	iexplore.exe	16
PID 1500 wrote to memory of 2052	1500	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\102cfa5a140354a641dd46b501bca2ff.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:2
  2⤵
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82bfaa3d622ed0ceddd14b9854198dfd

SHA1
8bd7d73bb79d3b75554750fea91495afd9f715de

SHA256
4cf0dfe8347f3b3e80c028c57f9fe2db20b1b20ea6d2077ebe26bc837e362470

SHA512
c62d4b65c7701f77209abf08c5f344e2c4e24a3f0d6909b7814caaf997af87a69171fac29635812548ee6698885e101aee689b6fbe861629fa10205433149dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8180ec3dd21e494103f4a5c0a5cd626a

SHA1
cfbcf52af2662b283f28d835bf6aff57e515ffbd

SHA256
4fb9b8eca56fcc75e75f4ed0fe5ba8fb4fcc15f64211d9d8b97a7e2b69685eb1

SHA512
3df0b6edff54c0e2967b6ce69249f8953fed6045f00040eea5989f54aeaf0c903c674d3b38755c8af0c6af7a94046220578b11e48141bf8b3e49eb940e883b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad47c6a8b523a3b7852fea110b248212

SHA1
6fa82920f7edd0087435d90da7e6ee184738e352

SHA256
9401c0cb2428fbc02f253d7a8441df799f0a0adb0e8174f625c522c0a85e106c

SHA512
b2f1a7476b5fd79113e6d7e622f2b6de43b62b19f66fcdb05547df10fd24474951c07d75857f6a6172a234375b13b2c62b41a6115986dc05631cd30241f3a6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf8a318fead58d2799ed08f972a20a6

SHA1
42a7262d1574209ad67103c6b928cb9bac471d02

SHA256
20ffc9d986f4de5936d9d508cc07cb5c452c1b4e36e8d96922c09c252fe096f6

SHA512
e320ae06b42473fb766400e5eef3847904be2de14e8dd1dd2ce350009a58bf05e7fd42a79be6f9084696e12e73daf8caa665e910128452440ddbc6372a1c037c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab43E3.tmp

Filesize
4KB

MD5
91d0fde4346a866a8df69b54200eb9e8

SHA1
cc42e5d1caba0acf48f7c17308e922191556dd9c

SHA256
1b1164a784718c6c1db9e19b737d65895081ae5fed7851e76f14cdbac8463880

SHA512
40dcc2a387f4531987a97a3eaf755643cc32cf0046d4792f0fb92c70749a0859320c6914f7db54edb500d6ed2bf0953a5b5efdff08e97d263ad627dbfb99801c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar453F.tmp

Filesize
15KB

MD5
72f31fc60073c87dc512caa6c7156486

SHA1
3f1d18d228efb8e4fcf2cb60efc3add00d930432

SHA256
e9be0369e1bc9a58c3961441bc74370206bc7ffb09024d866240cc6ccf45ccb9

SHA512
b78d0e09495df6940ffc697c5d12acb3ffeda21aea5897e5735cde7bbcbdd0ad7cb1d2ba34cabf51bce770e2fa5dbb4c817e897b4cc03f8a6d7c3a1cc8fbd398

Download Submit

Analysis

Sharing