c52ba73eb0c66d868da54e19f88fb2836ce5102edd348bc496c2e5deaee7edc7

General

Target

1092f2b53cfc8566748b95fea4a21dc7.html
Size

6KB
MD5

1092f2b53cfc8566748b95fea4a21dc7
SHA1

d93719460fb9e2706604c46457ea8cc6b0746688
SHA256

c52ba73eb0c66d868da54e19f88fb2836ce5102edd348bc496c2e5deaee7edc7
SHA512

ae3c57ea23dc469f19039e8aaccbdde38462fb856acf31033ab36ca879b355346f0453a3da5f4cc719e5d450f8fb6b72bb3d05ba7e4ac15c982d1acb2b5fddaa
SSDEEP

192:SHYFfAGsfBlPOZ3pincwgiGq/3N/T125443J1:SkfsPyHpi7325x3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AB92D51-A856-11EE-B07A-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2284	1936	iexplore.exe	15
PID 1936 wrote to memory of 2284	1936	iexplore.exe	15
PID 1936 wrote to memory of 2284	1936	iexplore.exe	15
PID 1936 wrote to memory of 2284	1936	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1092f2b53cfc8566748b95fea4a21dc7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f052ebb39fb4e93ba9c6427d86ad282

SHA1
5ab0ec55de8dd5205ea3f2c1e9229d97b40c3393

SHA256
09081eda5a3b4ddf2688a2b64949a2cdb2a32a084f5656752a1ef389ffb67d91

SHA512
92a0bb0654a67a22b534884fd902ddc7dca3333ee67c1db6a0126b4848789f3639f7765e1d448ae737189451e9d8d71c584500c458eb0866d37202140cdb5d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9edc09366e7be00e4d0c2b1b92c8ca30

SHA1
29c9dc4d414a51d9465a78f6e3b9f1482d86fb08

SHA256
d1063dd57224ff08f96721d93155ed33eed33cc64b40cd8684e11adee9dff20e

SHA512
bc5d3282440ed660ed69228d1c6be156f747120be64a4490aadbbfcf325aeb207e04d0214b511bece503c45736b1a5efa96af8c23cb4fbec352e06b5b36a30c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17755d8887c49d642d0393379be45ef3

SHA1
0082458745af7f3b322ff4eeda95ad85925029a5

SHA256
511b673d97f7e1ea676916a59cdee61d47673e72969af5d34a4c96620fb32177

SHA512
629f8f7ef0c5d1d1e7cf95a754ae1d65320eed10a16cbb7ac1965292bcc47d9b0aeb58882812a8b87aecdee39bef21545d339f1724559653dd1f99bdc0c73e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d2bb26b5a2851e8e3c7a07263b1d57b

SHA1
cdbc86526ab565833a420361288a130481372cd9

SHA256
75478187a3f452e260431494f528d8e3b05a3a13c3e6be7e59ab5cc3fe4a75c0

SHA512
895c79019d077cdff971b8dc3b3af4cf610acb99163d834cf3b01528fca72b4e2be1a4c5f6b5fd7beb097e96f5ae9018fb6e42a319a1369d20a0c99be2e8d984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e26d68077e7c94daad80a4d60f39ae9

SHA1
6a09f63c6e6dc6e34c2315a983688ebe9616fd3a

SHA256
8a45611212a3e49b5da08c52dcb12773094d594b4d7cadca1b1621ddc38c635c

SHA512
d815e025f1a4d235d66ba0e77502de700b3b0af13fc9925f2c2cfe1b74ab56babc3858a863fffc2ab973def8bcdc1c89c74f889944eb8f35b37ed705a92c8f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d58fc31c479ec120b4d83cae7b2b741

SHA1
20457edb54712caeec1ee29e6247819566f98422

SHA256
21d787b8a595b6295a83ce16022d10a181eccd93fbedc8631c530017d7516a4d

SHA512
c1500e6c2cde8c9b1ebdfaee330baa66c63e45b1e525cf038eed559b2250bc2424b3c32de888073f3d859d4e055be73091a97684f50d89f1ec40a2d91b9c711c

Download Submit

Analysis

Sharing