bbf7ea8665d45cf4b3e863e0013cb5a0fe1e4e9485c86b5caeb9d4e893c9a8e3

General

Target

1204ba1c45ebcb485c2b2c839e4b9b3c.html
Size

3KB
MD5

1204ba1c45ebcb485c2b2c839e4b9b3c
SHA1

14791384a612d2b1099b77d1d187ac6c3a6f21b2
SHA256

bbf7ea8665d45cf4b3e863e0013cb5a0fe1e4e9485c86b5caeb9d4e893c9a8e3
SHA512

aada952cee3ee53719d95c9b6f9c1908ecaa8a8b248dad2f03fff1dc2c8df52534206cf55e772cd0bbf439a3b3d999d5b103e75a45bbf01949f536f758c9d08e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD45DB01-A79D-11EE-BF7B-F2B23B8A8DD7} = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2172	1244	iexplore.exe	16
PID 1244 wrote to memory of 2172	1244	iexplore.exe	16
PID 1244 wrote to memory of 2172	1244	iexplore.exe	16
PID 1244 wrote to memory of 2172	1244	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1204ba1c45ebcb485c2b2c839e4b9b3c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
837ec0c02489b6515a432867f15e72f0

SHA1
3b3782e56feb61cb94f0794b847eebffb267632d

SHA256
a992d1b77332d62e4947363e287acb4364348c5f747b4ec5247eb218a888e4a2

SHA512
2ac9d2c6961bb61891ba939b79796e91fec065b2ac03e591d6b6aff63685cdbdc2c2524a74a0842742ae1f6e7766dd5142fc797527666004e59bb76c67d8b397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa159ad5b36646db40f74cfde8dc84af

SHA1
7b75ca368d85c08bfcb9ed36ff0f11d2fb70c18a

SHA256
3b3a4e00f541095de8b475f2416c367ebb8a3b3b8e34f1c4bd772f8cbdf96bec

SHA512
3d556f7e248ffc984cd16f23b2e605dfebbb7ffaf957713648c2701876490fca0ca2e85199de54cb4f20b3a93c92cb83ae891e66bb1c3f827ab826186a59bc4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab591A.tmp

Filesize
8KB

MD5
ab2536bfe71a803647a1b99ebc7aba28

SHA1
055deacd20d88c521932efda2de5223ddc558105

SHA256
d5626811f05d3bff010310fbb16a3ed50f58ec2c85da8e5c59db84e9f7bc9b29

SHA512
1f46dcb886c449b1f8170d0cb7131e52a77210302fdeba6e171bdf26e7cfdadbc0ba489d997d159a4f91192864ee7011bbe9681606bd638e269b217e00fa1d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59D9.tmp

Filesize
4KB

MD5
28bd1fabc38b2587ef4041b11fd3ac6a

SHA1
803700f6b2b89a5c06356569908ca1af23067638

SHA256
702574ea4240fda88dcb09864ac9f82e6f44ef06ada0c2274af239ceccb2688d

SHA512
c2a83813727ab6dac249f0ce0ed86daef3644e4ab0daabbe0d90186c37d8420b59e3888ed2a9841a8f8c1a7c2238d53bb89f3f40c8d607d817590807f3ac71f3

Download Submit

Analysis

Sharing