70af91a119867dc7da912f23a69bdf30125ce563773378d21e8d94919ca6a0d4

General

Target

140589a16ac077c3dc2c42ed8b2bc186.html
Size

28KB
MD5

140589a16ac077c3dc2c42ed8b2bc186
SHA1

1a0732f0b9ab2f31c44eb85ee5e16f14ada79f5d
SHA256

70af91a119867dc7da912f23a69bdf30125ce563773378d21e8d94919ca6a0d4
SHA512

82e94465f86518d0cffa829214c3df0876a576dab6337ab288632be9abdf777fad30ca21cbbee52f14ba265c07cc23b4bf9f0cafca60e372dad96ee17d52e05a
SSDEEP

384:MTX6+ioo9cOqjJIWrWuWhWnWUWZbM1+vugqPZsgaZ4Jk:MTwr9cOqjJI0NGmfz1+v8POgagk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4D729C1-A7BF-11EE-B2BF-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
848	IEXPLORE.EXE
848	IEXPLORE.EXE
848	IEXPLORE.EXE
848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 848	3040	iexplore.exe	16
PID 3040 wrote to memory of 848	3040	iexplore.exe	16
PID 3040 wrote to memory of 848	3040	iexplore.exe	16
PID 3040 wrote to memory of 848	3040	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\140589a16ac077c3dc2c42ed8b2bc186.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6143cf70a6b068b7c990bfa2edbb7e4

SHA1
90f49e380bad1d334287cb97a6d17c330318094b

SHA256
b309a4477b13bb95f523860d3e44a561553143b783cffb18f0efb85cc06b9971

SHA512
24b6ced1dc71257108a7cef72bae272d8d4d6f843ff61c5f72baff161f5329b56591a771aa70b9ac8d3200f1cb7f7a1e4047b37179acff4737ea12da88282cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
243b8639c20f299641ef1161232b5c77

SHA1
2c11995c4e23a50fd4a3f85b54882d0cde6df0dd

SHA256
fc56de4585ff1f135fea517126a600376e18e5d46263a8ebc5037aa3302895a7

SHA512
ac9c3433fd467a3a49d857e2abf7141c80f0eacdedcab7bf716195b4400daa852a321c34d6473b2577ffd1ce27f0d8e5258e1b9549093c9887b86f0ccec0880f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29cc07e34a1262814b4ea97e88ccf0c9

SHA1
8bd9149ddbcd42cccb1850eb8ee851c75284ce88

SHA256
bbb59fd5c59e586d5a4ae17e4701b12ececff3bc0b85f4379e66505d597dadf8

SHA512
8f01323062a40d470d2783ae2f95b2f9c10998701f15229497934313893e3571f007583191feaea8c91372d12951708c6beff29dcccf2121b6bb2b6455935472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e799e02c4f68952fd99e18b9a86e219c

SHA1
1fd3512b7bc76f9603e822b4fb2731326a0c1c72

SHA256
6e90b0f142d656b6f7ff95bdf8f1399ee33ef0b428fe3395c71a6d982fceb82e

SHA512
f38fcf919d6627ca03f3e6a030d5468e9df94e2b229ba8ca0e3d392f39784b11bb8044999e65759c239a81d9988a2cf1dea6417e316de38177c227ef6c3916c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE3C.tmp

Filesize
102KB

MD5
270c1eb94cc0878c110740efeff2605a

SHA1
ceff319d7527a92a0440c9ead3065554901fca86

SHA256
4d1009096c91a86f14c31f8b17b9104a8e3c81189e43de56b298f593ac67b920

SHA512
a048f92cd1c5033917f8d7592c456592c3a95a19e2235b2ce745f69b6c96cd9cb20368aa62577c4eaa9d549cb38e87501025d1e54679735e9c1b86b38dac6416

Download Submit

Analysis

Sharing