e43ef59fcb631d4d43b0cad21327b1e82d8c8e443d3c268aca5cf03d600eb6e0

General

Target

150ca409e1a18ac11bab66ba8a4309c7.html
Size

20KB
MD5

150ca409e1a18ac11bab66ba8a4309c7
SHA1

276279af9c8019c2ed94a5cadb51d5e3eb0a9ee7
SHA256

e43ef59fcb631d4d43b0cad21327b1e82d8c8e443d3c268aca5cf03d600eb6e0
SHA512

ce45505ac5c29f257a985a1d8e9c4c45fb852e6e8538a69913486e38c46294f414794616d17ad4fb771fc595a639557a9e4579780236c2ee89052fa483c9a5ba
SSDEEP

384:SQpKv6LjTQF9jpgbEhihRu8BxGJ8xGJ8xPhdXJ8xZJ8xxho:S2jTc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410183696"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0828DA61-A7CF-11EE-9776-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2920	2696	iexplore.exe	18
PID 2696 wrote to memory of 2920	2696	iexplore.exe	18
PID 2696 wrote to memory of 2920	2696	iexplore.exe	18
PID 2696 wrote to memory of 2920	2696	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\150ca409e1a18ac11bab66ba8a4309c7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a90a8cc9ad20f3748fd9bcc39a9f4202

SHA1
92c335cb77cb6c693333e649509dbef1a9d8b2f5

SHA256
80e2643e69bfa5a7bfba41886a69d2c53a1ef8bcdb4240ee65e5e9c6057ca337

SHA512
215a3793c0a493fa4f896b5d7852cc338461826d039e700a6f364caa1f8462856a03b280c18641b10dbe15f36f44a37974aed981cadfcfc1dcb1c317fce22115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7953d001e169adab16b4faac4edc3d1f

SHA1
7c8f1d1d75824183efc8335bac39bc2ecc46b33a

SHA256
518999cab1e503772308690c11377df9217c0b4b95b0224a81562e9684998863

SHA512
d8d1e2626f67ea46acec9538b683e37d95b0c2780ee71016e306b5a5058dafa078a28efc0d0134cf6bb4d655bafa42ef7368b376a9bb87fcad197b6afb6f5c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957498674cb9f3acaaa207c98925d340

SHA1
fcd0f6e1290b7f9100d023a8dfe3546bfc565967

SHA256
bbaf5345cfcc31a072fceb3b7794db8e87dd1c54e055da1602178dede5a1ec8d

SHA512
a135ba71baf2eecd2b449392f68393a62bbcc75982c45c932c016118cd09810a9588e49eb754ff5bf7fe9b8abb5b1b2d4aa09fb1d70015cf24ed6efe1a048c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eabbdff09640336339f256ded167278

SHA1
de05b4d4900df8c34d13c1953613395a67785e94

SHA256
beefd3c2b0a3e2fb5f3cc00171608c40508f07fcc21e4642a2dc626892080617

SHA512
79fac1031671d6a8461f7a42499dbe07cceee3dcbf6e214c6a5f0e5fb755772c2bf0d37d9c97aa86fb301c2ae58a7cc586f07c33798b66a43297eceefcfdacd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e08b0c156db5941c03640a981ca6b0d7

SHA1
07bd9176c95af4eeba2cba272d5be4bd30459bd9

SHA256
b54e5e5a6d316dd8629897127493ab4cf3372b706d32b0c4de06a7ebec5223aa

SHA512
c6c15b6d29630c2f1d226bd007cfdd3afeb349cd579e608f5fe24451bea38d675706c50196ad554d39dd20180b3a8ed914c1929cf28c46c70846ca6312f10a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a66a9c57b692ac037038dd8be6c92f1

SHA1
8c5eecc3051e31ed427ec124bc112140f1b77327

SHA256
7da756968d2b1c411570f01f23787d61ceeeeffb5c39cff4fb4769195c6aa034

SHA512
645fea278621a0fb7e9c2ac8b9aa53a58a096975dc71eb4dd851cbbfdf88607e7f890df53dced9ef431999c0c88b2f968f4f9f93722d114e57d7e08dff7165fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE3FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAD1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit

Analysis

Sharing