bba8b56e5bb6780080a81f2fc830ba2c038ec6c6f3d566317a061e95b2f920ef

General

Target

15e18d6ee075793c6d2876596f312778.html
Size

3.5MB
MD5

15e18d6ee075793c6d2876596f312778
SHA1

5a2b356c09a17fec62e13690e8a331a377563861
SHA256

bba8b56e5bb6780080a81f2fc830ba2c038ec6c6f3d566317a061e95b2f920ef
SHA512

309c9bc6c5cb72b85e96b71db55afec6b436f9fe4ba3746a8fa97d8c23a6f075d2663d01dd4b68279ce734afa566dd075d3936d978883e3684ee895ba3948875
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nym:jvpjte4tT6sm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E03A881-A7DC-11EE-A2F4-62ABD1C114F0} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2972	2224	iexplore.exe	15
PID 2224 wrote to memory of 2972	2224	iexplore.exe	15
PID 2224 wrote to memory of 2972	2224	iexplore.exe	15
PID 2224 wrote to memory of 2972	2224	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15e18d6ee075793c6d2876596f312778.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed0a655e4686da868b86b15933f936ad

SHA1
5016377a9446bd20588572a0c2f75857b0929c27

SHA256
2a974c4aab9729709e9976182d78489d826b381467e06d12d4ba7be525a781e3

SHA512
a9c964850e5540e448e53b3e7284d0cb16723292b819bcce7d19639487d9105a7c034cf77f487e7830abb9e291e09f320782c293cf7257cd4b3408c87e34488a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d570ad786980bf1a7b5c0babc6c20f1

SHA1
507eea80d898d8d9d7c8b2bd8d2afdc59fa8d314

SHA256
7d4de3a21515b175ea10ed5d3df31b1a30ab38fef8808a0ef5f890b735a349fd

SHA512
76ccb483564f2b1d7c7ad7c2bfebd7cf584fb5e3555c1d450e58bb827b77c2f9b4c3adcb944c4c4ad23b901e2891eea11a2299ac318b5879c5273c6df8c68cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f48c189868f5176bcb7cf76eaf28a961

SHA1
5e351bddb210d359e0c76f68183607e9677a7681

SHA256
1516efce3daeb045911a89985fe393bab5b8e83a19f3ad93c9fe3f22441e7a9e

SHA512
462585d81e7fd05ae5825288547c61b2183586e0f9fe152af6186e07f32ff994e518036969e9d99bdbd433ab908c7d16fed77439df6df88687d8f9528d1fe211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23bb1ac482598eebc69e9084a78da780

SHA1
8cbecd5d8ee0bc19a2d3b5abd1e8baba79778734

SHA256
832de3c07f5d8c472f9ad6270151d729794276d60c9d78ab1c6bd8c36556ffe7

SHA512
453de5ab361dc222a90b6b542d1991fb0c89dc5d5b6bc8e4f0f5d8825250590e22c5e1558dfcf892489b7c274680ca0cea9e2b1ec55a9b839aca57f19211bff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fb3f94bd2a7e507d8b864681b93fb36

SHA1
dd690fe8fa56f3de9c7a0dc42553fd4cc142077f

SHA256
db3a46b977156f54ce5d6a3b8e70e83e6c57e438b4452d9558bfbdf61350fdc2

SHA512
b4189d93aec91f11f97113ab762b96f3de02879ba374da272b486d6f09a6b348a9b68f2da2d5240591f697621a9083024088c6cab6d7bd1bd7c2eb32af6db51e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f0427f60238e4243f23758069a061c3

SHA1
c177a1096eddcd6ecec2478a75f8f51d651470c9

SHA256
04000ef3eee17547a2d65b94056bf98876750bead4918217266fff3b32b21b84

SHA512
d8f65655f0fb93f41b8958fb726fa57327fc2a94f7bc67b6fe12d88def36a834e48f58d3d5d13041621385b32593f0fa4c6283e11eb1f291215abf2c37b67c11

Download Submit

Analysis

Sharing