30e1da34c6d239589a76d2085a71ea5c6bfe045d3db090eb689ecbe480a3d535

General

Target

1b974978560a8ae5baa03a7e3ec9f21c.html
Size

21KB
MD5

1b974978560a8ae5baa03a7e3ec9f21c
SHA1

bdddcbaecdb87af866ec9f235dfe5fedf4c5a7c6
SHA256

30e1da34c6d239589a76d2085a71ea5c6bfe045d3db090eb689ecbe480a3d535
SHA512

bda832a796317453205637ac5703c6f5d185ebd4ec4628aa4f567fafe76297a92dbfef74eb614e0d6859e63a4df3e52804302480bb18e15534f4fed50ec5d466
SSDEEP

384:Mnim5NoILuvAUxBnp1H3FfuF+EwQURRRRRRRNbFnjnAHyMU7ched2D:mimJqvAOpaFsKnD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3075901-A856-11EE-B279-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
660	iexplore.exe
660	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 1820	660	iexplore.exe	18
PID 660 wrote to memory of 1820	660	iexplore.exe	18
PID 660 wrote to memory of 1820	660	iexplore.exe	18
PID 660 wrote to memory of 1820	660	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b974978560a8ae5baa03a7e3ec9f21c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:660 CREDAT:275457 /prefetch:2
  2⤵
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88724d37dfdfa1fd01f60bfd9de76d2c

SHA1
01a9bfadb53e6a605b5a8683ae4bad29633a57b1

SHA256
5f3aff17450a9e303c22fef0424b4163756b524c22998a642fc7ed6e87fd9bfd

SHA512
a9e6413562fe3103eccedfa1aa02bc569fe4e7c0c9c610836ed9797507bac7c91568be73d39f6a22036963af1a808c3a79d7892029fb25fc0f41ca463526f618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b3a149f538b28c16ab063d8e30f0adb

SHA1
2ccbe3229cbb2d31962886ce14c322b23de51743

SHA256
9761a9b83fdb1364d09951fcacb1f378b958c790bc149dcab2e10e83e9cbbddd

SHA512
48ba3975f34b839e1e72404a9c2898d37ce1195f095623c6e2a7a4340e57324c5da5e4d8adbd5d07b9ca9de1e3d41d4b40629f013669c24a3c489bfd19276da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d8f21e0a39ce30e7c1f487d56a0195

SHA1
fa61fdd0bba9ad78255cbb0881c8a061af00ea2a

SHA256
4bf1ce989afa35122a09a77ebc8777bd1e2868e789d6ded34e1f4fa5de0e277a

SHA512
65865f6e683ff233e509c1a79172f03ca698b1250a19eecfe357420619b5e17b57ea1ea9bf99dd9cbd11cedf295a73e4703069b5bf3c8a282f74a86698b3e102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2555b7a3732065c3fd04592c79a795a

SHA1
fb9dfb35ae9eafad1c56a58a2eb39918f35000b8

SHA256
e8bc59f48867315d304f7849f1fa23845b2e2e941b25e995b33349c4158b39a2

SHA512
713e9d38d66bdced5b4898c98a7d1fd7636e6351459b150e5fb4fe6b06ddf8010812fd484d2ab372bfa9a2cfb8a42e4b8c3f879bbc9ff55f01c9d12e807ca93b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f5c2f152d6a0051c8c88141f0900886

SHA1
48f37fceb212c2f1b335e974bb7b6a4e0c0d75a8

SHA256
a7e6bf542f8c5b27e03111839e18e53c49d1776e4464515f8b41be0b2d88f20b

SHA512
f40dd6a9598b6fe12e8a56864a9a8692033483b8e0e70da1d4a90242fb0be035e0c78e840ff2d8b71591f0aa62e8b6793275fa73b8ca7d85cdcc728d63da7b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36eb1e442bb33b91a92936c7bb66d764

SHA1
9f116728ba1e52ba5cd64686d985560cfbaf689d

SHA256
619935dbaa779613c193906defbd391bc72c2af83e2948fdee741fe62fb418c1

SHA512
74df2eb302f044b4bbb86e1b5b491d7db174c69fb29097fcb51b1a3c6f5b26b5f4afeef850a6b01ae9aa39ee8d09703875b81c643ca90adb2d526f8a145956fc

Download Submit

Analysis

Sharing