e4bf11de8746d8e494b14336b2749042857307bf6354573ef96dd697f91d87be

General

Target

449cdc64fd6ee4b2e2752cea948fa7e7.html
Size

57KB
MD5

449cdc64fd6ee4b2e2752cea948fa7e7
SHA1

4443b4208af1426b17a1d8794d1a90cfc3a0b177
SHA256

e4bf11de8746d8e494b14336b2749042857307bf6354573ef96dd697f91d87be
SHA512

a5e1105270db40997e747222e87f70cd01e0f8d803557000ba4074710688c29a811c944e5cc4d92bf17d580b3f284ff79b0c4b228fc656fd51d56d8ee768cbb1
SSDEEP

1536:gQZBCCOd20IxC1PlTfffkDfqfSfRfVfXf3flfyf+ftfDfHf9fAfRfpfYf0fwfxfC:gk2Q0IxUHgCapdPPtamlr/VY5hQsYppQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{59A0E3FE-AC1B-11EE-8184-F68B0B0A1028} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
544	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
544	iexplore.exe
544	iexplore.exe
4864	IEXPLORE.EXE
4864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 4864	544	iexplore.exe	16
PID 544 wrote to memory of 4864	544	iexplore.exe	16
PID 544 wrote to memory of 4864	544	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\449cdc64fd6ee4b2e2752cea948fa7e7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:544 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\25xleom\imagestore.dat

Filesize
1KB

MD5
232e84aa84ac170293855aa49f7f2935

SHA1
27d5578564b8536b733c0661429c131026fd4c64

SHA256
5374ff0b338c08096b935ce9b3ff2d368eb6e6d5e5fe2cf550d54ac49c1d8ce8

SHA512
4f8780682679bd58cea74d2d0cb59c8febf779e6e726641cf23be314a4574e91b50539d75385a7d9d0fed2fb35a0902207285ea98761e07bc78398a260a7f82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\layout[1].css

Filesize
42KB

MD5
e57c81f3a17073a78a7c3c865f74f89a

SHA1
587d7c955432f1e5a87460ecbf9086ae2589346f

SHA256
e36f1f796e538f826beb42510edc0354133c61c7f711b827def7f91d3f7c8bda

SHA512
630aa9dba2aee1125103954b093af8b24907d98761e1a9b93fb6f6c43abfec3afdf53825e3f12fc3cf87fa14855daadfdbc90b1e49b503fb2917599dd77daf52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\recaptcha__en[1].js

Filesize
382KB

MD5
d5318336d6768abf5e84864564193920

SHA1
71865b961d3c41cfa095a40eca2c4ad33eed493e

SHA256
e81d39e652e1e19752a9ccce5bfb043c701a72b0eaf04ead66685270dd2a33d2

SHA512
c142f366f25120538b654b7c7d328c73819404a35b7c5cb710b5b31d11da9e8823cdf265c25da5901d1b88272dee7481f8837d383f9b3cd6529d9eced55d4b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ALL181V\favicon[1].ico

Filesize
2KB

MD5
cb546f0ce2ca2505cbc9088d8a4592e5

SHA1
d87b70b1a34f4313d085de80da3aa4e8845af904

SHA256
0c3851f8f6d7b9dc63645a68b0db991edc9162620b9d757684a4a20206c458fb

SHA512
b6fcd078f43082daf299a49646280ac3a30b91d10dcfaf8e9fb9e8317af417e34d45ae7397af9507d4101b7bcc58169c2f64adcaa253fc08204b98020b20b551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PZ64U2GI\js-loader[1].js

Filesize
650B

MD5
ea5a5798612df63ab0532174aaf62634

SHA1
0f4713eef39ab07510d3703ef201885475ef0b42

SHA256
ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31

SHA512
8cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907

Download Submit

Analysis

Sharing