4c327e4de2dbf9f8723718ffa58fe71f479cd0eb89e529718401df73b4ca0127

General

Target

42a4ea47462354107011220b60ce513e.html
Size

432B
MD5

42a4ea47462354107011220b60ce513e
SHA1

5ad1d63558fad298eee4bd49417d66ba9654b159
SHA256

4c327e4de2dbf9f8723718ffa58fe71f479cd0eb89e529718401df73b4ca0127
SHA512

2944a54416695ad6de72303a3bd52cd7ca56c8b8a4031352ecf5473d1e912c47921ffab1c3b9e59cb94e1e7eead9e95de0206882fc0b312b3b6c2836f33cb416

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7520891-AB7A-11EE-AE8B-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2340	2228	iexplore.exe	16
PID 2228 wrote to memory of 2340	2228	iexplore.exe	16
PID 2228 wrote to memory of 2340	2228	iexplore.exe	16
PID 2228 wrote to memory of 2340	2228	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42a4ea47462354107011220b60ce513e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23fe3a9d8555fe531569fda7ce1fb6dd

SHA1
106a672f4f9988a7be015d18bf93a21b6bc5b162

SHA256
43c7b30e907e9036b1990bc1f577f69c02f211c42e476b664da73f66d9ebd5cb

SHA512
197146fb3f5ff592e20eef1e429631f8933f4868370e02d15c196f2a51b387ad1d84195010e0606d155cb61995c477f3777b52e02a8fcbd9ce158478dffd56a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
321e2e1aa1e8412757d8b81b039068c2

SHA1
0bac6bced3e2c230d94492b2015242131ed4f8da

SHA256
8a97f30e6d500a8111aefe39b737510d9a24471d73d1620694ad454ece782d0f

SHA512
cb1b044564a47e7a1551b310b7a5092176bc9950b5ce7c0d03f84ef79ee5c3a76b1c09634f890e8b03b274c1f1fe18f543e16a1b2e98015ff84491429dd45d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ac5138f47300c4a9d1606c212c2bc2

SHA1
f707b5af7d54b55ca6ab201ca8e831859519b525

SHA256
d049ea34ab45ab85916c1987064221f99425bf6004dc1787e756aa2e0532086a

SHA512
89f6d0a37ba61483f7c74c5226e87e34b06c5698b3546c420ff860c502082be2b030bfe09bdc4a17c117c6db09bd8e5145818205ab6e89373702158e32cd1c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80355249dc3e25ebe65a823dfe6663cc

SHA1
afac2b44665daf7c865c041b1ea5dc9b9430a287

SHA256
2cc1f473884b2ba248df63120ef536cd8d2ef896e7d18801aaa3b03b0225857c

SHA512
059fe8197bef5b84d8d5505b138c6ddd718f7c42c15f5187179c2b4b2560391c14710ef61159871bd70a40b51066860a05d0207221c8ad991648e554a75b96a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc7a9a27000c6f1b2f78a28c5f8e8267

SHA1
6a536a277f8e007b6de2302725c53063aff07ae6

SHA256
b744fb22e949e2949f676ae7c61ac9acc3eaf56266ba26d7a14da1ce79760d41

SHA512
894c0a7e8ffb06ed426c497a3d0e9310c73a5d151e55ee870b6195d24e90acdfb300aee73692d04735aa41262c0d94485c8f98f424c3ef0ec1978a859c868c29

Download Submit

Analysis

Sharing