b7e6149c072ff965ff81b322e2479b5dcba95bceac2cefdc8524c1a55627f8f7

General

Target

45e782e31d2f9df6b793e9ade70665af.html
Size

42KB
MD5

45e782e31d2f9df6b793e9ade70665af
SHA1

55d0780d0ea9f846477a1b88f2613638d763aac4
SHA256

b7e6149c072ff965ff81b322e2479b5dcba95bceac2cefdc8524c1a55627f8f7
SHA512

d2d41d3a9accfab26f4fc3062e8d96e18eec03a64d51713c92a453442fd2d269d8e9237100e1e701eda241900ddd5b1514557b1b64274b0dc592c114f8f7c17a
SSDEEP

768:ANsk4l4THOn7Sh3cX4dGp9AxEUz/TB3fFIXi4Rv:ANsk46Tun7Sh+0Gp9IEUrN3fFIXiGv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{943EB7C1-AC77-11EE-8857-46361BFF2467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2964	2884	iexplore.exe	15
PID 2884 wrote to memory of 2964	2884	iexplore.exe	15
PID 2884 wrote to memory of 2964	2884	iexplore.exe	15
PID 2884 wrote to memory of 2964	2884	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45e782e31d2f9df6b793e9ade70665af.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f46107501e5eece997bde189de45ade

SHA1
f5c27a9d518a6df6e9c4521e8e86c45826bbdd48

SHA256
2d5ba87cfca1c91afa2780c30d48b7dd5c8839788fa3249b5409852b27c5ee24

SHA512
2fb6dde06efaa04ae82f1dfa55f761628eb01a4e5b163eb7dac115a92b99e4a48259d7b432dc1dc82e8847578878c8513ca2b19262e17cf094cfbb1f125a34ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
febe79714f18d625eb60ffc5bceec771

SHA1
4a9642557fbc830e80b278e36894bc2487402467

SHA256
887685af44cd5bda985291929903031d214050761c49f339b91158d6ee32ad1f

SHA512
ff7598ff0e21fe66d57af340931d2f7aa6d09773d1622f2500180623dd3c3e0d1c4bd88fb962278bbe5f3f3c93509dde8768c7e4dd05766bb04211e89d7b1c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51d35447f097c38a9cd782b47cbf61ac

SHA1
3fdc993ee71580bdba4145d4205b821589d4c94d

SHA256
4c97cc20dac5793558f63eba5da3c6d4788616384df4cb0c38355fca86a45d73

SHA512
3c43c9e8fba319706400b1aaabd50c33e047ed5b0cd707f6514ad138f085136ca96b54d7576f923a97a5b90404ae501050cae6fb140fba8dff7365a234c4ba4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit

Analysis

Sharing