e2af54fa3c83154e5260341eac3c533fe9715498a1920907ec852afd08bee4eb

General

Target

46b87be5ca0faf596dceb15c1b16aa5d.html
Size

11KB
MD5

46b87be5ca0faf596dceb15c1b16aa5d
SHA1

c2f2b61fbb3bd84769b1c28bcb4cafd3f7f5d72a
SHA256

e2af54fa3c83154e5260341eac3c533fe9715498a1920907ec852afd08bee4eb
SHA512

6ee074346ffab466d8540a497ae94317f9b5f3d79ce211ddba229a6dc01cc3ea6ac4f58240d46e9c8a5b6b3fa13b7aebecd17b348bf0434d6eb5559da33b0fdf
SSDEEP

192:2ValIsr0r57M4Xxa+T8IB/w1wvqVkt13auBuLbdU8d:salIcIQ4XxawB/g83aguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410721514"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{404DBD01-ACB3-11EE-B0F5-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28
PID 2148 wrote to memory of 2208	2148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46b87be5ca0faf596dceb15c1b16aa5d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58e39d6460d2e8a6894234f966ce0ecf

SHA1
86b6648f6495412058f4ac38022af67e00a8e794

SHA256
113431703b80b2c7312219e17e1613b47b13afc0853d278d0b88e84ffef60b75

SHA512
61e313a3fff6d3fe1b882c0d07aed47326082499f0003d0bcfa2fb8486828274262d6552add6c12f25d072f973a3c01c4dcd8703e05a542ee0f00e0658639d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2e08ee3d2704c71e745fa3b5cde34a8

SHA1
477d45bc21b5f9345763ba69164193b3bee5cc61

SHA256
40e8d9c93dee8284973804394e9eb3741363d1272175102a205fe12f5e361e96

SHA512
fc5d890378df73f93acb2c0b3d6bc3cdaed56a823ea1e17607eee094567e0a6523e1905551ca4dee3b84350819f6aaac7818fa4462e7b8bab481d453cc4506d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0820f2165db7511935e980bdd5b4b426

SHA1
316a4c6f6d9123371350b38da85574e300c448ab

SHA256
b6aa4fa00cfc9c09ba68c89771a2feb01fb50616cc5cb964a33538abe13b9b22

SHA512
9c98355d66b419c69bdaed1c9984a05928ad732668f5ed960fe2e4c8328f78ed2528ba971cdd33e77b32b2230ebff07c68c49de627d95644e99787dcae3b7699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77194c4c00ecf80beb45c2228d83d967

SHA1
c81e251c603198728b464477ea3ccdf5c133b3a0

SHA256
ea05dbf5160b06499b1dc5abf4d3a67b925e0be1e15630e3d3c96e393971827e

SHA512
edf849457e171d4159e5ed105a6c302e44e9a70940e09bf1222bfa672e9add83f20bacfc0f7a4a5c2f890e7308087320aab29c03d33c1df84de09456ead9c136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01ad314a12ba5e4fcd6a8844a41d54f2

SHA1
382e8a0b6664177ceb97d092107487293fad549d

SHA256
322d82090f1a33c0b1cb2ab2fa2aa65221b63ce7cbd2e759f466f48ccc5fa2b2

SHA512
719ca451610fc3e293175dac50678db6045bc171d8c3f47b159f29effbef8affa104d908c6f363943c15969b61c8d99507c1aaaf69623a5fbfd74aea31bf1422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60e2e54aae748b4b1db8e70ec682ed12

SHA1
fba219503a67c82331001a62fad9c6681a9c2c30

SHA256
f7d1ebfa6b2a24c6f9de7d8d37891852bb8bdba689d012577da93b34eb0dbc14

SHA512
e66a5089427bf3b58271b2e4dc8fcf74d51574eeaab02119ab5dfe8cfaab4194526b32c3b4e9ae567cb2ea0e064116ffb0a616db226e3f8e779bc376dd504abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1132.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1154.tmp

Filesize
58KB

MD5
62100b1ea299f7f93714c4e8905e0e42

SHA1
dc9d54b5d6ffaa33dd8a0c6b1ec81d2662f58cfc

SHA256
b105a306730e0d6fbed043e3974322c56295182ea993cca9ebfad888c2cf27e6

SHA512
803642a874bde9a96d164f735ac515d9c8262601c0bc74727820c6a1a8e99be4640e5abbde265d6046fd3444addfecdf51609b98dc318e872859b45be86d2c1b

Download Submit

Analysis

Sharing