77ce740647d8f855faed89b08bacb1a83280f467e0e49b9ce4a8d71824dd112a

General

Target

472741547c8242005a074d74a18e5ea2.html
Size

2KB
MD5

472741547c8242005a074d74a18e5ea2
SHA1

03a886c0b04b95006a244d19d6fb66c3da109865
SHA256

77ce740647d8f855faed89b08bacb1a83280f467e0e49b9ce4a8d71824dd112a
SHA512

76d905b6027da5ff27a4419692bd962164752e90cdc521e4440523fa919dd0295b2ce8effbe475bb51178bd1d1e506cd8a82d4e67e2ba35cb977ed92aa727a7a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{921427B1-ACD5-11EE-9028-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
832	iexplore.exe
832	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2432	832	iexplore.exe	18
PID 832 wrote to memory of 2432	832	iexplore.exe	18
PID 832 wrote to memory of 2432	832	iexplore.exe	18
PID 832 wrote to memory of 2432	832	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\472741547c8242005a074d74a18e5ea2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:2
  2⤵
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f33b649bbd8cf8e22a6688791794145c

SHA1
01b8e8dfa97a00f4d2bab38cfac3dcd42352b4ae

SHA256
46e7cb7b4c7d10c4e03a032c0c9fae7dff9d8bbd74a5b1bf4e38905f027f3e6e

SHA512
52399082e747fa0bb3de1e2c8a9be466873023b2c103339dcb6cf5234a0175366e48f10ad9640723536888b9a7aa50f6d7a0d36f4d953a09bdcfcc9fced578a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef7ec207d4d3d6b214ad1e6f104d2738

SHA1
23dd6828670547bf66a863e497d0714290bedd00

SHA256
0af3ea5db39436a30430fe562cd17250fcff1da89cd390af78e504897c1fb77a

SHA512
c36ab6ab9e390c0a40cd76a04f9597e2edee77e1b2b677226578ea4173df6cf6f844ef86d45506ac465973d4455df1cda8ced8b4eaa16c1a20e4f56e7b1b5a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bf2a2bbd5847b8ae3cfc3b0494276eb

SHA1
6f944982d5a8e21885dc095d891ee4acec1c4935

SHA256
fbce713831ecd0108ca755533e52724eeab73b2a78078d4bf033c08a0d4aded8

SHA512
ef9bf8140138dca678da4c0d6141a6588c83296b7e22785ad44f71f9473ae90fbed4bc36e973fc605933d63626ed98047ba69d9fb5f9f8dd11c6c787df5f23d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4452198a9486325be2d7bbe7986d0bfe

SHA1
b64e41831ad7238f7fca292fc40e486f0bda3c76

SHA256
c67b913bfaea48fccc11ada6e9ee76328d44dac6fe2553e25b5becef9cfbaba9

SHA512
d2234ed90e049779c0f4d474ec73fc49e8aad024ed2f1957cac26c97c601c50e363fd4fd7113ffc47a936637b91df7c99c4c196c67988ca14cb4a4cecded3bfd

Download Submit

Analysis

Sharing