557a666bf3ded0598f40384ae2e05d776d4d46e6f4f83e5bac0d80bba5a921f6

General

Target

47ec05b6c2513dc5780235fe769a50da.html
Size

31KB
MD5

47ec05b6c2513dc5780235fe769a50da
SHA1

fb50787acdc03280b13e43dfec2fb67f828d28ce
SHA256

557a666bf3ded0598f40384ae2e05d776d4d46e6f4f83e5bac0d80bba5a921f6
SHA512

1d55f30dc661d0cfcaf030327938076332af4111901535376d87086369a2b17f50f221a02d23699e8fc0536453c880394405c119fb8d1cae3fe2ac996a811791
SSDEEP

768:rCje7eUene/K4eYePe/eCeb8eCeGnekeEweAeteaeReweYevereDe4oUeqOYe/io:rCje7eUeneS4eYePe/eCeIeCeGnekeEM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C73167E1-AD0D-11EE-AAEE-523091137F1B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2544	2316	iexplore.exe	17
PID 2316 wrote to memory of 2544	2316	iexplore.exe	17
PID 2316 wrote to memory of 2544	2316	iexplore.exe	17
PID 2316 wrote to memory of 2544	2316	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47ec05b6c2513dc5780235fe769a50da.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa4cfc222c98cb4fa9cb861f2cda2dd

SHA1
fa09f055e94d542bd5607f2642dd4df0390fcb7e

SHA256
ed603274d3433a38ec2dcbacb6829d8fcecc6573ef5906bdc099584a5e40aef1

SHA512
e0300ec5833f76a661e2d3fea36dfb34b6dde643512c2f6c100e2d65a455c5de9c4f0c70c46e9928ec6c40b86e338b5544c6103bea490a69b4af5331564a40d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d16d20951bea851230abcc9ad448b71a

SHA1
6db60f1f660833bce7b850bf6b1f625847ec9507

SHA256
26598fa6ee0ca878c4ef66f290cf434fb9b2ae8729b8f2bf4d3869e9a9c08cbb

SHA512
0bbb4c49108f9581c228b9fe2737c111e708eff72b4a82182a67fc824a6cc5b138cec0e25a4621c02819e426ab4a92c2084690a211c1cf482eec8308c6a059f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ac13f8793e44099d7356b005dc8d69

SHA1
ae54cd15323b85982c1adb48bdf936df999ed96a

SHA256
e326e8563e54a7de83133321b3a51c4b672e32b1607ef63e8d0ff64c32b4de8c

SHA512
f7dee0abaa004d22a500d357f6b5006eba709f30aa632e4ff91e36f10592c87a9c016bae0368f3e4ca0fe0622544e2b0bf9eeb31a17e2674985f0beac60b8f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar33A3.tmp

Filesize
17KB

MD5
b564f2091aa9e806a5d92bd39d524bd3

SHA1
3ea1934b237dd779bc4f4c0a18e79344ce99a7c2

SHA256
c0e2614fb0b9ac0bf8347e4fbe38fc3f43d2014a0c322b92fd6b6d2bb528cb9e

SHA512
97c3b6dc665079f4743e2aa739b1b5a133d23594f2b969ee0d57865357c5c3ec0937e0d6fb463b1ff17d00d1cb7a3ccf8c59689dbfefc3f58ab342b7e30d8c66

Download Submit

Analysis

Sharing