af92eda08aa281e312cfaf3ed667e34e3bafee5e356c8abbf4129c3055481882

General

Target

48f5e00f88dc729038a53f138a492d53.html
Size

69KB
MD5

48f5e00f88dc729038a53f138a492d53
SHA1

f5951c6a1c9edea8108a7f53490373ca141d3f2d
SHA256

af92eda08aa281e312cfaf3ed667e34e3bafee5e356c8abbf4129c3055481882
SHA512

de91475602bf21046e988f364635e611e0065e41dfc67110212166f4876d2eae20a52b15962618ee47a5fa6c53f595918123d05293f513db1db01dd5a0e845df
SSDEEP

1536:LHvYoFZP88w7WrZqxUvC93IxgdR6TJGv8f6XP8Fpm:LHA6h8FWrZqxUvC93IxgdR6TJroP8Fpm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E94ED6F1-AD5D-11EE-B2C4-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1572	iexplore.exe
1572	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2264	1572	iexplore.exe	16
PID 1572 wrote to memory of 2264	1572	iexplore.exe	16
PID 1572 wrote to memory of 2264	1572	iexplore.exe	16
PID 1572 wrote to memory of 2264	1572	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48f5e00f88dc729038a53f138a492d53.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275457 /prefetch:2
  2⤵
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83641dfe4ebe4609ba9590aa479b2621

SHA1
84f5d1e6800370e1c8a5da8d018d75a1c819da2e

SHA256
8284ad902eb80b41f10504d902905b43a7c279c9ef0623a7fcfef6132d778264

SHA512
4ad18e185a20a7a3be35ddefd8e7b5aa7a6d24cb24bac462c15df5c545ae6b5d86e4a3da9ba6a35086d692d09a4e6e01a00103afe1f61627a1403b29f24a3041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ee174171c575a856fa777445bd5696f

SHA1
915e3c171f9fc4172f71c970bf23ff35996d530f

SHA256
81814a38a361201e8dad7e7624e7e693aebeab18707f863ac14554a6449f7709

SHA512
b9104c706e8d84d918284850984d22966d7cecd394cc505e2cc760e7dfef83a0370ff8d0a418b2dfc3aef37acf15eea69cc8f0d6fc5534ae933af847a85b5313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71624b893e3f956f73caf42f65bcfab1

SHA1
4069d0e42b7fed2abb3bebb0fa0b96862b045db0

SHA256
21a7c44acaa9413ca415dee942a10a17920a264024771369df602aa6748d1158

SHA512
85cf7709b600ec27088fd8090a0a7a5a13b1b415b79feadd7e9d9193cc308db73e32c92a6b7fbc1f191846acc0ca1d326c5c24dbefe956ac9ef63c1301d7b126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92dec8e4418843f1ed6636ac77803198

SHA1
af1dcba6dbf8da6bb2fe9c77e689a6f6573b16ea

SHA256
c015b943ea69df7b95f04df2fedc81c478cadb13916ba536c048939dfc517206

SHA512
b2bd3a5516edc953d8ffd566a92f801205a1aaf0947e4925ee390dd965ba01c273e950513178e4fc380dacd97281a0140995ebca97df63cfa1a0cd7fbffe978a

Download Submit

Analysis

Sharing