64972d47cdca4abe6409882fb78dcf86fca8027ffd9826da5e7c2d0b2ad7a3b4

General

Target
4a374cfcf5fecd5696b84f56b51ab59b.html
Size 8KB
Sample240108-a4k9msade3
SHA256 64972d47cdca4abe6409882fb78dcf86fca8027ffd9826da5e7c2d0b2ad7a3b4
MD5 4a374cfcf5fecd5696b84f56b51ab59b
SHA1 21be04ab41b81367e098c34b4151d16987d0cc09
SHA512 f5af5d06f87c706a0c2a0b517215067582e344349239aa46db96507461587b0b9eab8d4a5bee8be3f27bc84993355eea43495a98eb5abe0fd990b6e390276702
SSDEEP 192:Pwsz1GxmypSmQ3XcXDtLor3Rx0Z9JpGFeggWcyDiLmIH/TU:osz1GxmybWMXDBC30Z3sF7HcfmI/TU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F25FB01-ADBF-11EE-8723-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2744	2916	iexplore.exe	19
PID 2916 wrote to memory of 2744	2916	iexplore.exe	19
PID 2916 wrote to memory of 2744	2916	iexplore.exe	19
PID 2916 wrote to memory of 2744	2916	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a374cfcf5fecd5696b84f56b51ab59b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 dbcc283a713948d094537b4fbd9918e92ea9dc22dcdda36508ee8029e7f1941a
MD5 4f4698264eb622fb82b7618a427b9a55
SHA1 4e4100b9ab02e12ae6142255e937c2cd636904d3
SHA512 54c60d23434a4dc8e08069bd820c08f458dc29d941a5246bba401d45075c24ed21de16600c5e1eb899d01d70d63deb133b2448b89b731eb62a58c84f88e37472
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 a9f6010db60177a2fae8bfb4ae133eb3d7d77d2028a65e4a5d672429fdd5ec37
MD5 b78961371c957f007f833c410b33a78b
SHA1 baff679f839d0cfd404b351c7d7649409800c34d
SHA512 670a3939d13c8699853521ebb8df3c20e9a2b057e74769c337f4ada1f9bd86c52e14b6ddd20450cfdad3e910f7778f3a28a237fd466ee6ccdb3fb4aed6868007
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 303a966f24319ae69cb96664c579bcfcfb24e1414160d428716b8c611604f438
MD5 e80490055013edf2bad950ae8d6c1a2f
SHA1 b033e02e0cadb8fbec650e159e834e07a0183718
SHA512 9f755be068cb7faa05f52f7b65cf44d00785b099bc3a2c50a0e38afb653c74c0ba7c6b4edc0049ef80a2094710002e3bbabe3fa73c9de284e6376f7a616b0c64
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 2cf3012c180dc6543f701f0b697f2e1628785445dcdb237250d01d724f89f8c9
MD5 df1d8ec2fa0b3d7db382dc6449b452c1
SHA1 45a47fd9e065ccbb25275a6f666524095a99cdc3
SHA512 9565075117b85dcc517f81f38344a1fbb6d08cacd660ed825baec6c73d9608a20119ce3efc1e2cfa81560736b71a8e7f6a2a2f30f1637799b7e09ef268dedbaf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads