0cf7f06a31e7b8b0d775aa0a3167ea56832982c6768a905b4d918e07bc6a6f89

General

Target

51013cedf67325756badb21804df47b2.html
Size

4KB
MD5

51013cedf67325756badb21804df47b2
SHA1

62a260b66d80643c828363a00832c426932814ef
SHA256

0cf7f06a31e7b8b0d775aa0a3167ea56832982c6768a905b4d918e07bc6a6f89
SHA512

9479dc720193353fdfcbb2427b23d01cecfb94a3351020e4b75f51d1b61e64a5501030dcb81b15cd5e41000cf56c2d4426fc9494347d25fafa6fecdc1fe456b7
SSDEEP

48:Im3vp59cB5ZUXK4JUwgCCRXAMACAzQXYg6GB+z3ztdtdVFtdgtdtdlEL54YN8hwi:xTGZcHthNLBdW0qHEgOl4aF8z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBAADE11-AFD1-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2168	1720	iexplore.exe	28
PID 1720 wrote to memory of 2168	1720	iexplore.exe	28
PID 1720 wrote to memory of 2168	1720	iexplore.exe	28
PID 1720 wrote to memory of 2168	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\51013cedf67325756badb21804df47b2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca38af2f12287f2375ba2bf7b1e0d5ab

SHA1
aaba64ea0cdafe47eaccc55d800f70be10848fdf

SHA256
fafcaac9f7c25aedb511300d25813a61870bec0e471fa2fb9371da662308ebbd

SHA512
fd37b9a3150a82f83066e2162ccc5cd22c1e698bc1c5bc1cae85ed739644c3dbe33c21842851c13f9ac96329a302fbe2a93c5425f7940c5b88686d120aef15ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78612d60362eff58a2bc4ac202fa05f3

SHA1
8796112402c9c8f7ca2d2936a6f766ed0af2e7f3

SHA256
b04a289008a1d7350dc3e2dfe96c309cb264edb3b1979bf73ee2e04c657dbcaa

SHA512
8fe7e0ede97d08cb328776ca25aad3ef57ab4823e963e1aaa203ca40c3c3c3a8191a56886f95d237a7dde87e06b12809c23409a2290ebcec4d5637c2e6a4ea22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e987daefc6c7016f6efe99299f0333bd

SHA1
3f986c456cb40826b99edfb8238b554d47a265fc

SHA256
9c1a136ec961329c8b3012b83ebb6496dbcf6199e69d13dcae90109b0d6f9b72

SHA512
5312dae5a5a1027912487a098556820bf07ca46c8cb6e2ba60b0794e410a14515f2488b900f93152c6364899568f7fdd28be05d210bdadab934073b0891deebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b82154b4566a70cdf7ea4605f6c68287

SHA1
0fe2e1150d292c841a917307476c49eef3eda5d0

SHA256
851c968d9d6d07ddf81c4e4eb83a86c92393a7fdd2a192d3047ee8d44bd95dee

SHA512
2b25131b931bd87327a8b403ef629da8b98155bdb833ca2ce96f1fa8d74c4722d9759673cb4425938d6267f25b3531ecb126e89b0410be3b9e15f39eb0a8155a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b6929b789c3629f92cc46e358230363

SHA1
71d6683eab3be4c51675ffbbb49cf2202aa271ee

SHA256
aa8a6854b6993d0906ecb760102231e85e9302137903eb7c37176577a3b299f8

SHA512
f28c3666c41ed4d3e63a707c04f0603acd9e149c5b04eee34f9818c62c2d6ebcc5f125b1eaef6864f008921f825bf758b8514e62ae687bfad56789fbd47656fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d61fb5342721c8f96f05090494974f71

SHA1
da593fb3066011104c2a2b3e4dd7bb7df694eebc

SHA256
7653fc454880e15a81490f7f84bfa621ea0d7da1a48e1bcfd3b0cddc732f1979

SHA512
021f4e983fb19d9fb5dee65b6430968a2fddd7ce65aca4a9a9348d8a78915d2eb0c92402d6527351b1687b5438c1ce8d04b1da91069028d277e5e46fef078b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5e1a534b265f1fad4898f5f8baf0f78

SHA1
0ebc72a71d7539c06d9f4aa60291c7bae797de7d

SHA256
ced91d5e8c3829545029c6194cd4570093808e985e6226f6a4b3ee062ee9624f

SHA512
0ae8302ca54623e70582847658b3aeed7436db855c2f48e475d7ffc04be4f1f48c1ffe063911b355418f5c260909f3c7621bbc6546a07079dc94a8b8b4550cfe

Download Submit

Analysis

Sharing