e7700cdf513c355388763e853c936f646816e8643d7638a511f8f3212fbebceb

General

Target

514755968520309184fa81f70b0e4970.html
Size

68KB
MD5

514755968520309184fa81f70b0e4970
SHA1

63908e385f6de9a40e18a8a8d481ea64372e75b2
SHA256

e7700cdf513c355388763e853c936f646816e8643d7638a511f8f3212fbebceb
SHA512

061a232e97d3cbec53fb6f46ffe52fd4983bbd9525f1162bd8f6c0ce3e31c3df04120a0f04425d8240b3af5a3067f2c98f0e1d6ee5f809b7b214fb77f52d29cb
SSDEEP

768:Sg0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/VA:SwIk/btnwOHqh4uc5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A27832F1-AFE5-11EE-AFC4-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2360	1708	iexplore.exe	14
PID 1708 wrote to memory of 2360	1708	iexplore.exe	14
PID 1708 wrote to memory of 2360	1708	iexplore.exe	14
PID 1708 wrote to memory of 2360	1708	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
1⤵
PID:2360

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\514755968520309184fa81f70b0e4970.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b8054ee8eaaab3831078a75b4fec4a9

SHA1
5d086ec9c967d038c28744c452e5eff8823ec5e5

SHA256
1907dba2f22ce18b28faae61a8f344b377d322df222a40406ce223b8c1410d45

SHA512
5fc9b7d28e5bba0771d7f7379bf61d95751bca1166b1e09b0ce858f6aca552c80e2d3db5f5648f5d0396b41a315f2e63501936236a0adf1ae8a6ad94f94ffde8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4ebd9a263b30df340aaea7f89ecbca

SHA1
49afaf1d883aade945098811750496705c07b501

SHA256
7d027d2f9e76b5523bc6e36c37d0c5f4cc0c12b0ca54e2721c9abc7f049dfeba

SHA512
cf70ac553b5eeecb201a4a4d500476bd7c00401513af41fe1542a5b9c7a25bc2656f68f6cbef6d2294bb39f7e16207119b865740fe825d65aff63414a37d5a5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9a40aeac976f8b56052be91a83a0d0f

SHA1
6a45c322ddae63f71c4a39170d9235de94e4095f

SHA256
ae9d9cced6c7120ce9f144840a9598a4c53dd45963791fbdc792a7d69eda4410

SHA512
f43fe401a9b8eb72b51e5bfba211f46a09d600c1c4a5948b25247d70f8c9d7d0bfb667ea059244e52228cdbd608ad6e1b120aded598ef80fb7732aa01811de48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71b6a498532484f26c9223d4062d4d30

SHA1
96997380ee77cdfa65a91e621857cf9abc93c598

SHA256
f5cbdd968eb7e25568a7eb88db3d211778aca8a648073b4f0a54bf9ab2a6efa9

SHA512
6c38e1d4abcf49a43adab5dd9b86deae05feb32cabedb54c56d47ede9a1ed604abaf7dead6ea07298084633c61c9c10f68557022baf9c3fd5dcba32bb1dc5734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\ga[1].js

Filesize
6KB

MD5
85b81118cad3fb2e5689c44365b54a45

SHA1
d1692c168f823f61fb82d7beed210c401faf268e

SHA256
6aeab1dc43f811db5a80adfa16da09400513fb318d2bc4fd25d70942b13e6775

SHA512
fcef8c5ce84b843fa0e7acc3dfc338ee0f35ff33660a4f43e4e3b546d2a2ef371f5b90341020f7f350bd4690d4bc61bf21b3e25786ee50c91f063fbe821bacf3

Download Submit

Analysis

Sharing