e31715720356a793256ea45c6a1eff73030b02fc37f7087b5c7441b3a1560877

Analysis

max time kernel
0s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08973b94b106ab7745c3c13f805e6924.html
Size

57KB
MD5

08973b94b106ab7745c3c13f805e6924
SHA1

07da532ac2b54fac54a58ea3da9271dc81f316a7
SHA256

e31715720356a793256ea45c6a1eff73030b02fc37f7087b5c7441b3a1560877
SHA512

b63c6318d5d786c98ea0d0eceb929ac0966dad2088e63cadb2e5452edd7ca0fb52c954ad46e4ba297693bace765aac02778f930d66bf6d94e0cb90fbcc197b4b
SSDEEP

1536:gQZBCCOdI0IxCh/NVMWfpfpfufRfOfBfUfffYfCf5fwfEfhf3fMfMf0fLftfBf83:gk2y0IxkRhm5G5cnQahYsp/U08jlZUl5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3138DEA9-A2D7-11EE-A0B6-D6F9353EB06D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1872	2508	iexplore.exe	18
PID 2508 wrote to memory of 1872	2508	iexplore.exe	18
PID 2508 wrote to memory of 1872	2508	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08973b94b106ab7745c3c13f805e6924.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:17410 /prefetch:2
  2⤵
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC8FD.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\flj0k7l\imagestore.dat

Filesize
1KB

MD5
34135aa9c8c3c67fd32ca23d4aabb666

SHA1
c011088d679a27a262084db7b0713100dc79f772

SHA256
11b3a5a5dfbde122f556a5da1f65f097efa45efb3f26edd556423ecd1c076f72

SHA512
a4b2c92b5de23f28f360c0a4c4333d73a0b04d1b4a19e852600ebc614dd73ca853ba2caab4f3cfe28e8fc73a4549da7421c6200289f4cc6c1d1c50252d545f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\layout[1].css

Filesize
22KB

MD5
3e69b5a3cdf5026cd6cb5cf9c605a084

SHA1
4a685a38f048ac032c715d8fbede49643e1714ec

SHA256
561b9419de83de5ba6e3d44442cbdccc7559fbbed7673a24cbf02b0c5aab4123

SHA512
3d38f9890278e9cd58d6df034c201fd0efabddb9c22b8747f221f3136a25bf71c10ca0a562534d862f5e03c4e597f034f0bf5e12648031d9ec926a925293e355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\recaptcha__en[1].js

Filesize
8KB

MD5
2538ee201a81f3d466d003c361678b48

SHA1
e876f33f0436aae0fab8770b164179b351a1ee51

SHA256
f94e9b8222198b3fa76c07b5982140e0a2a60cd59c64aa081141c4f1e5e660aa

SHA512
2c31cf5e0594f4e3abcf11d874191c5c4e61f765543c072b66eb337c182b58a7270bb39a989ba0ab08d66031b039e3edd9148cd599ed2ff4e9dc9687ec76cc81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\favicon[1].ico

Filesize
1KB

MD5
8616a73b5d02ff6b623deab39e621a78

SHA1
46c7618bf20bb96944417272937d9a4d13768947

SHA256
d507190651b896207373ce9430c01c37e56e59c1800bf52834492f83c198bbbe

SHA512
48a64f537dc4acc06c7c8d86975cda69bc5706a2ef4010991363aa28ee57c7c6100de067fac2860e61f5bd2d1466023de64ee291a54ba63361514bb6c5fedd15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\js-loader[1].js

Filesize
650B

MD5
ea5a5798612df63ab0532174aaf62634

SHA1
0f4713eef39ab07510d3703ef201885475ef0b42

SHA256
ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31

SHA512
8cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\suggestions[1].en-US

Filesize
7KB

MD5
83ce59fb59f5ac3918e6dab83a0f9b89

SHA1
89e9ed63d2317679e9ec3f24ffc593f054559034

SHA256
7bfd6ea671e8d0ec8c839c894ce07c3d86c1d05c5abbd1747eae8f0584d9c273

SHA512
73cf0c3b495b968ef4ff76b2bd13d2ee831699b2d4d8df45a8cfef78fd0fcd9799b8844495e15fcdd7f4389c0fb77a30a1f84135616886363e2651f9502288ce

Download Submit