e34cf9e341c3d0edc8a5c96b937210f227ead8367fafa85b65b60dd561b28629

Analysis

max time kernel
0s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43c896d65dbc939f3cbd7f1fa8196f52.html
Size

34KB
MD5

43c896d65dbc939f3cbd7f1fa8196f52
SHA1

22bde8ae297c228ab15c3bc5553115e1084ed3bd
SHA256

e34cf9e341c3d0edc8a5c96b937210f227ead8367fafa85b65b60dd561b28629
SHA512

fe8ba8060791868126acb3a96eb822bd917de4233ad0dc62ef3e6474fe0aa3eafc4b8b53df4795a1e4cd3217f338728a6416501efeca830ed863bc0159b66128
SSDEEP

192:SIzarisRMLsCyp4NrSYgSGTuQpip2JtvGfyFDsXBmPvIaqgcBB7ErwaUvaut6TxO:SIci3sCyp4ATTip2yeHip2SXr9+isU8c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BF3F7DC1-A44B-11EE-9963-FEBFAF1864CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
8	iexplore.exe
8	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5068	8	iexplore.exe	16
PID 8 wrote to memory of 5068	8	iexplore.exe	16
PID 8 wrote to memory of 5068	8	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43c896d65dbc939f3cbd7f1fa8196f52.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8 CREDAT:17410 /prefetch:2
  2⤵
  PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...