e5a6b05515027b260cdbfa98ef7b9ee9bd59c4abbeb589f43f687f31263fe5d0

Analysis

max time kernel
0s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44b3ddb097b01d877aefa75b61d0aa9f.html
Size

19KB
MD5

44b3ddb097b01d877aefa75b61d0aa9f
SHA1

a7c23b5eee1a85663b4830c1cc3d4d0b43a615bd
SHA256

e5a6b05515027b260cdbfa98ef7b9ee9bd59c4abbeb589f43f687f31263fe5d0
SHA512

74157ef3a752c7ae66cb380b7e6bbc082c8635ac6c90b3822fe6e864b2292eb27cb4471e8b00c9b0e29393407c61556420443695988933db88294f353cb8d629
SSDEEP

384:4+QfPFd9QZBC7mOdMwstKfpC5IgSnbmFe7AcB06slLZ3Pd:Zcd9QZBC7mOdMwtpC5I9nC4O3Pd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D4172637-A44F-11EE-BD28-4E55496B34AD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4176	iexplore.exe
4176	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 400	4176	iexplore.exe	16
PID 4176 wrote to memory of 400	4176	iexplore.exe	16
PID 4176 wrote to memory of 400	4176	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44b3ddb097b01d877aefa75b61d0aa9f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4176 CREDAT:17410 /prefetch:2
  2⤵
  PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\cufon-yui[1].js

Filesize
17KB

MD5
461958e1e515e8e0f372e73b4c819d53

SHA1
3745471542e7992dd2f5d85b2948da66845ade37

SHA256
186707c7ae0d45cba1490a5556f59fc371f6ab88cc16c452fef8b70072cb5e54

SHA512
734f8cde6780c2deeb1f23b21097fc381193ef0c3492d16b411984bacaf807b2799e340d254e8371ecbb73b104d29ee8a46448e26e0ef14b26460ebdde100d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\roboto.cufonfonts[1].js

Filesize
20KB

MD5
301d51da906e6cd41dea529d764dc504

SHA1
15dc16d366325aea102fa46c11edf04ea83a0283

SHA256
d49065ed2e4f7cb5eafab0fb03611563146102e514a5946bfcf08de6db58b85b

SHA512
6d50fea1d52b5bf19d1c758465d054dd3b0f03dbd754c29177e7f7248c275dfea2f61368857b54da914187966539f2eb5dead4308dcc331980fc26ca42255ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\Rockwell_400.font[1].js

Filesize
17KB

MD5
55a0d8277a94894a8b40f72717adf869

SHA1
84ec2afd66e38aeaab8988fb18787e32ac6e3bb0

SHA256
f8bf624dd3d3247c58ddf95b43c5bbce5c12404158d466ff8235af41e595f29c

SHA512
152d99198ebf5e5ab18de1bd1ffb804912934a8fede44826a08c4b7b30e17be222acdb406e8e005819f1e40a4e2d63c91a01a19e672c309c74f2ce19b09efb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\jquery-3.5.0.min[1].js

Filesize
87KB

MD5
12108007906290015100837a6a61e9f4

SHA1
1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3

SHA256
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

SHA512
93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\jquery-migrate-3.0.0[1].js

Filesize
16KB

MD5
7bc46cd787fd2b6d3336e056301d4b84

SHA1
60062992ac61926ac3e1604b7f89cc373639c66a

SHA256
7fe32e1f272b3c300aca9d573ab228d87c605b4a705369d3c459523c52c9428d

SHA512
37ae02c8da88d3ff585d85035162f4e927cf1ed4d77d6b83264abc12a94af5b484095f2f46e9f3a6ef80436593ab482646b80479bebb8e782667eb86e98d3397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\layout[1].css

Filesize
42KB

MD5
e57c81f3a17073a78a7c3c865f74f89a

SHA1
587d7c955432f1e5a87460ecbf9086ae2589346f

SHA256
e36f1f796e538f826beb42510edc0354133c61c7f711b827def7f91d3f7c8bda

SHA512
630aa9dba2aee1125103954b093af8b24907d98761e1a9b93fb6f6c43abfec3afdf53825e3f12fc3cf87fa14855daadfdbc90b1e49b503fb2917599dd77daf52

Download Submit