e570e4ec9fcbbc2cabf25f3ad1a10e8e1fcd0a3fb99787a6cc2c9f22281f1ddb

Analysis

max time kernel
0s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ec3667f84d4686682f6fbe83c529e23.html
Size

57KB
MD5

0ec3667f84d4686682f6fbe83c529e23
SHA1

0213fdc6cfb693be3397ad7c78e8fb938ed55ef4
SHA256

e570e4ec9fcbbc2cabf25f3ad1a10e8e1fcd0a3fb99787a6cc2c9f22281f1ddb
SHA512

cc6e533837ce8dde3db3a4c48a5d56414e7d4e7e9dcad344fb12ce6554c0b5583f03a5e2783a3470605065cb6efcbca4df7f0167fd4d9b82e5eec249ecc38d0d
SSDEEP

1536:gQZBCCOdH0IxCPU7kfBfWfbfDafxfyfBf7f7ftfdfqfFfifBfdf0fifcfXfwfKfm:gk250Ixop+jbapqpDT1lyNKJ1sqUvYS+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{ABAE8153-A35D-11EE-BD28-524326B4BB5C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1156	iexplore.exe
1156	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1860	1156	iexplore.exe	19
PID 1156 wrote to memory of 1860	1156	iexplore.exe	19
PID 1156 wrote to memory of 1860	1156	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ec3667f84d4686682f6fbe83c529e23.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1156 CREDAT:17410 /prefetch:2
  2⤵
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9owjsyb\imagestore.dat

Filesize
1KB

MD5
73c27ba8adb0501623b05956be03eff8

SHA1
633a9db80def912cbd4b8f1f908520471fd1263f

SHA256
c3b996cb06ee394027451170fd92e8a6a7b2b387f0d9993af701ebc6e56c5c88

SHA512
5edd9f26b35dada28c4d98dc5cd8aa9e512238bcd35e4a6ef4c01906c9c411bc23def4d066767c250f798da051c2cba084a7bef09abbf1d5f87b75cb245bfb46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\favicon[2].ico

Filesize
2KB

MD5
cb546f0ce2ca2505cbc9088d8a4592e5

SHA1
d87b70b1a34f4313d085de80da3aa4e8845af904

SHA256
0c3851f8f6d7b9dc63645a68b0db991edc9162620b9d757684a4a20206c458fb

SHA512
b6fcd078f43082daf299a49646280ac3a30b91d10dcfaf8e9fb9e8317af417e34d45ae7397af9507d4101b7bcc58169c2f64adcaa253fc08204b98020b20b551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\js-loader[1].js

Filesize
650B

MD5
ea5a5798612df63ab0532174aaf62634

SHA1
0f4713eef39ab07510d3703ef201885475ef0b42

SHA256
ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31

SHA512
8cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907

Download Submit