dcab814a6ed50590a9804f46cbb02316ac007e8869963f0e3dde02193bd9d3f9

Analysis

max time kernel
0s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21fd091e699fea5979c8a61e2eb53a94.html
Size

57KB
MD5

21fd091e699fea5979c8a61e2eb53a94
SHA1

b0b529c3a639b62f8f277b636cda7b021e9a6f6f
SHA256

dcab814a6ed50590a9804f46cbb02316ac007e8869963f0e3dde02193bd9d3f9
SHA512

93f42d20a77fe2222a696bb99a13538262cb61748f26372b13c093b8c7f55593b36a3985be0486b4011af7e46e234d1bf4312b32c418beaf2a877f8a62a0c5d7
SSDEEP

1536:ijEQvK8OPHdFA/o2vgyHJv0owbd6zKD6CDK2RVron7wpDK2RVy:ijnOPHdFL2vgyHJutDK2RVron7wpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F576E652-A3B6-11EE-BD28-F21AB124C203} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
632	iexplore.exe
632	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2056	632	iexplore.exe	18
PID 632 wrote to memory of 2056	632	iexplore.exe	18
PID 632 wrote to memory of 2056	632	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21fd091e699fea5979c8a61e2eb53a94.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:632 CREDAT:17410 /prefetch:2
  2⤵
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\f[1].txt

Filesize
34KB

MD5
177f413f34f6226df1a1d91d2958ea4a

SHA1
0f70736bd5035ce5f3ac9d3cfd65299cd92d35f9

SHA256
71c78f0184044c0b81f320c30cbc41136049f84b951901edf9c36ac9949a3d5d

SHA512
a2348d8193fc1a5fc76322956d9ed7925fa7af7e0aeb5c43a7151fc9974b3b5af7d815486551864b9404db36611433b70d4e7f3f5876420ffa7254840b4f050f

Download Submit