f155531903702b156862b4f4f5f188764ff5180fb43ca40df1d87a028ebe24f2

Analysis

max time kernel
123s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25bcaa77158edf2a2b52d0088b7cb137.hta
Size

11KB
MD5

25bcaa77158edf2a2b52d0088b7cb137
SHA1

ff06fd9a8725f42e01444a0fc683d46de4a264c8
SHA256

f155531903702b156862b4f4f5f188764ff5180fb43ca40df1d87a028ebe24f2
SHA512

c2eaa5e1a71233c5f61677708c22b377796490e767cee798de78455b439742382b5570193670f07a0876102bce90704c8b70900da33315b2b54e3850026cbd7f
SSDEEP

192:Z4tq41K4/4ClbJpEdtT4B4B4B4B4j4B4B4a40424M4X4Zj24Y4N45v464z4h4h4h:ZGqUKEmIIIIYIIFdBHoIqxiKvFEIIIl9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2984	2680	mshta.exe	29
PID 2680 wrote to memory of 2984	2680	mshta.exe	29
PID 2680 wrote to memory of 2984	2680	mshta.exe	29
PID 2680 wrote to memory of 2984	2680	mshta.exe	29
PID 2680 wrote to memory of 2984	2680	mshta.exe	29
PID 2680 wrote to memory of 2984	2680	mshta.exe	29
PID 2680 wrote to memory of 2984	2680	mshta.exe	29

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\25bcaa77158edf2a2b52d0088b7cb137.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\ProgramData\qEscKey.dll,D2D1CreateFactory
  2⤵
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads