a52f4d4ae2d40a45fa4e989b5210dba72b30f7324b2b2ba018cc08c9749e2b6e

Analysis

max time kernel
0s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c7d0154b3bd1b060a8d82b44593f3c3.html
Size

123KB
MD5

2c7d0154b3bd1b060a8d82b44593f3c3
SHA1

fc8d34b8e16e81e053b130dee5f5c3ac7d2db205
SHA256

a52f4d4ae2d40a45fa4e989b5210dba72b30f7324b2b2ba018cc08c9749e2b6e
SHA512

a1dc135a2c41c8554e54b866e68781de2ef8df62ba75931a7f7a453d3920cac21faf62b98cda773e5ced89407cc3c67b86e1687334d89e8a089b9c59dc4ac441
SSDEEP

1536:ic+yuLOqepeORteie5ceeeuesMeueaeueLexeBe5SeEeueHeueveuereuepeuenO:ic+yuCgACB2XMloFhygoAzl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1402402A-A5CC-11EE-A0B6-7AB8B57C8E96} = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4336	iexplore.exe
4336	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 1852	4336	iexplore.exe	17
PID 4336 wrote to memory of 1852	4336	iexplore.exe	17
PID 4336 wrote to memory of 1852	4336	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c7d0154b3bd1b060a8d82b44593f3c3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4336 CREDAT:17410 /prefetch:2
  2⤵
  PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verB90F.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\suggestions[1].en-US

Filesize
10KB

MD5
a315f3f1ebe6762fd387227f0adcf309

SHA1
9a14630e4e2e93a17bc5696be062b2aef4ab5b1e

SHA256
236f40343767762eceed055c7c5a4e653c82fb4d80a067d1b8c4b590403696b9

SHA512
9011f7922c910e219f41327a9536f92a19f6faa97496701e0742520a5fc5c6ab3de8cd20f4777da3b92c90272d8ffbc6dcace8187b22e0487d5fb83405b035e0

Download Submit