a0df5c50f6440cee72eb76166ace7d92f76d85a927bad9e1dc3ad12f8f07b4ef

Analysis

max time kernel
0s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d2f5f2750a541c5cc9f745dc3059c22.html
Size

62KB
MD5

6d2f5f2750a541c5cc9f745dc3059c22
SHA1

9ec134f44b687115637d82a3cf717b5fab2489fb
SHA256

a0df5c50f6440cee72eb76166ace7d92f76d85a927bad9e1dc3ad12f8f07b4ef
SHA512

3fa94e31af941075556f2cd6016fadb4b0bf0ccc20a14fa6435a1cd9715c0ca0597662fe79d81f3f63b3cdce6baf7a61ae74a531cfead5016bdadfb7f62925a5
SSDEEP

768:YIWeruQi6qIa/IIH6/G4xRG5M74M9QcUfn9VzBYmJyZ1:YIWeruzzaG4xRG5M74MKNVzBZJyZ1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9EC86536-A4FD-11EE-8184-4ECC77D3B663} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
800	iexplore.exe
800	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 5112	800	iexplore.exe	16
PID 800 wrote to memory of 5112	800	iexplore.exe	16
PID 800 wrote to memory of 5112	800	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d2f5f2750a541c5cc9f745dc3059c22.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:800 CREDAT:17410 /prefetch:2
  2⤵
  PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads