ab7226ae0b88eec41c132a18a9048a8ad7e2f982cc2e168903da00ad5a2bc166

Analysis

max time kernel
0s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0519e341dcfbc88bc9f4e765c2ab58da.html
Size

21KB
MD5

0519e341dcfbc88bc9f4e765c2ab58da
SHA1

9ce27eb0c2665f235411fab45788a117d3509ba7
SHA256

ab7226ae0b88eec41c132a18a9048a8ad7e2f982cc2e168903da00ad5a2bc166
SHA512

34a5f25f252ff47a9e5bb411c218b379317eeef044cb8464579984cbb5f5ec24368d0ff0eae1740861f8a6d25efde8f9f52bae7f293c1efccc195a6627b2f37d
SSDEEP

384:FtjIvqm1Ne7vYsEMsYmEpm+kzAcAieGpG4RhZdEM/VcNkfLK+a646867:Fdiqmje7v3qYmEpmn/AitpI8NapbU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3749E4BD-A6EC-11EE-A0B6-E2EC48AD62A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3456	iexplore.exe
3456	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1252	3456	iexplore.exe	18
PID 3456 wrote to memory of 1252	3456	iexplore.exe	18
PID 3456 wrote to memory of 1252	3456	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0519e341dcfbc88bc9f4e765c2ab58da.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3456 CREDAT:17410 /prefetch:2
  2⤵
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\suggestions[1].en-US

Filesize
9KB

MD5
108340c24f455fb3b665ea4772fe0226

SHA1
44c39314ddde36c8541cc82665d61450e14674bd

SHA256
d6ae1c92a12261f9686c52cfb13f806cc26d34c1a84645c016cddeb4531245ef

SHA512
788694910a4ab330e8dad02b52830fb2347067d8faa8e25efb1a76a5476c8f3529f22df88dd4171593a7ae3e5eb3d0079a3eaf9ebf76ece1e065cbe6de0004a5

Download Submit