9c3bdee564806268a48cf5d3c4d6a158c5f2b6e7b97d93a24f11ddfdb9859686

Analysis

max time kernel
149s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06d4e8a9336d1c52bb898c0ec81bac2b.html
Size

30KB
MD5

06d4e8a9336d1c52bb898c0ec81bac2b
SHA1

2330cd4d274fe8e4fd57b521ef7b5ae32ee03a1f
SHA256

9c3bdee564806268a48cf5d3c4d6a158c5f2b6e7b97d93a24f11ddfdb9859686
SHA512

5d8b100db712ca8a3ee73724c17bf01aa5b602b25afd3a7e50ebb6d6e447e93e99e7380ad265b8326394cc98e051afab53fd378bedf37de61ed75c5e6ce54c00
SSDEEP

768:LHT0ZYMoW6g9i3niDH9TYyTTqay749gNTwHCf3CiX+fIry7HwCq+j:SdoW6g9i3niLGyTT5V9gNTwHCf3CiX+T

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079221"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410715475"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3421515498"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079221"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079221"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3421515498"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079221"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3495577772"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3495422546"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F55B1ED3-A728-11EE-BCD9-7672481B3261} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1032	iexplore.exe
1032	iexplore.exe
3592	IEXPLORE.EXE
3592	IEXPLORE.EXE
3592	IEXPLORE.EXE
3592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3592	1032	iexplore.exe	91
PID 1032 wrote to memory of 3592	1032	iexplore.exe	91
PID 1032 wrote to memory of 3592	1032	iexplore.exe	91

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06d4e8a9336d1c52bb898c0ec81bac2b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver581E.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8PO8IKDM\css[1].css

Filesize
193B

MD5
eb2bf7b6c9361b8b5a245d3e56090639

SHA1
f18ba15eeeb59d3da653638c3c54852485b9063e

SHA256
f091aa194aa885141aa6a5e199c4a2445334ca5cd51cab34e98b9a26c55b71fe

SHA512
c4fba364dc493e8b40714b85f76b27753a64e2ca6c4d24e8df5a3ab6904f31f2c0845a141dd3da4169ea711a2b3c16f377a04646a3d44d0817e6b199e518b7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AAZL0E9Q\comment-reply[1].js

Filesize
12KB

MD5
39a98028eede8315f8ff2d2c1f947168

SHA1
5bf6ba9431001f3b047216aef2abf4bfcb37592c

SHA256
0df263a4d7d02d7bf1b4c0e02bf3c5c456228d3f5e715153c7db9d3944aed91e

SHA512
7bd618c330b0b4f414bb7b25e44c6776382badb92de1f2c86d7c4de7508107dd842a29ec73eb301ea8360ca518ae22dfab36c6b65f2e75640bfefc980acecfbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AAZL0E9Q\wp-embed.min[1].js

Filesize
1KB

MD5
2f9c93eca3f761e9a87c735cf3a24a39

SHA1
4b7cdf3690ba5126bacfba15dac67da45b3c8664

SHA256
51f2cdd4f7e97288a74d803275b0550ec9eb938210ad5ab7fb1409548acf7554

SHA512
c2a46755dc04fa4127df222e34066b047e42906eee70373b632a1f4a4e205fd7e5bf8646b9f4ffbe9fe9d0cd8a880f7f861c0a1bfd55cdfa4bff3537d8e2fb3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CCM17AA0\9GMBLKAM.htm

Filesize
333KB

MD5
4724e2458f7d43a29bc67c3404b323b3

SHA1
b936923afa3247dc238114dfc4fc6d3b5412dfce

SHA256
3dd7f4047ab7796054c02613f664a3727b080a80146f0094c24195beffc00ec5

SHA512
93f41494d42311c9c44e033a24e49fc9d85ebf59a461a1708ef79e44fdeeb4e9bd81ea746bb774bc1b769ea285fc200b2ca343504528062dd7b7cacf78b171b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CCM17AA0\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CCM17AA0\wp-emoji-release.min[1].js

Filesize
18KB

MD5
4cc444663c1e69cb8ac7b909e7192bca

SHA1
d00ddc5b9526193fa99bc3995a6d05f995452ea1

SHA256
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

SHA512
ae37d08d11aa4337650cbec0d0f1205a5505cb3e82373873e82cba093019521cd2b93cfe2dbe4840ce098717287e1f732e9330c90063b122f1c6358664f1b8ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PG47MANB\css[1].css

Filesize
1KB

MD5
a0620ac73c79b5cf9087eb28268e626a

SHA1
ad69758c1d83f357664d5f30cf3e5c60a960e424

SHA256
c2d2bd170392064369f2bfb49a09ca7a41145f138ab3e7d2120e349fc813573e

SHA512
43feef19847f40d9f333675e34b684e21f3bc0ef81118711bbe4c223ca5e8587e2015b3ce6958f2847e879cd7866bdda4227cb409eed17c04ed742bc965b2798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PG47MANB\jquery[1].js

Filesize
278KB

MD5
16623e9f7cd802cf093c325c511a739c

SHA1
b364dbd40e67076a03e9d7b061c9b2624d081e31

SHA256
1e7f83052e1e3442c4397ced9555033cd1d3f08444d85960683bcf91c8433cdb

SHA512
44b9d0ed3184fe5f19e650798e6fda22b71a6f316415e08c4ec88af3a4211e9fd335d5f9fc44a070f7b478d7060ae3b665c2d2620bbbce2ea6098bd6826b930c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PG47MANB\style.min[1].css

Filesize
107KB

MD5
99ab466e0866c823ae5db517d59cebd1

SHA1
5595a586cbd42b31377681b9d35293278d75d336

SHA256
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

SHA512
d19932f64adbdb1286b61d472526fe0be92e5fcdbecf9df9c9dc607d46e26f8912c74294256f1a6b56d0fb14a774679407187eed011f4b5b7008981aa52f6df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PG47MANB\styles[1].css

Filesize
2KB

MD5
0e4a098f3f6e3faede64db8b9da80ba2

SHA1
65b9b3c849f3fbdd783ddbfb183616ff55c7ee53

SHA256
ab21762c3f447aa08cbefd5ea3866165f925bd5058a9ae19e23721462de6fb60

SHA512
47cf04b377c4d5d512ee93439d17d21f6e0c5011e3cdc9ebe2835c91b6bfe7d5b3e4e23dd8c00017d7b235d08a8524a103edf3a199c8b1d5cb9a182d8d5eae73

Download Submit