1caee147d374cf9c1bbc1f5b6e9c87af6fa6d0934e7a72cb408dac11e4cb8089

Analysis

max time kernel
0s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09adf72fcd948836f5fc2f7cbc0c7365.html
Size 146KB
Sample231230-bkl79sgabp
SHA256 1caee147d374cf9c1bbc1f5b6e9c87af6fa6d0934e7a72cb408dac11e4cb8089
MD5 09adf72fcd948836f5fc2f7cbc0c7365
SHA1 7af5bb0cb4ddcd730b14bb384fe515505186a35a
SHA512 1895a8f1de1638a2121ba542ae24cb1218829ca8e4fb606f9634c4537978efccfc5f19fd97cb466385927e10f9e3a45e0e1e6a8ad33d6e0b188a7031d49921bf
SSDEEP 3072:rQE4FrRjmS8gg/QuHqQQGTf1IkymWWWWWqmAV8KszEPBCb7NWpKIpjw194D:rQHdRjmLx/QuHq8TbmAV8KszEPBCb7NA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{402E8FA9-A712-11EE-A0B6-DAD4CCDE76B8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3484	1924	iexplore.exe	16
PID 1924 wrote to memory of 3484	1924	iexplore.exe	16
PID 1924 wrote to memory of 3484	1924	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09adf72fcd948836f5fc2f7cbc0c7365.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:17410 /prefetch:2
  2⤵
  PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1061967[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\1061967[1].htm
Size 1KB
SHA256 ef937cca64d6388b3ab142d007d719040b2639ea8e92e2ebe5068c495488aad3
MD5 a003bf5aa6386d9b4537d2bc66d869f9
SHA1 a6498b127cabe7eb6826f635693bc6b49dbc2adc
SHA512 c80dac2822d9cc1f9f65e0d2b2608525c9d726bb42783720d7cbb33c8e360450b318c79fdefa4015ce160d76cfa410789d1bb88c771351eb528ef2950e6fc506
MD5 SHA1 SHA512

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

cb=gapi[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\cb=gapi[1].js
Size 54KB
SHA256 8ef9ab23ce9501b1f98a10a116c0b2e1f80a0f6fd3454d451b0b145b8c30319e
MD5 62a4936cb52e024ac92043874c633e85
SHA1 3dabd8fabf55105afe6ca8c2bb4b7408540bd278
SHA512 bcf006416e370b5d4f27b76acf9f54464d6c5fd477b96c3fbfbe4621fc332108d655baf0af761c57304ee4ca8034efef6f8731fba29d656c22d84733a30d183d
SSDEEP 1536:S+w/zcRjlqyv8UGOKxJYfH9m9wHrV3yEhmyMaIw0j:Blqyv5KyDRr0j
MD5 SHA1 SHA512 SSDEEP

Submit Download

analytics[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R977VUU4\analytics[1].js
Size 51KB
SHA256 de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
MD5 575b5480531da4d14e7453e2016fe0bc
SHA1 e5c5f3134fe29e60b591c87ea85951f0aea36ee1
SHA512 174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a
SSDEEP 768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads