20a7b4b84870b2fcdd75cf38a124f0424404af53a62025aa67fd6d5301e12a3f

Analysis

max time kernel
0s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19322cb5b6c2ec67e9b2ee3a2fd4b09b.html
Size

7KB
MD5

19322cb5b6c2ec67e9b2ee3a2fd4b09b
SHA1

4db388cb7b3335547763dfee163b4e5bc8b3a92d
SHA256

20a7b4b84870b2fcdd75cf38a124f0424404af53a62025aa67fd6d5301e12a3f
SHA512

049b3305403b884aaa584656f15b4708fe4d7774d697275e76cbfba91d1d22100997032b797beded8e934daada1a2c7db0dc1374eb95215e9fd33b38882947fe
SSDEEP

192:PMOWE8yUSQ3Dq4lSm+EZqyErZ/uybMAO/6ImZ/TU:0OjUSWDqKSHRuZ6Z/TU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4FB06B5F-A82A-11EE-A0B6-FE6B1C63FCC4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3512	iexplore.exe
3512	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3612	3512	iexplore.exe	19
PID 3512 wrote to memory of 3612	3512	iexplore.exe	19
PID 3512 wrote to memory of 3612	3512	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\19322cb5b6c2ec67e9b2ee3a2fd4b09b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3512 CREDAT:17410 /prefetch:2
  2⤵
  PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\PUKZ1SMC\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\PUKZ1SMC\www.youtube[1].xml

Filesize
446B

MD5
c9475677affb99b4ba0238dfa9bc1fbb

SHA1
db12fa810a5c8a2d1965c4d8166155aeebb423b4

SHA256
15dfb7653677d6bedba5fdb23b0ae502dc8088210e1f3fc56ede0301ef835892

SHA512
973f524bc56a2b7af4d383e557316639fe6f76dbd7ee909e4e475f6e3d1f8adbfeb7d05cf63756bd87dd570d42d5950d906ecacea8e656b25eeeba92790a88fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\PUKZ1SMC\www.youtube[1].xml

Filesize
686B

MD5
2203eb53d0732b1243b2f1f578a2b49c

SHA1
da3f77487c37a4af0d0fa24b2184a153c3852ee2

SHA256
a45ea1ee70da76de227ac547e0a7b599b82ed47878c25eb2e9f84cd0929019f5

SHA512
9f62d9ba1346acdadb310d70f002010e045f440e818cc16a492dcd53cba3d62be4fa830c700fc92fa8ccecac7007c4d8df7587ae513015849fc6b789547bf7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\PUKZ1SMC\www.youtube[1].xml

Filesize
25KB

MD5
fc4acc035ebd81e901f42696829d9789

SHA1
43ef936bd30cb874eaf54bc0164c80d93ff58823

SHA256
e1c95d8d0d37fcb486ae59566097cb83f0e2b44ef4ccec4fdf838e5b8498de99

SHA512
17b99ac7e50c2cb295932a33defce9a5e9b74729e614ca3d8ded416220f756123d4dd0f2b68954c8606084427fd5ac83ff23fc34f1f0c00d91844963e3093b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verCE1E.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit