1d4462cd46e36f812338ce9c33ff3c79c982311b8e9a4e8a71f34a4f58b8f34e

Analysis

max time kernel
0s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b269cd2b929c402e3e076936283a209.html
Size

22KB
MD5

3b269cd2b929c402e3e076936283a209
SHA1

ceca46414ac09eadf9a1e3ea19b6836bcb4b638b
SHA256

1d4462cd46e36f812338ce9c33ff3c79c982311b8e9a4e8a71f34a4f58b8f34e
SHA512

599a3ebcb318f4d6e712cddafaab92d1849ffe3ea43783b91c38ae2a6b5c605fce658a045df4d217a9831c19a448026d11d8f5b2f67b58ac6d0cef2dd4e98e88
SSDEEP

384:F8an/6b9ehnflvP5LESGKDqiSiDfQ3anVc1GGKqM2SGKmwOw8aEwnAfGKnskkUgF:F8an/6b9ehnflvP5LEpKH7DfQ0qzKqFw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D9DFC7A6-AC2B-11EE-A0B6-62C42074CD15} = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4092	iexplore.exe
4092	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2996	4092	iexplore.exe	27
PID 4092 wrote to memory of 2996	4092	iexplore.exe	27
PID 4092 wrote to memory of 2996	4092	iexplore.exe	27

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b269cd2b929c402e3e076936283a209.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
1708ef6eb76b2578e959be48e7e5a545

SHA1
566185c4756f8ca20bdafa330af03f679979e2ae

SHA256
e842177f8dea3a4b7f0807a3903a6d84b4c2bcbaea99e60613fdd2868cb54df3

SHA512
52ce23c8d2ddb4cca7e99bb5e4cc77ba93365bf70cb0e07b7a845affe276cd340a8401f8a49732aa15374b559932b285f6bb5c049909499d6f6cea051f409cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\W7SL0F8T\avgle[1].xml

Filesize
84B

MD5
b7947c52e065b8a1342548ee63d9ed3d

SHA1
4623256835d44cc2dfe8d02efa8ac090d743af39

SHA256
a00b6fd736c56107872006c369d9bc761fc0d9ac2bbba077827458302898c2c9

SHA512
c2dd1dcf50bdf7dcd35da186a472e86e3469f61c1473eb31f0c6538565c1a90104495407055741ad8cde6d130b690a602335206b1941470ec5769251805aac3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit