e0898ff6426eefa9ec4b3ce1fd9e47ecc2dacf6dbac270ea058dddc50e03de68

Analysis

max time kernel
0s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

220bb6a3f7e64ea34bc8516ccc8c56d8.html
Size

56KB
MD5

220bb6a3f7e64ea34bc8516ccc8c56d8
SHA1

b502c5fd6c7dfd02eb201eae326434b9d16d16e4
SHA256

e0898ff6426eefa9ec4b3ce1fd9e47ecc2dacf6dbac270ea058dddc50e03de68
SHA512

6f42dedb12174be66a39c5999f704cdd0e3f96cfe0a2e25ba3c936e7b418f8751b8ea0de65e60200f19bc383b022bc843e018305411f7267df997dcdb4e7c882
SSDEEP

1536:gQZBCCOde0IxCsHFzUXwkkXks5dS2h0bR8lUi6iL30WRn0vXqtBACQiX/Wi4wUxp:gk2M0IxJzUXwkkXks5dS2h0bR8lUi6iE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B86268C8-AB60-11EE-9ECD-FAD2FAC7202F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	iexplore.exe
2740	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4232	2740	iexplore.exe	16
PID 2740 wrote to memory of 4232	2740	iexplore.exe	16
PID 2740 wrote to memory of 4232	2740	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\220bb6a3f7e64ea34bc8516ccc8c56d8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:17410 /prefetch:2
  2⤵
  PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBCB8.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\js-loader[1].js

Filesize
650B

MD5
ea5a5798612df63ab0532174aaf62634

SHA1
0f4713eef39ab07510d3703ef201885475ef0b42

SHA256
ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31

SHA512
8cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\recaptcha__en[1].js

Filesize
18KB

MD5
1e90af2f05a5eeb0b81f5cd009be02eb

SHA1
2c020b1731601553d5c186ab5826c15c2bb62934

SHA256
301caae7dbd9e5be03fc45941ee3e66e27dd7774393b8e599f725cf10b8457a1

SHA512
256324bf3d9652a1aa94d66cab9f027a7561e2e339383162c74d4827376af1a7a1cb87c28b91295cb6c5ea093b21b431917d3f2a6860a5516f16b84bccb7017a

Download Submit