58f0d2c9a1e933d1730e8ca4c384fd59e5dabd420c82760977cf6552bd14ec3e

Analysis

max time kernel
0s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

225712226a8b5c0934489b8f57530e3b.html
Size

432B
MD5

225712226a8b5c0934489b8f57530e3b
SHA1

3f6e2ac38b366fb699f0fde630cc51ce87ebf673
SHA256

58f0d2c9a1e933d1730e8ca4c384fd59e5dabd420c82760977cf6552bd14ec3e
SHA512

8d24f8be1ffe1230962826a143acc308629b2abd92e2bded7d441e5a3b3ae260ffdc750cf0adf04235ac9f293488fcb9da6eb5835eaa42ef4f4cc316f02612ba

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{34899DE3-A8CA-11EE-9ECD-76CF25FE979C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	iexplore.exe
4340	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2944	4340	iexplore.exe	16
PID 4340 wrote to memory of 2944	4340	iexplore.exe	16
PID 4340 wrote to memory of 2944	4340	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\225712226a8b5c0934489b8f57530e3b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17410 /prefetch:2
  2⤵
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\buhspo8\imagestore.dat

Filesize
55KB

MD5
4be2497671699fb3a70772ea07638c53

SHA1
21706f7971cf0e52082909808ed840d2d582e1b1

SHA256
977545fa00b4ffe4af8127473339244a1b31488be74110086e1aa1c0a689d730

SHA512
8aa6fc75d51bc4fed2ad5d9920495ccf07a516555aec104af4316c45160f48989bb12613b4b11d63965d68a0f1b611dd7f3923facc95f4050443df56d121272f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\buhspo8\imagestore.dat

Filesize
2KB

MD5
22e3bc529e5339bdf745e31bd3e01132

SHA1
4bedfda0c4f037272c16444e1620f4876785fef0

SHA256
53cfdbc5c7c5b7d9e9452c802ce1c15c7135cea48d7daa936c1897484f83521d

SHA512
90b0bac3bdb1d0efb941a71cb2f7b358282f376fa87f1c8c95da49fe63b7d111bcc4c3cdbd49379c2a115a4c5b79aba3b265b64adf196995bbe5f08efc411499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\favicon[1].ico

Filesize
52KB

MD5
f0a8acc314cb0006dc9ea2335f856f14

SHA1
6e7155fc3014bb1287d09891d1fec3dbc5f24bd9

SHA256
c895c96c4ff471e8bfccc608a6a808babe6b041533fb529d4d48d1cf2348cb93

SHA512
2f4eb01c04dd86915c90f4505549ce24c66584dc63d6d001cd87ddefc1ee2cb14724c6d677944195974b8e3ed4db95f458f89cbe7c22976bfb85b96d69d420ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\suggestions[1].en-US

Filesize
9KB

MD5
9ac9cecfa6b6fe413252f7be8033b1c1

SHA1
ff6d64e8a3891846a1f56365dbcecc943f19e17b

SHA256
a416fd4fb3e7e7a1505e271bd123bfb718e8609021ca1a82472ed655b31b8fab

SHA512
19596c84968b46839afa854247b3ae6aa150e20a68d596a87dc58b06de6cdbfe3de398af4957a891cc994b9fe0d28aa1240d77fa50ee32e7977b9fcf4d1b7858

Download Submit