195f49ca1f3589b88e6babe9c51e44e0cc5af2f35edeb13ba5dda0c5f93724a3

Analysis

max time kernel
0s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ad8be939a1dc64ca627e2bc320f4744.html
Size

3.5MB
MD5

3ad8be939a1dc64ca627e2bc320f4744
SHA1

65fe758ef08b446647f63ae26cf7f253dcdfd067
SHA256

195f49ca1f3589b88e6babe9c51e44e0cc5af2f35edeb13ba5dda0c5f93724a3
SHA512

a01bb94195b673af0c62b7866293c7dbf105d387a64dd15902b899d2951ea2b67bb4ff31db5875063b0d5cc46070a87195d072dd8ce35492e8dbf459447a930a
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Ncx:jvpjte4tT6ax

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{60CAE5B9-AC25-11EE-9ECD-76CF25FE979C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1568	iexplore.exe
1568	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 940	1568	iexplore.exe	13
PID 1568 wrote to memory of 940	1568	iexplore.exe	13
PID 1568 wrote to memory of 940	1568	iexplore.exe	13

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ad8be939a1dc64ca627e2bc320f4744.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:17410 /prefetch:2
  2⤵
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD050.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\suggestions[1].en-US

Filesize
8KB

MD5
9e8984ea88f32dcb9794046e037fb502

SHA1
3bd419d5d7de9b26a084ff24956504906cef4c79

SHA256
a9a4d60c91d25e2d791bcce9bd46be9ba6ea37d2c355285eb58c389a3368e81f

SHA512
496cd15429228baa0599582db48b439d0df435eacdb7379d99a66714d56a9f2dc789c3b1e61408abc9bfb0514b50a22c835dd4c655a0622b638b375e6efb97ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\jquery.min[1].js

Filesize
4KB

MD5
1aa15b9228d73a360b3bb7a6ea632ae8

SHA1
8a48150b7234d3dea342d6ccb870f51af042245e

SHA256
7eee141ddf483e9c4d6c9ca6170a0e6643379cba3365211f3ed520be8e181aa7

SHA512
7f229883cc877b443dd9c83d335c80bff29290d839c065c64430c5d75f8fbe377fcbd9cae654417e1a48d1e49af93dde80c027cc4e8ddc34cfcfc34e9c139652

Download Submit