60b057dcee51e5b7cfc32f9f5a7b9cfaad0a3039551b5ffe41865fb2d97f6b7b

Analysis

max time kernel
0s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rdap.html
Size

26KB
MD5

54757cafb38d6401bc84ef4d4c851236
SHA1

a03dc3aba1048f6c950304093e281be10c44ebc8
SHA256

60b057dcee51e5b7cfc32f9f5a7b9cfaad0a3039551b5ffe41865fb2d97f6b7b
SHA512

9d955184dc49a1c265aadedefb5b0ae6c5341cf91672b9c7a78a53cbe18ec1d626fff7a82f5fab53d292acd7edc28433872b91e59f5f74a83741be08f6eba433
SSDEEP

192:9Axrxv8UKdK5qrhka5SZ4t84gWiD16fAH8ejPjPBX7FtEX4lxlEQZlL79iCc5fgU:9Qp8bdK5qrOa64gh1TVRKoB9SNRg9Pla

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{58344A40-A941-11EE-A0B6-62C42074CD15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5032	iexplore.exe
5032	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4596	5032	iexplore.exe	16
PID 5032 wrote to memory of 4596	5032	iexplore.exe	16
PID 5032 wrote to memory of 4596	5032	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\rdap.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5032 CREDAT:17410 /prefetch:2
  2⤵
  PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...