8ead9c4b9424460b67e6863627fca1a463565736f57f48c0faa69c4c59b7ad82

Analysis

max time kernel
0s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42f0f9b3a5b96e12974a6b8456c2c4e1.html
Size

50KB
MD5

42f0f9b3a5b96e12974a6b8456c2c4e1
SHA1

14aacd8e1559e51b6fe87867b04e92f50832b0c7
SHA256

8ead9c4b9424460b67e6863627fca1a463565736f57f48c0faa69c4c59b7ad82
SHA512

f801b5d6d08b544ae5cc026e0c84ea39882f4050a8a18ea05727dd88ba9e0bbc04b4ea3c0a5c23cb672d5e5c50c2be2922135fd2b3aa7bcdb03ee09f18a19c5e
SSDEEP

1536:zeN5EWFbCiHFfIQDFP7iVnPtFcC4VpEHhm:KZViVnPLcC4V6Hhm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D55D16D8-AB99-11EE-9963-6A04C5405167} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4104	iexplore.exe
4104	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1564	4104	iexplore.exe	16
PID 4104 wrote to memory of 1564	4104	iexplore.exe	16
PID 4104 wrote to memory of 1564	4104	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42f0f9b3a5b96e12974a6b8456c2c4e1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4104 CREDAT:17410 /prefetch:2
  2⤵
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBEBC.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0A013ETK\f[1].txt

Filesize
34KB

MD5
306fb0b813b9206f465dd3a466978ce7

SHA1
e10b4d104b2d283f5243c0894ff18b7039f4a70a

SHA256
bdddc3dc3feb2985322ad5de7b1b93c431a59cfdd74449c0d37d2c25d8b59002

SHA512
649a20b7f7182be0cea75eaf3fd2cc03728fa33bc4757b1d4ccc38aea2e18e948201555d503df48eac70de0cab53a520ea9f2ce12097bc382493b882e5f6c152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0A013ETK\platform_gapi.iframes.style.common[1].js

Filesize
54KB

MD5
2f037334eb68fa44b5ba9e624aa71582

SHA1
4ceeafced9aa70e2f2f0417eaef90ca059dd1cf0

SHA256
21d15af6a88ec0e3474b26245634fbbe246d1451728c6930f4e966a9d8b3937a

SHA512
befb2849e580905acf1a1040c720ca3ae84adaae395562b2afe59695f9a3d6f18e6af5119168e041dc00041db3d77c09b65bbbc84d1fbbfe910c21e0766d4874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RVXHSNZG\banner[1].htm

Filesize
168B

MD5
82f04704c04c2706b1b96a73be2ff3a9

SHA1
8cd210a378b7f54ce8945cdf1c7ce1f696171eee

SHA256
ede97dbf06b3e703cd950b3591a29351ce9b24eccab58b1a913b3c7e4571bf02

SHA512
61f4e5ddd3d46293dc64151f21e249b80d5261b9cf1eb788aed2e399e80ca60fdf485736ee6fca57471b4b2b4ef8744aa52b59bf035ee922f2736fc87d78e94d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RVXHSNZG\cb=gapi[1].js

Filesize
46KB

MD5
c1f1c836619eef9adb003b0d06c82e33

SHA1
b1e56c43b3672f6d08c3bfdc6ff8fbfd407a6a19

SHA256
fc52ce9503626ba3e360b493b429126eacdb78d1247aeb743965e3eb6923b555

SHA512
e70af3a09c3b270779136c3e2fcffbad3283786e1b1032e7bf550baf84ec409e3f95eb0305eeb6624c23fec7e8c65d63c07a3dea7c845772b104b1ae2444533d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RVXHSNZG\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit