d4bfb1ab671d66ad9dbac10aafefe72ba8b25176f9dd0114281b37e9587a1fb9

Analysis

max time kernel
0s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/bot_info.html
Size

7KB
MD5

f4576e3b46b8b2b2a2895f31e24725d8
SHA1

d9bab50e3aa2e9679fc4124dd7388ec469d739d5
SHA256

def0517983ddc746be3efb3997421e656986a8eea1e83659ba7c81aa422c08da
SHA512

307b3f07e73c4b1abdf4763a7a619eab10b04ad4ec330e4923c921e0d8698c0f212931a67ad24d28d9c3e38ffb679ec234916121cd76ee01f3e35e8cf6b43b91
SSDEEP

192:MQM2xofWBxMSaxPFFrCg/ROXD28USCDG99:MIKI229

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{063F567C-AD14-11EE-A0B6-6EDCCF833886} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

iexplore.exe

pid process

2800 iexplore.exe
2800 iexplore.exe

pid	process
2800	iexplore.exe
2800	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2800 wrote to memory of 2156	2800	iexplore.exe	IEXPLORE.EXE
PID 2800 wrote to memory of 2156	2800	iexplore.exe	IEXPLORE.EXE
PID 2800 wrote to memory of 2156	2800	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\www\server_www\rootMD50MA\panelcGFuZWxleG9kdXNvY3Rv\tpls\bot_info.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:17410 /prefetch:2
2⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads