Analysis

  • max time kernel
    131s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 01:06

General

  • Target

    71090a9f3f23b23d1d6fb2cdb20d5753.html

  • Size

    71KB

  • MD5

    71090a9f3f23b23d1d6fb2cdb20d5753

  • SHA1

    6f39b2300762f1c7aee462d01579abdc45aa168e

  • SHA256

    15eb40b1c8a2d827f5989c8176537004fe18032b574c78862bf80f29983c66e4

  • SHA512

    771e9e044e5bdbc270ca6883639eeba3f75f978ae69024cf5f59421cbc268e65f6aedd4b8c0bc2eed88f3e059db0d6e5b25b4c71e148fed4412c1deaeedc56a1

  • SSDEEP

    1536:nui6zHSXBaSz4Yd0qMnpsFK98tXeK98TOsmhI3h7Bdoy:ui6TOBX4c0lniFK6XeKY3h7R

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71090a9f3f23b23d1d6fb2cdb20d5753.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3348 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    f3990afbcdf64f1f806d1b926cf35b3d

    SHA1

    da1297f9ac1e9e9e7e78b567006e9248bfc212f7

    SHA256

    48c214dd545cc2718f7e844d699efae28f80d683340959e000bb41ad75dd6386

    SHA512

    9b5bc750b2e1038c82a93d51efe0d7dcf951ca594a62a90bac0ca1019d232afd07f9630e1ba1b609e128a9ba9c23c1ea8f1badd9e6b25f3eb591a936c89ee939

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    723944682206fdf5530a606fd66f0005

    SHA1

    0d436af0014f6a158d67d62f8df5e68251ffc0a0

    SHA256

    64014aaaf4503f2a85c5e64a311ae002f041517934152034357c061081fd463c

    SHA512

    7a534d16c09e3fa9913e8e4bf2c7394e564261536a336d27276a2fabc4c133786e546d3de8df3b7bc6490f1eb0569c8183e8666d1d22ea2f94714c3afbe55d6e

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC505.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0A013ETK\smartpromotion[1].htm

    Filesize

    167B

    MD5

    f5d40b7259645010f9a248858ad14178

    SHA1

    b3051d17a6ec8c9e166bf09a62b48261ab86957b

    SHA256

    7f5007068d2b56ea9735e2490d60cff2e72cae312024ac1f6c91158eba47d05d

    SHA512

    1e82bc2d067f726670b3e6054d73e57868f6e7c50eb979696bf927daeef699f2d8f8de201e8252b86b0e9f86dc69e5037fc9fa08ef6c271b033f29d4f0f4c1aa

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QPBAQNGM\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee