Analysis
-
max time kernel
149s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:16
Static task
static1
Behavioral task
behavioral1
Sample
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html
Resource
win10v2004-20221111-en
General
-
Target
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html
-
Size
7KB
-
MD5
034161009813265deadcc8d3113fd57b
-
SHA1
6242ffe46a6a3c77622262ad0bf6e701a858a09d
-
SHA256
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9
-
SHA512
610ca3d1bcde4ad2896b4a7f3a65a5a5eed6a42464143a05a21cd519fe74c9b3e4d36a5d98065a5d5f00e3ebf809de48db2456d7695b02f4152f1ff8d4516bb6
-
SSDEEP
192:dJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLw:/SGabMPvLddLXuSwSTLdlLXugfo2Kaw
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0097c8925ffd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f00000000020000000000106600000001000020000000375ddba65c04a72b61f6267ee5558ec5d9668734f242a868e63318781645ccc2000000000e8000000002000020000000427962190f3abfc3135f89fe0f1aad4a114b77e40e559273445cf3c6b8d7917f2000000061367c80096409e57f6656532d24680de67321e22cb1cf88f52f73ad81bf799640000000806dc0ed52f5b896ccc6e7a48c2cc14a11851ac1ce0782816398981480fc0c07b08066bcfcd46768510f8c41b26373a491b9b3433b0f3ef35080bed6a01dceb4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B1AC4D17-6B18-11ED-B8D8-FE1968EF3A40} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e060b69525ffd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3005cb9625ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f00000000020000000000106600000001000020000000d78686bae213f24f195e7302b445bface46fa10d27b50cb2d8f0247a3cc95c49000000000e8000000002000020000000087eba4a275bb6d6e923e04f965314d0ad5da0ebd77da8ed09db12254bf067ac200000000684269360bdb0cd2323bae79be00143c630a503810b1e263978e9bdaa2a29aa4000000034ca4437e474ea570079ea446f3779b72f1f505abf4fc3be0aeb9ea58f5971fe4095a059eceb194c5d5993cd7fdc0c0d4266aeefd994e831cf356ce9f861cff5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000000bfc1438840b082420e185275b5fe003b6b840efa2f06533f30379b96f60035a000000000e8000000002000020000000487d0c9399ef610593f778b6f1995249cb8777c6584c2415bd023428cd39a01e2000000042ea5d7e5e8bc2c5f55c1e97fcf11084e5d63222e32cd5a71c36f2056e518e7940000000dec41a367d5f4af82024658099eb8d19a956c69faa0b5550f7f42411608a9a35be0f1f96e2d93406ba2210a6c22ac8fefb8f0b5d0dcdbf148d41388380b13549 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4940 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4940 iexplore.exe 4940 iexplore.exe 3212 IEXPLORE.EXE 3212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4940 wrote to memory of 3212 4940 iexplore.exe IEXPLORE.EXE PID 4940 wrote to memory of 3212 4940 iexplore.exe IEXPLORE.EXE PID 4940 wrote to memory of 3212 4940 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4940 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx