Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:19
Static task
static1
Behavioral task
behavioral1
Sample
9540140d8764e8d66cacfb7c5f47cbf75b64e9056a697580ff55aeeb6c465dcf.html
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9540140d8764e8d66cacfb7c5f47cbf75b64e9056a697580ff55aeeb6c465dcf.html
Resource
win10v2004-20220812-en
General
-
Target
9540140d8764e8d66cacfb7c5f47cbf75b64e9056a697580ff55aeeb6c465dcf.html
-
Size
7KB
-
MD5
4f0793b8678b6ea90ac8ee54759ebcb8
-
SHA1
240b2a27aede4fc45f89ee7d0bdedddffaf0175a
-
SHA256
9540140d8764e8d66cacfb7c5f47cbf75b64e9056a697580ff55aeeb6c465dcf
-
SHA512
606525e5c0ebf80e7d51eff95fa254900d19b6f45ae08f40649337b17f1a22e3575fb53477e8b3c134576bf059704bdb0b95c32a2c4f31315fe0aa81502adc6d
-
SSDEEP
192:TJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLj:FSGabMPvLddLXuSwSTLdlLXugfo2Kaj
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{25E7B3FF-6B19-11ED-89AC-FE977829BE37} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{25E7B401-6B19-11ED-89AC-FE977829BE37}.dat = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
iexplore.exepid process 4984 iexplore.exe 4984 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4984 wrote to memory of 4108 4984 iexplore.exe IEXPLORE.EXE PID 4984 wrote to memory of 4108 4984 iexplore.exe IEXPLORE.EXE PID 4984 wrote to memory of 4108 4984 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9540140d8764e8d66cacfb7c5f47cbf75b64e9056a697580ff55aeeb6c465dcf.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4984 CREDAT:17410 /prefetch:22⤵