Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 04:14
Static task
static1
Behavioral task
behavioral1
Sample
af62661de4ac71cac8a42e57bc983b038e25fc3bf96f8fd886d3683111fc1972.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
af62661de4ac71cac8a42e57bc983b038e25fc3bf96f8fd886d3683111fc1972.html
Resource
win10v2004-20221111-en
General
-
Target
af62661de4ac71cac8a42e57bc983b038e25fc3bf96f8fd886d3683111fc1972.html
-
Size
7KB
-
MD5
23ebc250a78438b5aab99bf5d9f92add
-
SHA1
c96d1e9c44500f524376321e5f5614f453d73bc5
-
SHA256
af62661de4ac71cac8a42e57bc983b038e25fc3bf96f8fd886d3683111fc1972
-
SHA512
776ad73eeece0c501c90ad30a641d5fa34adb55bc58f66ee95f664ba9d35bfdb32dab1c9dcf652e7ce6c7d9d8b185adc52b569bd636240ac2309b7eb207ffe82
-
SSDEEP
192:jJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLv:1SGabMPvLddLXuSwSTLdlLXugfo2Kav
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376045567" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CAD81677-6BD6-11ED-B8D8-E2CDD1D11107} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000007d1426947630f474a5def7da4aa27f46daa166a1f8ce588fed421f60b74230b6000000000e800000000200002000000011093f6b0b8cd620b61d5d5baecfcbfe4fecd19eb01a5c1acb34f0953386417220000000213d59ad6364ad61321832d6513ab2c23e56c20b50b09137ba17cee01d9b038c4000000078ca97151366701d930fd60822efdcc8ac2088a944dfc9af2c6785565a5037e2f30bef0a75833884416c2a51d126b74cdbee0e0819392840549f728130c219c7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f0000000002000000000010660000000100002000000064524dcfd278124b3459aaa16ff2b8f24275433ae69a4f1645810f65bbe72aa3000000000e8000000002000020000000f60d643ca0dcb565fe0d8bb16df87e2609f1ada78ec88e0fd6bb025a744c9f5920000000ad4745e8ff06ca7c7c2633fed2bbeb4f40c571034b867da721bb102181486f2c40000000e8a98ba2d79a02f6277a0d4685ccf7bcd7e6a8bf55150155f37dc0ab242747ae22ec612cfd4667868811f6e025ed008cc0eddcd9236454054952ff0616cf01bb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409368a6e3ffd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9094b2a6e3ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909949a6e3ffd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000008a9a49fd7bbb6427d6cca39c0a37c391f50af5f2fb38629f68d215e7e7e535a3000000000e80000000020000200000000e07a51e89a6d46eb0204d21aca28e043d16924ad441ae60cde4576ee90b706120000000c0bb5eaba7677bfca774f67b13677e5b8436b46182088eda97ff3051ebad586b40000000061d26944fe9be1e0f52a2982822bd3274f2555957d2433bafba59b5058ed980e0e43c1988bef0775cb1e8fdd83aeec964df07c1542d58fb47e560464eb9df06 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 520 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 520 iexplore.exe 520 iexplore.exe 3492 IEXPLORE.EXE 3492 IEXPLORE.EXE 3492 IEXPLORE.EXE 3492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 520 wrote to memory of 3492 520 iexplore.exe IEXPLORE.EXE PID 520 wrote to memory of 3492 520 iexplore.exe IEXPLORE.EXE PID 520 wrote to memory of 3492 520 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af62661de4ac71cac8a42e57bc983b038e25fc3bf96f8fd886d3683111fc1972.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx