Resubmissions
30-11-2022 02:05
221130-ch7lvscb8z 1030-11-2022 02:01
221130-cfxzmsca4x 130-11-2022 01:51
221130-b9x13agc22 630-11-2022 01:32
221130-byfbwaaf51 1Analysis
-
max time kernel
163s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 02:01
Static task
static1
Behavioral task
behavioral1
Sample
b728b6fa-ca97-43da-bf3f-13f86b8ee983.html
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
300 seconds
General
-
Target
b728b6fa-ca97-43da-bf3f-13f86b8ee983.html
-
Size
637KB
-
MD5
2d9fc73397ec9f722163ca97db847b68
-
SHA1
ba3dabc812f0e9805d27e750e2f041ac0db06a11
-
SHA256
1144f930260c12b3931b944435967789584da516d019578541b6877068fca3e7
-
SHA512
7348b5c4456b56d3678d8a8df7f66abde07acd0e4bc6414c661e9ef9e73395c7ef87f24451ac72ac64f4d6c173689e361bb57d18ce529f980920198d7bb035db
-
SSDEEP
12288:FKlxGaDKqDLoaZghNHbq7tp8dgJvrKoKiLGD:FKlxG4KqDLoBNHiT4q2iq
Score
1/10
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7EF7686A-705B-11ED-919F-DAB196BEBF97} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7EF7686C-705B-11ED-919F-DAB196BEBF97}.dat = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
iexplore.exepid process 216 iexplore.exe 216 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 216 wrote to memory of 2268 216 iexplore.exe IEXPLORE.EXE PID 216 wrote to memory of 2268 216 iexplore.exe IEXPLORE.EXE PID 216 wrote to memory of 2268 216 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b728b6fa-ca97-43da-bf3f-13f86b8ee983.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:216 CREDAT:17410 /prefetch:22⤵