Analysis
-
max time kernel
182s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 12:07
Behavioral task
behavioral1
Sample
IDAutomation.com HC39M Code 39 Barcode/Font Installation.html
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
IDAutomation.com HC39M Code 39 Barcode/Font Installation.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
IDAutomation.com HC39M Code 39 Barcode/Free Product License.html
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
IDAutomation.com HC39M Code 39 Barcode/Free Product License.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
IDAutomation.com HC39M Code 39 Barcode/IDAutomation Free Code 39 Font Manual.pdf
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
IDAutomation.com HC39M Code 39 Barcode/IDAutomation Free Code 39 Font Manual.pdf
Resource
win10v2004-20230915-en
General
-
Target
IDAutomation.com HC39M Code 39 Barcode/Font Installation.html
-
Size
3KB
-
MD5
da7e8578aa80ec5d1fbdfa86da6a85e8
-
SHA1
eefe3ad4ddffdc6101be2ef8355e437ecde0632b
-
SHA256
7e6db90c73fecc06146d73a75c8eabd5622c5ff19033e1f3960d27e5c8fc0448
-
SHA512
6ac7114c048a3117e3deda7a132fdc8da61f08dd5fcab0cbfeeda7b1728f33a51c7c3a759969715578e50deac50b5a0a3118c06b5a04a876b3523b38c1635c93
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DC743B60-6B83-11EE-83FE-7E90C1422BDE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DC743B62-6B83-11EE-83FE-7E90C1422BDE}.dat = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4164 iexplore.exe 4164 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4164 wrote to memory of 3504 4164 iexplore.exe 83 PID 4164 wrote to memory of 3504 4164 iexplore.exe 83 PID 4164 wrote to memory of 3504 4164 iexplore.exe 83
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\IDAutomation.com HC39M Code 39 Barcode\Font Installation.html"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4164 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
PID:3504
-