Analysis
-
max time kernel
0s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 23:39
Static task
static1
Behavioral task
behavioral1
Sample
43c896d65dbc939f3cbd7f1fa8196f52.html
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
43c896d65dbc939f3cbd7f1fa8196f52.html
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
43c896d65dbc939f3cbd7f1fa8196f52.html
-
Size
34KB
-
MD5
43c896d65dbc939f3cbd7f1fa8196f52
-
SHA1
22bde8ae297c228ab15c3bc5553115e1084ed3bd
-
SHA256
e34cf9e341c3d0edc8a5c96b937210f227ead8367fafa85b65b60dd561b28629
-
SHA512
fe8ba8060791868126acb3a96eb822bd917de4233ad0dc62ef3e6474fe0aa3eafc4b8b53df4795a1e4cd3217f338728a6416501efeca830ed863bc0159b66128
-
SSDEEP
192:SIzarisRMLsCyp4NrSYgSGTuQpip2JtvGfyFDsXBmPvIaqgcBB7ErwaUvaut6TxO:SIci3sCyp4ATTip2yeHip2SXr9+isU8c
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BF3F7DC1-A44B-11EE-9963-FEBFAF1864CB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 8 iexplore.exe 8 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 8 wrote to memory of 5068 8 iexplore.exe 16 PID 8 wrote to memory of 5068 8 iexplore.exe 16 PID 8 wrote to memory of 5068 8 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43c896d65dbc939f3cbd7f1fa8196f52.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8 CREDAT:17410 /prefetch:22⤵PID:5068
-