Analysis
-
max time kernel
0s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
f71f7cb8631032c6a4361a5f6cf3e165.html
Resource
win7-20231215-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
f71f7cb8631032c6a4361a5f6cf3e165.html
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
f71f7cb8631032c6a4361a5f6cf3e165.html
-
Size
3KB
-
MD5
f71f7cb8631032c6a4361a5f6cf3e165
-
SHA1
3fbf9860bbcf86470652dcdd5acc7d979d6d475f
-
SHA256
e1172d0bf9d853258a82cddf8fcb0f328dc34ab88ed36a59f2729841b945e4cd
-
SHA512
f4c5fcf82633eaa864755ea5ccdde416deb3cd82d85a0bd0753dba4ea21a8876cc431152244fe2e3726f1e7e08dc3d33ab651f304ff1291be523f0b801a6b1c4
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1E964468-AA2E-11EE-BD28-4E55496B34AD} = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1480 iexplore.exe 1480 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1480 wrote to memory of 3432 1480 iexplore.exe 17 PID 1480 wrote to memory of 3432 1480 iexplore.exe 17 PID 1480 wrote to memory of 3432 1480 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f71f7cb8631032c6a4361a5f6cf3e165.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:17410 /prefetch:22⤵PID:3432
-