Analysis
-
max time kernel
16s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
20dbe9540e9981c64bed4add93a2dcd8.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
20dbe9540e9981c64bed4add93a2dcd8.html
Resource
win10v2004-20231215-en
General
-
Target
20dbe9540e9981c64bed4add93a2dcd8.html
-
Size
48KB
-
MD5
20dbe9540e9981c64bed4add93a2dcd8
-
SHA1
38a6d877afacbb0f5ecdd967a657a0da074a9260
-
SHA256
19f69893a374358843b1a22351b393aa412582d9a1e532c810c8a4529290e07a
-
SHA512
5e2eb9026853f27cccb7ecdc05c020d3393e8782780d297c5fe3b8ca3431287e57368e7ffa0c55ed00314506a1917d82fbed55f3ad69048d1279cf524b894405
-
SSDEEP
1536:/pUzGA5p9+rshFqlgL1o0PvdyT7TFhv0zw87MXXn:xFA5p9+rAkT3vL87m
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FCE4747B-AB4C-11EE-8184-4643CEF3E9DE} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1308 iexplore.exe 1308 iexplore.exe 220 IEXPLORE.EXE 220 IEXPLORE.EXE 220 IEXPLORE.EXE 220 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1308 wrote to memory of 220 1308 iexplore.exe 17 PID 1308 wrote to memory of 220 1308 iexplore.exe 17 PID 1308 wrote to memory of 220 1308 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20dbe9540e9981c64bed4add93a2dcd8.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\platform_gapi.iframes.style.common[1].js
Filesize12KB
MD554af67fe8d3a396dffbb53b2bd9d8cb7
SHA193ae7262665699984e107c72b5fa3a408fa8a3b5
SHA256d87b3f1bc8a73cad7eefc7e5448230786c1ebd6db84ee6b0764c8dc57f62e75e
SHA51252e2049ee6bc227fc2ed79217ba7b75f157e512b23d94ad23655cb5e25b8abf920f4ff0e04f7ff64417bcc23ce768b03b0187a2af7594b3e00dfe658903a527f
-
Filesize
62KB
MD568a67ed26a62c4306647241df43370d9
SHA15d8f11f3d176189755b27acb72ea6636496f7d91
SHA2562fd740e2bab308b5d235a4bdf351f578fb02dcf01657d9b229d7730b78a09859
SHA5126decd476c7c71c897f1cd82479c3dd28038d2ea4940463c25ab810effda72d85769959a559aa61b48de84658762bbddf1557ddedce79669515d3cb3a27981873
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee