Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
4a6891d519b8988e2b6f37477f04908e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a6891d519b8988e2b6f37477f04908e.html
Resource
win10v2004-20231215-en
General
-
Target
4a6891d519b8988e2b6f37477f04908e.html
-
Size
57KB
-
MD5
4a6891d519b8988e2b6f37477f04908e
-
SHA1
8bd62c325604b9080e3bdb0b20d6f7cf0ebb39bc
-
SHA256
e21ee3522f6a95767ddb9e975d48db72b9a7f04921fd117ecfedf26a362ff689
-
SHA512
c4d70d1b1e609bc7368cb6e57f7fe3ea4317f981766d5b0cc9f392895f08f7c3b0cceb30d16417bf951282d4e77f3f58933d35c0de2cb4abfb5a7feff6ce8984
-
SSDEEP
1536:gQZBCCOdH0IxC6NFzAgFVLOr4rj6tTWTDbmh+GRfcCIxh+uxvdf0c67iZkTR/k0O:gk250IxrzAgFVLOr4rj6tTWTDbmh+GRG
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f2859d464fb564ea9e97dd009a434cc00000000020000000000106600000001000020000000e0d6a17e84df0bcab7b700ecd9cf257e33e9b0397db5ad7299034355088e6062000000000e8000000002000020000000fb1893a009c166d620022390106dd31e109164b3af0320b9acef88d9446620cb200000006512cbbc9e3c6d10596619a3245129920564d3439a4577c68d0ce0f0a5627216400000003820b9eb4f00e5e088b7b5670f8a2f5b8a46dbb67674aca0568bdad1aaa289f936952caaf34391277d0af41615106692907736fc0026eda9977111d666556821 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f2859d464fb564ea9e97dd009a434cc00000000020000000000106600000001000020000000b14e883264a18bcc969c295322fa25529997911e66e5c320bfd9888ec36f5473000000000e800000000200002000000043a1d41297e90af56e8634b4aa339919d69de11a5618460d7a66d9c3547d9be3200000000336b007ea5cfbaafe7c97252e90180214c8b3410534af1febe59589fa77e8c340000000b6ed6bd4e09926e55bcfc868401281e9fc08697c12c193fd563f9822472b256997f4a0b8d5870fb893819ed2e580d4b43b39dc572a442277431925b8500ee2b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3C344917-ADDC-11EE-BCD9-7E4216712C33} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0eb4d25e941da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31080937" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "282965118" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080937" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\website.ws\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DOMStorage\website.ws IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411452168" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "298766028" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "25" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fe6025e941da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "282965118" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080937" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\website.ws IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2144 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2144 iexplore.exe 2144 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2252 2144 iexplore.exe 87 PID 2144 wrote to memory of 2252 2144 iexplore.exe 87 PID 2144 wrote to memory of 2252 2144 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a6891d519b8988e2b6f37477f04908e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5787408cdfe6ed4d3c8cba1eae7fd5571
SHA144468bb9497fa6d78972ede4a966ba6ad765b0a6
SHA256387ff89957a48f57bb42839b3527cb545c674b3053824fa8868ed599f8847342
SHA512e358b27b1b7a3a39abf4d527527ec2ab6b92e9af0bf5d788639754fe816dc15dfbac49efa4d0549f34bc3e9078b422094a04147b094aad0b5274d4881c9f83d4
-
Filesize
42KB
MD5e57c81f3a17073a78a7c3c865f74f89a
SHA1587d7c955432f1e5a87460ecbf9086ae2589346f
SHA256e36f1f796e538f826beb42510edc0354133c61c7f711b827def7f91d3f7c8bda
SHA512630aa9dba2aee1125103954b093af8b24907d98761e1a9b93fb6f6c43abfec3afdf53825e3f12fc3cf87fa14855daadfdbc90b1e49b503fb2917599dd77daf52
-
Filesize
502KB
MD537c6af40dd48a63fcc1be84eaaf44f05
SHA11d708ace806d9e78a21f2a5f89424372e249f718
SHA256daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24
SHA512a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07
-
Filesize
841B
MD5e7afdc59ac3db2e735bca0105b3fcd6d
SHA115b9055b555854c519549aa4c01dca887191d945
SHA2568376faa9ea3b31a84f476ab14bdcd9110051f2e74f99d8a5459658d48a5e8cda
SHA5126f4dfbec2348bf4bfcce6f9282b227d92d905448aacfdce547a8bcd952eae2de820ce61a0b4fef85f8590512d455cfc20e315bb88b6528f28d618b9558643405
-
Filesize
650B
MD5ea5a5798612df63ab0532174aaf62634
SHA10f4713eef39ab07510d3703ef201885475ef0b42
SHA256ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31
SHA5128cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
2KB
MD5cb546f0ce2ca2505cbc9088d8a4592e5
SHA1d87b70b1a34f4313d085de80da3aa4e8845af904
SHA2560c3851f8f6d7b9dc63645a68b0db991edc9162620b9d757684a4a20206c458fb
SHA512b6fcd078f43082daf299a49646280ac3a30b91d10dcfaf8e9fb9e8317af417e34d45ae7397af9507d4101b7bcc58169c2f64adcaa253fc08204b98020b20b551