Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
4a69074d1e6e14d8b1fc1cc978bb76ee.html
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a69074d1e6e14d8b1fc1cc978bb76ee.html
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
4a69074d1e6e14d8b1fc1cc978bb76ee.html
-
Size
123KB
-
MD5
4a69074d1e6e14d8b1fc1cc978bb76ee
-
SHA1
7d1dc430daead544e5b2cf0045b06b44eab5e135
-
SHA256
fa55987a5366e8ce3dcf3c0c722a6e255a402bc7aeea22ab7a857712b40f0b9a
-
SHA512
2e23024c2cc5b59c4ed3939ff590e029ab9b7794990a2a3065017fbbb3a53f99c8d287c1bed9e6f6cf135480460cd17bb883e3f803554964656d7d731380a2d4
-
SSDEEP
3072:t7UcjvG8rMUcXmNRS713WwF1tb6wO1t8KNG9jpbpkND+JTPZ/M:LGXmNRlt8KNG9jfkY0
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5E5BF013-ADDC-11EE-AA35-E650309876D8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2836 iexplore.exe 2836 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2836 wrote to memory of 344 2836 iexplore.exe 15 PID 2836 wrote to memory of 344 2836 iexplore.exe 15 PID 2836 wrote to memory of 344 2836 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a69074d1e6e14d8b1fc1cc978bb76ee.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:17410 /prefetch:22⤵PID:344
-