Analysis
-
max time kernel
200s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 20:18
Static task
static1
Behavioral task
behavioral1
Sample
070320e6c928e85d1acce1bffb8e590904050fb57c43dfad637c33aaaa7d7161.html
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
070320e6c928e85d1acce1bffb8e590904050fb57c43dfad637c33aaaa7d7161.html
Resource
win10v2004-20220414-en
General
-
Target
070320e6c928e85d1acce1bffb8e590904050fb57c43dfad637c33aaaa7d7161.html
-
Size
312KB
-
MD5
7465af5610f88ee6188854de6141ed08
-
SHA1
a56bbd845af796a7f0018ccdd92c93536c2b4aba
-
SHA256
070320e6c928e85d1acce1bffb8e590904050fb57c43dfad637c33aaaa7d7161
-
SHA512
1fcab1dccf45ab708906023a6b4cdd3bae0ce55c9640043bb9137ed9320419ae835c92c9417ea2f1ceed3242e42b33b25c2fad0b5b07c2d5224a61320d84f6c3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "358303883" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02f5c9d875ed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000cf2dd58b78ee49abe29888ca26d1a5fec5f8e93184b08b6a422ba5a14e04d98b000000000e8000000002000020000000bde9e4b74adf470fab29878ea0f2e29b0db7db232c4c2f86cb6f307b5a8df22e20000000a3f90b79ad75e53ec64449bce150b3a5a9b53daaf43915ece41f2b0b0e6556f94000000014b967a1a4c7bed54d9f74b6879b6db5cc52da1c7473008de9a19a4b82e19799ab41be12279f8a53efbea62cfc5c06bb6489b4581fc2bdfe70c8e0e77807ba69 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000bf170093f3fb84cc60cacebb81d755d8c148eecc276f0fb9236406d66a4996fd000000000e8000000002000020000000d23841f38ed524c38188393b2581cd53406f879b9678fad1cbf81ca1bd451d4290000000375ca1d315f2b2470de31b2887ae1f41c385f7cd2f037138d3345d495cf166a45820410decf3440c18cb59f317ceae29bd4b3714ebc47eed233dea2880d2c981d34879b1fa041c5eec0efe8b65146ecc6bfb04ee2ac0e8321964a1da571440c4d01d299a2ccaaccf945c9f08505c64f3f8061f13e9d3d718b49f89f21676041fd485ffdf86d12949b8f00034c821291d40000000f1bb3f545376bc92894ff79914c2530c96fd1c41c421459aab9daeeb973046581fa73ae5389221174d81073a04f02645ff18e15bc9d2c0a04039e88f27b374d0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABF72B31-CA7A-11EC-AFC1-4E0428891AFE} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 940 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 940 iexplore.exe 940 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 940 wrote to memory of 1868 940 iexplore.exe 29 PID 940 wrote to memory of 1868 940 iexplore.exe 29 PID 940 wrote to memory of 1868 940 iexplore.exe 29 PID 940 wrote to memory of 1868 940 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\070320e6c928e85d1acce1bffb8e590904050fb57c43dfad637c33aaaa7d7161.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1868
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5b9f21d8db36e88831e5352bb82c438b3
SHA14a3c330954f9f65a2f5fd7e55800e46ce228a3e2
SHA256998e0209690a48ed33b79af30fc13851e3e3416bed97e3679b6030c10cab361e
SHA512d4a2ac7c14227fbaf8b532398fb69053f0a0d913273f6917027c8cadbba80113fdbec20c2a7eb31b7bb57c99f9fdeccf8576be5f39346d8b564fc72fb1699476
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a811e524c197250babda73a04e6f0082
SHA1861b807301b11e7e71008b4f1cd6db0621d6f3ee
SHA256181f490d7551b111d1453aaa81819f443373419781ad86070a0f815cf0fada3a
SHA512c2d307ab4f90cc8b3c6dde08c1e53c7f5f695da1a5a13360235502e195e14a018a70d1325000dbc46166204e0d7086ea4177441c23a26a0848f3e09650863161
-
Filesize
603B
MD55ee2d6ee96fad7608d16ac8dc231d326
SHA1e78b2da726d66c3a9e4a218d7f98ecd851fe1cea
SHA256d89a5c10c94a019cb9db8f6de7fbe592eb41e6ec957218ef15f48f97708c1664
SHA512a9d985d75e72987f459908f1c4a74a2fa9c285eb8e1c1c180cd7ebc8ea8da161245bf0c3f4b0836963e6cc34f385db3dca16f11e0eff47cc0a505ec4d42eb658