Analysis
-
max time kernel
102s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:06
Static task
static1
Behavioral task
behavioral1
Sample
507323832b3594c8fed262dbe6a04c794b939b38ae6d10bfb6053181b3e3cc24.html
Resource
win7-20220414-en
General
-
Target
507323832b3594c8fed262dbe6a04c794b939b38ae6d10bfb6053181b3e3cc24.html
-
Size
9KB
-
MD5
fc4f3a428b494b1dfb74085d3635a91d
-
SHA1
09d96bb21dd628c24c45b7fc8055cfdb3e5e6669
-
SHA256
507323832b3594c8fed262dbe6a04c794b939b38ae6d10bfb6053181b3e3cc24
-
SHA512
d1bd9528b2b659fd575de336dd41010cf4c669fa717f0b4ed1346ea8d9a4de2304e03b0d71ce156e48c89ae9420ad51f2868992c0ba519f3e181294b3f418e90
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
IEXPLORE.EXEdescription ioc process File opened (read-only) \??\V: IEXPLORE.EXE File opened (read-only) \??\W: IEXPLORE.EXE File opened (read-only) \??\X: IEXPLORE.EXE File opened (read-only) \??\Y: IEXPLORE.EXE File opened (read-only) \??\G: IEXPLORE.EXE File opened (read-only) \??\J: IEXPLORE.EXE File opened (read-only) \??\M: IEXPLORE.EXE File opened (read-only) \??\N: IEXPLORE.EXE File opened (read-only) \??\K: IEXPLORE.EXE File opened (read-only) \??\R: IEXPLORE.EXE File opened (read-only) \??\S: IEXPLORE.EXE File opened (read-only) \??\Z: IEXPLORE.EXE File opened (read-only) \??\B: IEXPLORE.EXE File opened (read-only) \??\E: IEXPLORE.EXE File opened (read-only) \??\H: IEXPLORE.EXE File opened (read-only) \??\I: IEXPLORE.EXE File opened (read-only) \??\A: IEXPLORE.EXE File opened (read-only) \??\O: IEXPLORE.EXE File opened (read-only) \??\P: IEXPLORE.EXE File opened (read-only) \??\Q: IEXPLORE.EXE File opened (read-only) \??\F: IEXPLORE.EXE File opened (read-only) \??\L: IEXPLORE.EXE File opened (read-only) \??\T: IEXPLORE.EXE File opened (read-only) \??\U: IEXPLORE.EXE -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.paypal.com\ = "103" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\paypal.com\Total = "227" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\paypal.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.paypal.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.paypal.com\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\paypal.com\Total = "26" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "133" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd40000000002000000000010660000000100002000000094c2042e2f19316c22465d474c203afed30f4e5cd53bc9be64555bd0e58f3a2f000000000e8000000002000020000000654390c8d9171dc5dcb45d3f48bd7e831bdfbe12dcaf7ac3cea6049e224ffa002000000007f4867eb9c92a91d6cb233244f17bee7f751470ab94741450e7bcff82794407400000001a2cb1a0b39d32ad9edc26326ae76f858ef7bc9175e0828f1b66ef20e0f17aad2f0222192cd64569d034da214bf2e6d60153d90b5d98f98c1411638199c53497 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\paypal.com\Total = "108" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17A01941-D909-11EC-843B-FABB0CD78C51} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000f24d1de231d77cdabd5437a70285caa1d506ee0a7c502d90afcd787c339f503e000000000e800000000200002000000024ea0ce33c239d94ca8439c8124b22856574df1bafc3a74a7f3a7b201378e4fa90000000f3361a9590bf3244c05dadf0fb0b8ec7dc2cd4712046664a8230172a1dbd59084a421965d42da4e834f4e23c71d31f80c488c529a9106c0d25aa3b6bd58de8379b27622b0f47da7d5f4b6fe148d1c3b99b946b13b1785b65e0185516ff207d4bbb8718ee913953ad0cec4063c3731795f459533a6aa79067a753aeb94e86b73baac800737a8978500972b3cecbc5d39440000000b9611a3f0da69754300d55e97cbe70159d8aa75c7fed37ab7b36e3a9eed58100ebe5e73b491a7a7458ee31c9eebd814f4823b003bfd814852d60b97eff445eb2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\paypal.com\Total = "211" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\c.paypal.com\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net\ = "60" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\Total = "60" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.paypal.com\ = "26" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "108" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f360eb156dd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net\ = "25" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.paypal.com\ = "119" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359904342" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\paypal.com\NumberOfSubdomains = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\c.paypal.com\ = "108" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net\Total = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "168" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "26" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\c.paypal.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\c.paypal.com\ = "26" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DOMStorage\recaptcha.net IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1116 iexplore.exe 1116 iexplore.exe 1356 IEXPLORE.EXE 1356 IEXPLORE.EXE 1356 IEXPLORE.EXE 1356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1116 wrote to memory of 1356 1116 iexplore.exe IEXPLORE.EXE PID 1116 wrote to memory of 1356 1116 iexplore.exe IEXPLORE.EXE PID 1116 wrote to memory of 1356 1116 iexplore.exe IEXPLORE.EXE PID 1116 wrote to memory of 1356 1116 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\507323832b3594c8fed262dbe6a04c794b939b38ae6d10bfb6053181b3e3cc24.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1116 CREDAT:275457 /prefetch:22⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
60KB
MD5b9f21d8db36e88831e5352bb82c438b3
SHA14a3c330954f9f65a2f5fd7e55800e46ce228a3e2
SHA256998e0209690a48ed33b79af30fc13851e3e3416bed97e3679b6030c10cab361e
SHA512d4a2ac7c14227fbaf8b532398fb69053f0a0d913273f6917027c8cadbba80113fdbec20c2a7eb31b7bb57c99f9fdeccf8576be5f39346d8b564fc72fb1699476
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fd67f57e222d72a7b44251db3bf0c860
SHA188df32c62c1fcfcef14bea96ecf6eb63e5e39585
SHA25665a741df39c749665828f23ef9d42d46309fc28472db7a9f7760da8d402989ab
SHA512b7f222c4af8bb8f8ff9f8c43fa39d227277b1f38c159599fea6a1b62636319ad5c1151273aa0f2a30b6ed661ea238d24277de9ebda2b52a96a442e95bb3bacec
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\k007hrg\imagestore.datFilesize
9KB
MD50dc44b3c977d39c5cb2815cf9ed60618
SHA1534cba1a9d05a4a7850b8a09bde29fa22a9fa0a8
SHA256f08fc967fb223c81d8f62b58cea54ad0e1ea67c2ee4707ce14ab6b5ad422b7ff
SHA512893712699978a1f2b68158b65b2d93f4536b12f875f9bcc653d86d8b901a6a4411553d7f1a9d8ff77f44795195dfe343c5167032b1201aa747ef7ba10498f933
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QSKQ67RY.txtFilesize
594B
MD5a7fb0c47b831416de3855cc7f4bf148b
SHA137e570883fcf8af27551b9f216976f73b9018d57
SHA25687a0bc4ad61447971ae6743a337ae9f50d3866b574e79d9a77f393c046568542
SHA512035b49858cee470b7e60baf9c27146e640a293f149df36c7711c7812ea3a7e28d5ecb2aa30242b91467ab0e6ced08c2e79e4f37b4b7a91f157793ac7c82bf9ef