Analysis
-
max time kernel
281s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-09-2022 22:17
Static task
static1
Behavioral task
behavioral1
Sample
159da9373c6c34e826209e5314ff4267a8460d5d9293320679fd55832fb99825.html
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
159da9373c6c34e826209e5314ff4267a8460d5d9293320679fd55832fb99825.html
Resource
win10-20220812-en
General
-
Target
159da9373c6c34e826209e5314ff4267a8460d5d9293320679fd55832fb99825.html
-
Size
606KB
-
MD5
c8fa3c8d38befc5c96b4b25e9209cdd8
-
SHA1
057625d4cd8bf04ddaa7131b1136a155fefa9de5
-
SHA256
159da9373c6c34e826209e5314ff4267a8460d5d9293320679fd55832fb99825
-
SHA512
b176c6cd0073289550aa7b3a8e93f2fe1265dc10fc19209d826d3b9911e25a4a03d2a0eb867947039a27fb5ffbf4c7a0c9ef0f247133e2e4f7f6fb50fbdc1e62
-
SSDEEP
3072:aClpGTetRqXXwR8tAuwRuuV3iV1ytRNNTbWCUkPDlJtLn6CVhJc7MwaMyFeqmqD4:aClpGTCRqXARbRVZSvLF2RPthZdHMb
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000092969645148f226d54e4772ca3a5751a90eb7ba63411ebbaab0955f201be3b38000000000e800000000200002000000058a4c7b854e9c9a502ccad424855f852587ceeace766d91fddcf71bc8d0b850e20000000027d02a708138d56a9757bb181916f21bdc3f94d9f8d24494cc54b1da0c0cb3640000000268c5d12f53dff123d0d9b56bdce9a5df54872d75019c0131ac9111a74bc3bfdf596ad9abf2d6ed3ba4a52f65d1d8dfb5c86974d0136d6c51417f4414cde7af3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000aad5cf302ec43a0dee9ce0acf3fdedd2a27d58b9e59910218fb93884cd9c1298000000000e8000000002000020000000c36a3d590acc9a3a4855a2e1b41c702163a17f1a345b00ac4e4428a4660a606d90000000547721a0feb217a6e64b4eb5ff3d56a39eb37319881ac7d5b5b84cd2a48e2b72a3161d7c92416336b6be25c65b788589dfe36f387a8c2ef7350adc37b5a6daf0a412bc4d55ff196dca52bb495b0795fe0aec74eaeddcc5d7235338d9cbfdc6afa182a01b9e1c4e795a739bf6d06c45fd639a6c0aa5d230f8c7654e5cc81fd6fb2d3d6e0327efc865b46202f8f2d1d19b40000000c1fedf9ea9b9a03954ba33dff74c78e3554120ebc0df2e954885043df9153bafdff3881051bd35b5b07e14d9f4331288c56df9b46ad65d1459751a3e0a1b2f96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006cc25f9acfd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370736429" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86160151-3B8D-11ED-B2F2-7E6ADD856DC1} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1060 iexplore.exe 1060 iexplore.exe 1240 IEXPLORE.EXE 1240 IEXPLORE.EXE 1240 IEXPLORE.EXE 1240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1240 1060 iexplore.exe 28 PID 1060 wrote to memory of 1240 1060 iexplore.exe 28 PID 1060 wrote to memory of 1240 1060 iexplore.exe 28 PID 1060 wrote to memory of 1240 1060 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\159da9373c6c34e826209e5314ff4267a8460d5d9293320679fd55832fb99825.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1240
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5259910549aa6b07f1db853a8cd32ee46
SHA1057ac46a11694c441e68e63e34bec3749a127c0f
SHA2565440417f18d14eaae747c2099623a7679cb665db4ed4dafeea16f049d31255e3
SHA5126fb0c0c7a57d14adfe89ca2a5f0a56db5f8dcff50965cfcf350282490bd022c8ef495ed6686aa0844dc2aa4a80f2716c185b9b933fb4d824edd3608633822a77
-
Filesize
602B
MD5d1787dbea1ee01aea336fb8f563c8edb
SHA13414a7a27993738a10582652943902c6621ed3df
SHA2560dc44f9f1182a17341487e68f1b3c6573ea254d1ed2d9be6575eaa21e2f53fa9
SHA5123f3609865ffb61ec1ef118058da906e0168d2458e7b1a5ee4f2606d6dd66a8433e7e3db13fc52027de4e1184c875bdfce9700e39fc991ad9a97de6cc5201bc6a