Analysis
-
max time kernel
69s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/10/2022, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
INV-901926.html
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
INV-901926.html
Resource
win10v2004-20220812-en
General
-
Target
INV-901926.html
-
Size
253KB
-
MD5
87a4e27f75284eda44b34b7a76524ca6
-
SHA1
3ecefc2833ffafa0ac48da02bb2036f8763871a8
-
SHA256
2134f796122f8a17b3f6f9d838cb11a705a44a47c732b81ba9ac982c65b966c3
-
SHA512
b33e8fd914188feb7ca293811584e9c5910c52e17bc5adda9121db104d8f34c40b45e744eb248810ae0d6a0950851d4ddc5166a907ba2c5a1c55afc81cf1f9a2
-
SSDEEP
6144:nrDYKFE6P/KlSwe1BBuCpFDN/mht1g+OQ9MKtL4TGDL:QKFE6P/KlSwe1BBuCpFlWng+ONK9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371763634" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006c4bf8f1d8d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BFBDF81-44E5-11ED-9201-42465D836E7B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000825c5ffb0d4fd5783f06646e0394610ce9dc83b8dd6cfb87dcb1e7f5831e2ee1000000000e800000000200002000000026183f16c23871e799322f02f01f05cedec8b02ed703d2eb6f331addbdd2b07790000000fb44550344fd1b5d7f5c5e2275e9b7acf390379ba904a03f7b18b8bb736c531075aa2c6ab4c5cd11fa590f0168f70cfd4621e3184dc97cec028215dfeed5f1d6b5e70f73a0358d4f69d55d8d7a7124a65204c41f5bca75acb124c5ef433b9fbf1a88cdb2ffed8ee364f15b29e15792e08935dd4d11d0d7f43c638f176cca9241c952449b47ab3c62ee5a31ff2482b941400000006c69c30823557579adecf2d802b928c28ec568ee996c1a280d31cd39ef1c670b4f23dfe27c887d1079017ff0d26e118c8d9910c21827564bb1c8095a767f5fa0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000002748284e848ca3bbf08b293a072cd04af48b126b0ac174e32967e140b7fcbc12000000000e8000000002000020000000526e2112a29cfdcb02245ddf6ad8a7297a6a637a8bb105b9d737cca57c6b978720000000ff5b20f824e1763076bf41094a1353e726b624b4abc758b7c52f6ff7b941d1e5400000004e8a88bdea7f4f35e439f4783fd53b4a40385d3282dbc80a170df10922c3fd8c8da09f3a7f1de328c32f1e7e636d52ae1072e837a28c091edfafdc72731e6dc9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1128 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1128 iexplore.exe 1128 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1128 wrote to memory of 1720 1128 iexplore.exe 28 PID 1128 wrote to memory of 1720 1128 iexplore.exe 28 PID 1128 wrote to memory of 1720 1128 iexplore.exe 28 PID 1128 wrote to memory of 1720 1128 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\INV-901926.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1128 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578672fc14737e7b1d2feb89ae1a87f4d
SHA1f635a873db8a3a2dfff630803c7c703441de0278
SHA256d5cfad0803d7721f19e476b9a3e6115e4c205911016240eeffc02fa3bf1806e6
SHA512a414d72b635c0f1ee11e2f55e0a6c15ddbbbcf2b33fec2dfd68782387393612ab2112a6aebe9b8d2d3b04e47baf1fd6a13174c05c3bab60c1255d6d3ac48200d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5679aa74b6f4e53a09d702b01ce6a900f
SHA1789a779c733e64a8c94f25ec8ced2fde05a8667c
SHA256b7996c169cf333d6543d637e10c90453b50cde3f9120deda81cb7ed2f4518eb7
SHA512d7d925eb35abcb75d0c6603eecea72dd8b9187935056cd6fe5f1bc557fb3619e3ea962b6a59db10668429b22b9e943dc9502434e887158d321c02860eafa9cfb
-
Filesize
603B
MD5945daeac4b66b9fdfebd4301532ab74f
SHA1f878df69d2938d4dea64d29a61fc0a519de40620
SHA256d8b55ecc60518ac02c35d0f172d25f7d23066ef4aad38ef26d8497159912d9de
SHA512bcbf9f55875f32ec970bf3bfe0cc42567e1abb9ec7b32ac8ec71bbed05cf9ba12926dbe9a77944684106bb6bb03daf804640f3eadc9fc980f04b055b1d1308d3