Analysis
-
max time kernel
90s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:08
Static task
static1
Behavioral task
behavioral1
Sample
ff0cf589df766df160500652f7b1695013498ba038680a61cd307b600f9cfa62.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff0cf589df766df160500652f7b1695013498ba038680a61cd307b600f9cfa62.html
Resource
win10v2004-20220901-en
General
-
Target
ff0cf589df766df160500652f7b1695013498ba038680a61cd307b600f9cfa62.html
-
Size
7KB
-
MD5
5d8da5751546a030c38ccae5ed896212
-
SHA1
ff70cd962063f2d48fc3e23bf6b4fe393de146aa
-
SHA256
ff0cf589df766df160500652f7b1695013498ba038680a61cd307b600f9cfa62
-
SHA512
2c2e7c1d8319531fe400a5008667d5377f18c7c6bf2fcf523c9139616e028e3bae920079b9d02094c8b48101ef514e08d2ad705107a06d0542100dc9afe5db0c
-
SSDEEP
192:0JSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLEztx:eSGabMPvLddLXuSwSTLdlLXugfo2Kaqv
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008da899f6a4727e45b494dc6e8f5e053800000000020000000000106600000001000020000000f66f0682da079335269ab3d08074b56c23daf492f5ac2eb9ee6efb09abffeaf9000000000e8000000002000020000000a2a009d5ad655c60db3effe535df999b62f70a218201ab895bb8483750e5c8bd20000000e28860fc40ed88cb2986cb6c43edc3e8797a2d8d00d7d99da9bbde49069140f74000000046e8fedadae8b3d70e0b2ba1f1f53301043f09f36c065bb13092482abaf2d83c5bec2214e6ea1e55f8ce1420c0679d58e09afc510fa684859d662a093ecf15d4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304589c723ffd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963157" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008da899f6a4727e45b494dc6e8f5e05380000000002000000000010660000000100002000000019ddb6a3f4c5c69d1de6c074ac93c842738d51c59d07943ba15ff7d15d76cb44000000000e80000000020000200000008d6bbfcca1be2ee445799365e4f6f52677efe3620ad30895fd0658f6fb0cd8c0900000000ce645b63996ba9f62049f1c5b305494f6d592e64ef9b093c7bc15db177164baf8affd995da8b93b2946776f74d32271390e1398da8466183229fc445c70dfcee7a76e0e5b29a2d9c4ad419b98b2c492ad2298e3950ef3539a88409ebfb18fe2d1101b876b70612d2f88e1708fd38f395f0bf9632864055ca6d6b7deddc7b1b4a6518201938f3ad1cafe44bb3af6a9fb40000000ab7bac4aebc1ea14bbdc370e7163cc331b8496813f18e46ff896eeeae5e82ff42629f373a2bc768863bedb3e7eb777a00a5374607b4e059fe0dffc7ee09b3016 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F18437A1-6B16-11ED-A50E-C6457FCBF3CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2008 iexplore.exe 2008 iexplore.exe 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2008 wrote to memory of 1752 2008 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 1752 2008 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 1752 2008 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 1752 2008 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff0cf589df766df160500652f7b1695013498ba038680a61cd307b600f9cfa62.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DOA7X0DA.txtFilesize
603B
MD5c61b440c382ffe7d7cfcb2f37d3c5014
SHA1063abaa2ccfa9e7ce38518c0032afb7af8350f73
SHA2564675fbe11baa42b0c880c57fc3e7505c672daa936f37632307eb26bf8a6b6fa4
SHA5129d8d3d76f8ea3863cc20c8273b21fa3204217dfdbcd97314768c733470b1708f2760f710725ccf457b482c17983712e69ab47fa0f1d6d7a37ebb3ef580bcd5e3