Analysis
-
max time kernel
121s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:13
Static task
static1
Behavioral task
behavioral1
Sample
ce9165396be648201458950f9a090c959047b1a5505e11a902787f319a07f56d.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ce9165396be648201458950f9a090c959047b1a5505e11a902787f319a07f56d.html
Resource
win10v2004-20221111-en
General
-
Target
ce9165396be648201458950f9a090c959047b1a5505e11a902787f319a07f56d.html
-
Size
7KB
-
MD5
b5b0306b0a2e03c4c5bc930f3c462a46
-
SHA1
8f53bb4579ff1416236182d833e91ed75a59f5b2
-
SHA256
ce9165396be648201458950f9a090c959047b1a5505e11a902787f319a07f56d
-
SHA512
34433fb8e472837e4d29f8d50c2969f430af6eca2e99a5950aa1f0411ffbac549271a218b0565d576c3f0be1507d4fde3c831c4d3d3fb3c2cf983e1b5fffa000
-
SSDEEP
192:xJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oL7:jSGabMPvLddLXuSwSTLdlLXugfo2Ka7
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcdf1566de37754e8b4161b444c0562100000000020000000000106600000001000020000000a686d5471fdac6e6d61aaf1933cd3ee2797e0372819b548cb8d07b545cb539e2000000000e8000000002000020000000340d8160045c19346f940b78974e862c3f211b03c1569a72078c96af0510ff58200000007efe1e0411925a6d09c3a077d9bddc054e71adb937b49ba5464ce3b16971ac5040000000f415391447ca18492a35b929932ebaffab0c1b2d6cc99ff70a0a9393de41879ee049ce16dd02e0ddfbc36bac51dcb44a8d570ce644341664b8ccef554bfa53fb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963604" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF8EABF1-6B17-11ED-A6AC-DE5CC620A9B4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603e50c724ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcdf1566de37754e8b4161b444c056210000000002000000000010660000000100002000000057bf8f1c06ee680589d048687fd4235cb71a8803c32a97dc0296c6a049705f07000000000e800000000200002000000055ca72c0888006852948840fed3164951dffc913e5490d114c4c104a0bb7c96990000000da4f60f45c91ebe30a35e078e47b2ed08df4c8d596f405370be218ce33019acc4f09af25583073643de45f077f1433ba4bce4255a009dee1f06e8a970abdbcf50231ee5ee5692f24c832c2e03c79d40b06d52e8f1288766ef2d0b9cf68a01e34a35a05d55221278130988592b8e6f8bab84dde923e7454af37b79374eabf028c24df208a299d7b4468300c54a81295f440000000b041b686ac96b1c0cf69778fb01a4d4422e90bfba78bdd98253745843d533770e715a3f5252d577e8e99fb981a0b93a16e3c026151b58fd49a1731e2f156c25b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 328 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 328 iexplore.exe 328 iexplore.exe 1488 IEXPLORE.EXE 1488 IEXPLORE.EXE 1488 IEXPLORE.EXE 1488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 328 wrote to memory of 1488 328 iexplore.exe IEXPLORE.EXE PID 328 wrote to memory of 1488 328 iexplore.exe IEXPLORE.EXE PID 328 wrote to memory of 1488 328 iexplore.exe IEXPLORE.EXE PID 328 wrote to memory of 1488 328 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ce9165396be648201458950f9a090c959047b1a5505e11a902787f319a07f56d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:328 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1488
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
603B
MD500d07e820394296df1af342ff409c3b6
SHA1ca24cdc0349873fa35f5b286bd8edf229ca7ed1c
SHA256956ffd1551ca81e84a6756496cdbf87eebae9e68bbac365d12ae738f9d439a34
SHA51236bf44c8143dcbced1aba8d5e07ead4a1268d67d73e00e29b31cd9f2e4c4f76e30b56335660fd8ca0d12a8208fde84a5f9a2b6555b0c6bf18982c7d1c72a2fea