Analysis
-
max time kernel
143s -
max time network
188s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:12
Static task
static1
Behavioral task
behavioral1
Sample
d8800a2bf52584ac69dd642f3017d4e53251d93c1400bb92c676d96a4f12756b.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d8800a2bf52584ac69dd642f3017d4e53251d93c1400bb92c676d96a4f12756b.html
Resource
win10v2004-20221111-en
General
-
Target
d8800a2bf52584ac69dd642f3017d4e53251d93c1400bb92c676d96a4f12756b.html
-
Size
7KB
-
MD5
e4fcf9c4da54f46029505e45cd44e1e1
-
SHA1
c7e6a17536b020b3f6eaf19ddc0b77245d1d0805
-
SHA256
d8800a2bf52584ac69dd642f3017d4e53251d93c1400bb92c676d96a4f12756b
-
SHA512
a0b52d27ff12a853ac8dee5c383f192b5445c84ee4ec3e0b4730b568f6bf0adbb5d74223180c3bf186ea4e64334bf95bd2a34b2ac73aa6e94fd6e3fe71cf017d
-
SSDEEP
192:MJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oL2:2SGabMPvLddLXuSwSTLdlLXugfo2Ka2
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9088b5a624ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCCB2A81-6B17-11ED-A8EF-5A9C998014C3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000438c54f9bbbce4438508d1200e8ed33d426f18d5e2725f945f3ba38775f21fff000000000e800000000200002000000075c0c68e1b10b8b7e40920174e0f8ad98c51a00eb665dc4df1410aa22f2036e220000000c21539bc21e40fe58a5d80439940b3b3885cc1e41ef96af00df0df11d7adac1a4000000051f062959e1ea50aa38ccc61c96423e377d03c5be6f8eb43b32248ffc9177cc9691e29d7d2f3c6922f76b779d31321a6fe23d8bed9a609f26d7ce3c7e507c106 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963525" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000ab7b2bdcfd1e5d4842a3448fc4af4ce1d82a32e1b5f00136e9e7c7d5bf08230d000000000e8000000002000020000000e1df5319fd1d830089cc7d7b2f9b68700f5853a43307fb8427887d34218a47119000000015ae8ea44d9ff557de76eb5209214893d5da38281a2d827c6cb8d16244bc4fdfde6590cba340e6e5849040c837794599fc89e37ebccb40d63d64c0e2707a9cf0a60552d0eed0278a6305055b5151c13e495be58b51a34f933fbb132000077474dedbe85833d1f8f1cde37bf0a9d58623f4b0f8d81a448aafd158ff4aea4695a7053422eb7d952ac94530544c252e57e5400000008ac03112b9c218e1fc4b7e1b15cf029121100c24cf3e32d2bd76b72e4cb3ad2719041a5d533442ab9aeb127ef11548813f3cf8cb4cc5fdf7232f0a9929977fe0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1508 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1508 iexplore.exe 1508 iexplore.exe 564 IEXPLORE.EXE 564 IEXPLORE.EXE 564 IEXPLORE.EXE 564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1508 wrote to memory of 564 1508 iexplore.exe IEXPLORE.EXE PID 1508 wrote to memory of 564 1508 iexplore.exe IEXPLORE.EXE PID 1508 wrote to memory of 564 1508 iexplore.exe IEXPLORE.EXE PID 1508 wrote to memory of 564 1508 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d8800a2bf52584ac69dd642f3017d4e53251d93c1400bb92c676d96a4f12756b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LD6U99KW.txtFilesize
608B
MD53d4b86f60934f72d9705b532dcaa90c2
SHA1f15b8e81d7f97ed9263cc3ed7c2dd0c8f714a4ea
SHA2562fe9ebe76ee8bd87efdf17ea5be735d1bd1b6d6ac4c4328007685caee3a6c09c
SHA5125b15b328ab346ecbd0383c09735e8b6cb2d0709a6c8d559fe6b47d0c401de841b217653b50e10492c54e6828c91c7e42df872fbd26f8a2b5276de7326da067bb