Analysis
-
max time kernel
162s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:13
Static task
static1
Behavioral task
behavioral1
Sample
d3dbdf2ebde53aaebcba4b9a40afeabc5d1345c259e27aa0c3ea9df9d1c85d06.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d3dbdf2ebde53aaebcba4b9a40afeabc5d1345c259e27aa0c3ea9df9d1c85d06.html
Resource
win10v2004-20220812-en
General
-
Target
d3dbdf2ebde53aaebcba4b9a40afeabc5d1345c259e27aa0c3ea9df9d1c85d06.html
-
Size
7KB
-
MD5
24403e0df4be54845d20084aeea1ad59
-
SHA1
198bf7e2c7c9ed7995ccdab51c6b6cce0c024172
-
SHA256
d3dbdf2ebde53aaebcba4b9a40afeabc5d1345c259e27aa0c3ea9df9d1c85d06
-
SHA512
e8d8711ce5f6ffb9e3bd12183db550806d2a0d2e707e137358294e2f4c2493aa2248a9743486f678f510ba23f310d220368373be98c24468e60988ac9cd3b187
-
SSDEEP
192:xJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oL8:jSGabMPvLddLXuSwSTLdlLXugfo2Ka8
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f752ca24ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000007df4c030d6fd3ec7912f6060ab7f79baed2503337df64d10b83fb7f1646e68cb000000000e80000000020000200000004e834984ea3b2267d804fd766b959c258742307f2f1740644de42244683c8d4f90000000da2b5049822e64892cca34954bccd4553341873d569a6284c5305c3ab465fc1314de46ddb795922911707df28252ace0931a528868c9535f7cd90bb02de9db5ee6da4b6780edbed17e5ec7fafc0392d832e5189498a9ec46cbf447d1cb0058958e8af7d5163ababe8276853ddf989132981b5000cc607621ef34025d25afccecd027ec99198376932d425166a6fe188e400000005711f66ade49cd963c3dbcb5e4e9a613a2fe7bdbf34f6499453b12888cfc2b77b57c2cee15b3bd7f955fb29c1023063a004563a1c834918d959ca07853dcd056 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963599" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000a99be7f19fcb912bf66ccf7d9bd2b5ac80f8b041b4319e4f62f7eaf8deb65e2a000000000e800000000200002000000080615b9a5d84c0b50401ec8c6182eca12be1aa448a272a80de9ee98feb3a1d902000000069e4407132f6fc4dcb9fef474298af5e21b8d41439a584e414d909c06c1dc1cb400000006101d501ee5519d9314db7bda68703eaff11fa53c3b6b53318babd05f28d65218ccb9ab9bc7666766600530a9c26c548ee93af4c4674990cb834c67cf2b258ed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EED35AD1-6B17-11ED-A306-CA7A4AEEC1E8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1584 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1584 iexplore.exe 1584 iexplore.exe 1556 IEXPLORE.EXE 1556 IEXPLORE.EXE 1556 IEXPLORE.EXE 1556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1584 wrote to memory of 1556 1584 iexplore.exe IEXPLORE.EXE PID 1584 wrote to memory of 1556 1584 iexplore.exe IEXPLORE.EXE PID 1584 wrote to memory of 1556 1584 iexplore.exe IEXPLORE.EXE PID 1584 wrote to memory of 1556 1584 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3dbdf2ebde53aaebcba4b9a40afeabc5d1345c259e27aa0c3ea9df9d1c85d06.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1584 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6F0SWPT8.txtFilesize
601B
MD5f648c32d4ac501bc1e7e55821d2fad4a
SHA13c32472f37590ba42bf59068af18d7ba4641671d
SHA256fba14ab0d95bd0340c11f48795df5f65312f35483c2d3de5d5a298576c707e10
SHA5126d68e268cd5cf02c2368bd6558910dc2fb1520318660ac4dc84b82e0ac1f7524592ee1f66b8ec41b20b3626bc7a88028ff1ea284a9aee52dd1e57d179793a583