Analysis
-
max time kernel
120s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:15
Static task
static1
Behavioral task
behavioral1
Sample
bb9f0efdfe9c476535862a3e753c47b89006f62bd22468d5f262d2519a1e8e58.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bb9f0efdfe9c476535862a3e753c47b89006f62bd22468d5f262d2519a1e8e58.html
Resource
win10v2004-20220901-en
General
-
Target
bb9f0efdfe9c476535862a3e753c47b89006f62bd22468d5f262d2519a1e8e58.html
-
Size
7KB
-
MD5
ea01863059c643b98f44e87fb7f9fc5f
-
SHA1
d0ec98c21a6d43e7f01d69215583efc2d1a43db9
-
SHA256
bb9f0efdfe9c476535862a3e753c47b89006f62bd22468d5f262d2519a1e8e58
-
SHA512
ba2e048ee6bb8f48f60f9c6790b10d81804672b41e57ec7ad8790b58a0568c92f4d811c734914ebacf4adcae2c840781e76e5ad85ec558e49a829fedb17b58ab
-
SSDEEP
192:8JSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLE:GSGabMPvLddLXuSwSTLdlLXugfo2KaE
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100ed03525ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bccceca3bc14d343b20b65f43b787c300000000002000000000010660000000100002000000039ceb75c4b7a539e0108d549d9ccb7916c5501d9400e9bed6995ee0fa1cf2af2000000000e80000000020000200000005e6bb9152ae4d698711b632e25e84db1efb9460e8d94e87b98986a4c9e506c7290000000f2ac394491d38e459f21636f87ee19c217b862b1281aba0c973237269efa036a9efe49aebab2210c12d94c17e36416ad0864a860a5ca680cab047fe2bf5fec90184eb3fdd2135f5424ae05c954eb2433023acc317de44e4a7758e152c1854bb703845c802e62adbc0b3268dc7b19f13e34b8be004ac0614551171a302454e48d615e83938733bc5b7b20973a3e5ab7bf400000001c1347470d8a79e49de71bb7e2b9393761b57055f3bd0b7bc956a037a79b4eb1274003172174a7a388c3b13244df799a8cc1bbae4574c85073884e0ad0dba141 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AD8DBB1-6B18-11ED-A964-EAF6071D98F9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375963763" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bccceca3bc14d343b20b65f43b787c3000000000020000000000106600000001000020000000223f48bc3bd87c79d9b70f18f37ad01204cb6fcd8cdf69981a307901935b5fe0000000000e8000000002000020000000d5394abb249ac5b956608cf43af8d2b0ce572477f48d5c168e64ec36c6de03102000000014f036e39cfb99c6e80368623b669667618f8ff92dc9d6e314014bb41f671356400000002bf044e6ce0a1da4dbf2472700428e9e337eb541cdb69068e9c5baa602b7db4724e03aa478d29943e37fd726d65dbe07e957d704894970d88aab0776a3074f05 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1112 iexplore.exe 1112 iexplore.exe 272 IEXPLORE.EXE 272 IEXPLORE.EXE 272 IEXPLORE.EXE 272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1112 wrote to memory of 272 1112 iexplore.exe IEXPLORE.EXE PID 1112 wrote to memory of 272 1112 iexplore.exe IEXPLORE.EXE PID 1112 wrote to memory of 272 1112 iexplore.exe IEXPLORE.EXE PID 1112 wrote to memory of 272 1112 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb9f0efdfe9c476535862a3e753c47b89006f62bd22468d5f262d2519a1e8e58.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3OM5DSK9.txtFilesize
606B
MD5977f7e49d256210d46748da1d6e318cd
SHA158e77df6f40ca1af2f5bb4dfcfb87ea696063e68
SHA256431736850a64c57f7bbb97b79a2cf09644d2c4e098575b13615f30ecad59fd39
SHA5129e0203fc4d1c8f91d87547f1de4463a362a1933b7548cf38eb8dce10c2a739b1e4a4c107f372994cfe6dce227f7aded8ab6b7858c5557487a76ab05feb15cd55