Analysis
-
max time kernel
254s -
max time network
345s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:16
Static task
static1
Behavioral task
behavioral1
Sample
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html
Resource
win10v2004-20221111-en
General
-
Target
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html
-
Size
7KB
-
MD5
034161009813265deadcc8d3113fd57b
-
SHA1
6242ffe46a6a3c77622262ad0bf6e701a858a09d
-
SHA256
b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9
-
SHA512
610ca3d1bcde4ad2896b4a7f3a65a5a5eed6a42464143a05a21cd519fe74c9b3e4d36a5d98065a5d5f00e3ebf809de48db2456d7695b02f4152f1ff8d4516bb6
-
SSDEEP
192:dJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLw:/SGabMPvLddLXuSwSTLdlLXugfo2Kaw
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000d01e9d1ed11386b50e4c1c614dfcb17f5e6cad2b5885d269951c5e563f41bcb8000000000e8000000002000020000000854f5fed8222cd2774f85cd74f38531a173a2473d28b73417706fe24a91eca07200000005a95fa2ff27ad12063272e5f9e6f103b0a8279a360b6d5aaa46f98d9b426c86e400000006677ffde717125004979c24617e0d18c9e7b33c096be15209818e4f4a9e9d3eb3af2cb2134b18a08802d19927fe8d646fee22f9ccaef5016a564e996cf722434 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000cdbb55728e356e7faac70d47312d86d37d10e8e6a8ac751f767be6313dd2fc88000000000e80000000020000200000001475b3cb58c990cb4bb19c60cb7a3ae90bfffb3ede9ada6279dd1a457968df5f9000000027f419f0c8b4226379dd3cd9c9b0c4d5ea5a3280ffffd75a72721946f7d2b5aecbdeb53e18c00d4d5730bb8d032b6ecc5a70e80afc01e3d49239c1056285247e3851fa82e2c31f3e7144ed95f1736b0e2ef1cc0805c9e267e7fa989b160350b26ec256b55faefa942575193a7e5fab3ee72017d7b3efd449387c51e8fac76f6799eb1bedde41f20b0bef603a3654b3c140000000c57ece75ca793bcd68a55977ec5bab7c92445b9cc2afb2bb7876c6b090e5d6dd3c0d9946de269c69962535ac103456e0095c44d92df49196c4b33a4857c6a6ff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d6c8d225ffd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964041" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4F1E4D0-6B18-11ED-90DE-EEBA1A0FFCD1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 268 iexplore.exe 268 iexplore.exe 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 268 wrote to memory of 844 268 iexplore.exe IEXPLORE.EXE PID 268 wrote to memory of 844 268 iexplore.exe IEXPLORE.EXE PID 268 wrote to memory of 844 268 iexplore.exe IEXPLORE.EXE PID 268 wrote to memory of 844 268 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4ef674fdb3f8a11e2c6935b7a070e9ddec69d7a332ca33a2801cf4d02fba4b9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UTUKOH1A.txtFilesize
601B
MD5a86e548ac7a86e111595ab4259248b19
SHA1079ef1780c446211b011872d9bbb2a1d736556b7
SHA2560082b38e26ae553541458c1de34b80bca38a66829b5a789f1182875357a138c4
SHA5127d1ad150ea07a7c4559ddb9ae7313efd9ad946be985ccc615421168d18adbe3da566e4b7c2279855e494ef36e6bdfb7fd0dfd47e5e3c9e445a8dbe6c6a5054bb