Analysis
-
max time kernel
97s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:20
Static task
static1
Behavioral task
behavioral1
Sample
8b27660e2e5e88e8c38837f79bcf55e0287b609abc448de59833fea74938d74f.html
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8b27660e2e5e88e8c38837f79bcf55e0287b609abc448de59833fea74938d74f.html
Resource
win10v2004-20220901-en
General
-
Target
8b27660e2e5e88e8c38837f79bcf55e0287b609abc448de59833fea74938d74f.html
-
Size
7KB
-
MD5
60b840b5627aed6d68ea4bcd006a3a80
-
SHA1
713bee225a6b7de199904a4c99ba02efe22d48d0
-
SHA256
8b27660e2e5e88e8c38837f79bcf55e0287b609abc448de59833fea74938d74f
-
SHA512
8b473a48c4e60664cd9342fa00687bef6a0708e8e8fb72daf15f60c3b4d98aabfb61fb830ef21d9a1dd34ea6d213b3e902ca5b9ed04aa2bee676ba0918282ded
-
SSDEEP
192:EJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLm:OSGabMPvLddLXuSwSTLdlLXugfo2Kam
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E675C501-6B10-11ED-AE24-CE372EDB0509} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000003984d5498a514143bfc4fba2694198f20fb12459b7b6cee0d7d36ad852e1ca26000000000e80000000020000200000000de0ac386b364c4a6145992af5d4c697c82e1f9049610aac83641e00250641942000000007153523c2b14031d2e2add6c7a65e1ff1f93bb33c2c0ddcbd9aa5c55e4e4d3d40000000c347adf70084aac9f7106dfc5afbe3ba75c144fba771381599d59822c816006ccce9e70d009ea2cb0334c0b0367b9f4fe1109398a464e18c33816116ce76ee17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375960560" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000073d834c1a79ac94e9d3fc2c79c7994439dd99229bd1b55f4e1cd12717b90c8a1000000000e80000000020000200000008b6d3fa873982427cddf1e592705f1f10c2f82f1857f4443a0cabe2c05a8b951900000004e57b171a96b08ba445eff6216ae59912fb8c29c4eef264dc0fccafc637c705a0729f079e8f775e1f4ab5d9e5a5868477891c099f9aa5a9429dd4824edb57078c628f20d79120b358952c41df88e75ed09ba2cb87662f418ac9b30807183ea651bd846b1669b14b91133b19a7f90259da1807d702721d8cc0c7ba4ad84d76056cdde6b2147b47abdbcae52e94f75ae5440000000f948a817f0d0c4ca643317a09a47141a1ea93fdf7e61d8330beae2f93e0313d6bd6e0b1e1af8b8c851c911479443e289bbf5f4c6b99be72a2713dcdebdafb781 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40491dbc1dffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1380 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1380 iexplore.exe 1380 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1380 wrote to memory of 1712 1380 iexplore.exe IEXPLORE.EXE PID 1380 wrote to memory of 1712 1380 iexplore.exe IEXPLORE.EXE PID 1380 wrote to memory of 1712 1380 iexplore.exe IEXPLORE.EXE PID 1380 wrote to memory of 1712 1380 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b27660e2e5e88e8c38837f79bcf55e0287b609abc448de59833fea74938d74f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1380 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NVB5D158.txtFilesize
608B
MD537861b0f1509655f1d12679f1e615776
SHA11037620399dbee8ce80f5a18b71d4df5f8716304
SHA2566920ef5168d16f7042c94a9e9f03b355370db1518de82d56aff3f49939eb42f9
SHA5123b4dae74cea70404ba274aebb2aa71b18d6f5ba1c63906b446f7253d67b7f9cd19e2ce0efd4c2633c47e1d7bd610caa2541a1708c2ed85b9d6da68742cc30cd1