Analysis
-
max time kernel
106s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:21
Static task
static1
Behavioral task
behavioral1
Sample
865e8bf0c25865d33c5262539f091425ec07cc38f51c216dc0c800fc4da3c0e9.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
865e8bf0c25865d33c5262539f091425ec07cc38f51c216dc0c800fc4da3c0e9.html
Resource
win10v2004-20221111-en
General
-
Target
865e8bf0c25865d33c5262539f091425ec07cc38f51c216dc0c800fc4da3c0e9.html
-
Size
7KB
-
MD5
bd061d951f26ebb1bbe7cbe6c3750b3b
-
SHA1
1111f71c9247d092c21d6a38c61eb11225c20b45
-
SHA256
865e8bf0c25865d33c5262539f091425ec07cc38f51c216dc0c800fc4da3c0e9
-
SHA512
a278e42608921d99d47cdfe0baf66c3da1a71f4e9779cb68f6dae82a660c721ae6cb96345ba282179b4a25987920d6c3ed40e9ff5586130a5b406462d4cf542c
-
SSDEEP
192:nJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oL7:JSGabMPvLddLXuSwSTLdlLXugfo2Ka7
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964244" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75788321-6B19-11ED-977F-FAF5FAF3A79A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004c0c3d4bd0e522428c91f366d68be2b5000000000200000000001066000000010000200000000a0b7860c56e5cb4b613340a2c73c871439b482d7fe0cc99ea1de0e51839bfba000000000e8000000002000020000000fd0d6f1f7ec55622fa7f4cee2c7d15490668693562f9e308846efbf97d5eb723900000009044cce160c169a88c4625abfdb2d9d94418e98868d06d08d8faa0fa6ddb1ff660d384c3c7f5abf16477c0e7eca9b80597c96e3d629815aefca7247ee4a18edabdd1580bfee3a307f35d3c21324fc443f6350b89bd6adbc5585c766c7a1e967c1263b39e62600b3944c40a6101106f5657bbb901d54f474b87a23291b20bc6a5f099ba5cb75a855aafb2f927cc2465fd40000000a8543ae2172fbd0a6c861a87ec33980d2af684b80614fd44b2b96e97cd4d27ee42a78e1474bd9c54b93c64c6d917cca4ae3752428a27dfd9cbfa55f1bc87d750 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004c0c3d4bd0e522428c91f366d68be2b500000000020000000000106600000001000020000000ea36bf35481e87d63ad9778fb14271a519dd1dc5ea0136bbd4e2b891cc042e52000000000e8000000002000020000000cfdc6233daec6ee9911c1220be1eff016ae3dcd530d743da0a16cbc94375ca2320000000bcc9717ce8dde9709552f033965fa018e12042f927bc138ddbc6148556262f9b40000000425df2ca41a232df5a44332e05ecdbbaca21991e9e07bbf4dfb261e4ad99c903a79679a56c60f0c5f422270ac3a0d98ff8f4230c873beb0df28424bfdb6d6a22 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501b5a5826ffd801 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 576 iexplore.exe 576 iexplore.exe 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 576 wrote to memory of 1324 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 1324 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 1324 576 iexplore.exe IEXPLORE.EXE PID 576 wrote to memory of 1324 576 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\865e8bf0c25865d33c5262539f091425ec07cc38f51c216dc0c800fc4da3c0e9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:576 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\POYCZSAX.txtFilesize
606B
MD500022be4733847148f6b40ee21a55fde
SHA14e2b699871465fc0405c8158b8ac23f2586c875d
SHA256fd95677b6da928e6a5591bc15866d8e21312a6735cb2b6757d164ff9a7fa7dc5
SHA512c24bb4211b4dd3f24cfeaa814021114caf213716ff9a8075890cd86aa82ef5f92f2301f3b539b4e30e050df15a44d569b3733c7b7fc941aabe0ade055bb04e38