Analysis
-
max time kernel
98s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:21
Static task
static1
Behavioral task
behavioral1
Sample
84b145a4d41b40092c40982189ff2f09b4d207dff6f94c98c0d3930b870f2cbf.html
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
84b145a4d41b40092c40982189ff2f09b4d207dff6f94c98c0d3930b870f2cbf.html
Resource
win10v2004-20220901-en
General
-
Target
84b145a4d41b40092c40982189ff2f09b4d207dff6f94c98c0d3930b870f2cbf.html
-
Size
7KB
-
MD5
7d0197b59bd2af88281d687944710e16
-
SHA1
8f41d5d2181f3e7d14f6bdbd73b28246e20b7aa6
-
SHA256
84b145a4d41b40092c40982189ff2f09b4d207dff6f94c98c0d3930b870f2cbf
-
SHA512
a047e2256dbfc061bce7465602fd6314de4f13497ab1012136b8b02d4ce41dcdbc805f5bfb0eb049e1661817b08c0493f2004e3d537897f47a99c92a81e4cc20
-
SSDEEP
192:dJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLE:/SGabMPvLddLXuSwSTLdlLXugfo2KaE
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{437AA2C1-6B11-11ED-B2F2-7E6ADD856DC1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000815bc7be416fd92700a49c9fab7f6f5c9ce7739a0fbd8604e93209cfe1fe8a3c000000000e8000000002000020000000a5405e9ddd44abf7e64216d8a758a287f268bee61fe7680a9cc01a705fd43d4c20000000c56fe2314df223ddbfca51b74d509c47e28a17dd9797f1eaefd524c42483dd4540000000c2476a474ef8e8d9284975edeeaf3303f3f7d759d57bb2a454703411f83de9212c8324315650feecef2ed34ffae18b353f254e7be88b4294af9ab803a0daea43 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375960717" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20922c1a1effd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000001c9c9eac5dc4bbb09408c8743f74ec5a9ab3035d23b20b37e5c234411c829123000000000e8000000002000020000000bb068bca34ef8bd8d028d4738634f85a84368b30ad90d76bbb808bfc01fcfc9c90000000668b4e3e8fa71711d59d884e33a52b804ab6eb290d5b617e16369270427439ee88d2758d2038a615b3ee5f8e46f2063715dfb38a6beaca61eea71132eefb8d509b134d43ca1cf5409b1d6325d6431e6b6399fdd317e7fd9c05ab544810063de8b80e15a0abf7f00fca123d04e7db6a4c1c9eeb7790803a4f809ddde813840314c58dd759a95a57cd4b4d184e8eb21ee140000000a69f4e1ff00f902412a7f303fc63d6d51d7dfd7ed1709456944af14ac47585cf3a53a33f408618fadd99deadda3a05a09f5c47eb393f00195e8924434ff46dfd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1060 iexplore.exe 1060 iexplore.exe 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1060 wrote to memory of 1072 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 1072 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 1072 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 1072 1060 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84b145a4d41b40092c40982189ff2f09b4d207dff6f94c98c0d3930b870f2cbf.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HAOMVFQ0.txtFilesize
603B
MD501fa92655329cd546959cb49e90721fe
SHA1ff3c1221863cb716685baf353f0681e1636b9ce3
SHA2561f44dcfdfad2eb6f6e0eed5aa3247e4e8119d9ee308417685a5f2f7a0ec65d12
SHA512a5203c6fddb188470c6cf2a6e7c49619d349f62c289bcd36d94f07341f8b9f04eea7981a16eec6907c1c812b3fd7ccd8cf60841c2fc5dc17f4f8e18f678ded57