Analysis
-
max time kernel
178s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
7061e63e561f1c647fffe397dca6a53b2f630cb9b12794750e17dfa0eca370e4.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7061e63e561f1c647fffe397dca6a53b2f630cb9b12794750e17dfa0eca370e4.html
Resource
win10v2004-20221111-en
General
-
Target
7061e63e561f1c647fffe397dca6a53b2f630cb9b12794750e17dfa0eca370e4.html
-
Size
7KB
-
MD5
d4c7ea1b8315fc22885a6ac1e533d29b
-
SHA1
74fa5821eea10e85c34a6b99807e1f51ab401bff
-
SHA256
7061e63e561f1c647fffe397dca6a53b2f630cb9b12794750e17dfa0eca370e4
-
SHA512
cce1ada8073407eb37d1a8caa363f613d50e132f47e393f254269e1da6f9f113040f603f203f868de98ee4b83143c7acd47b778bb127ae915bd8bae9d3637ae3
-
SSDEEP
192:mJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLh:gSGabMPvLddLXuSwSTLdlLXugfo2Kah
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23328AB1-6B1A-11ED-A138-EED7317926BC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964549" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6077f9fb26ffd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000002cddcdd341770703b31bd0fc751a9ab1532048a0c5344a390d5913d832bd98bc000000000e80000000020000200000000522ee9bac9c5ee3cdda8fa53b3647d40a04205f08a2f9f5cd03f1605233444620000000e3962ad2605cf03ceec3d86cc80189b72df09b0733eccdb15c127b008c9f563340000000e1b1a729855e358f2eee89db9ca5c45a2266fb2377d62ac554606546f889a9881873f606cbef7ed979f5f620ae2d4254fa9afeac1ece852bcec2fdefd142aeda iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000008d1159fdc52e1989288a67949b54a285ce0c5d727b0ffdb98be3c7c0b1ed6e22000000000e8000000002000020000000e8d06e9dc41c93897539f0c94abf1657d7e1fc773c224d2984c335337182943e90000000b217757b5b94474e3d04fcadc3bd60812c4d4481b12a3498b5523ef8deec970989d3c1ff849be8e3d08f7540f5aa6f2bd57834ede563b2052829bbad768cecea0b174ec22b14b0ddbf7bdc610d847ff622b3ceb7077e762225763bb5d596f1a8d7f05a77058bc740f642e3c13e7439c57120d3c75fb2c33684d7ad956e0e728f8225a0979749df4d045c34696705ad2e40000000b7e584c6b0eb09e1133ee3c373bcd0c739f5320128dfdcd03375a8943fa55bee6723c85ff903837cb61718676754de819520c74ed298429b10e8cbfab009bff1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2012 iexplore.exe 2012 iexplore.exe 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2012 wrote to memory of 1496 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 1496 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 1496 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 1496 2012 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7061e63e561f1c647fffe397dca6a53b2f630cb9b12794750e17dfa0eca370e4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BXCIOBNA.txtFilesize
601B
MD5684cdc543dc6fb6356452ccb70c94e64
SHA143dc2d1aeb124ee18788a14efba967a5f9dd1e63
SHA256dfce2b40ed10da6984c1c345f7c52a070863f4833699e5e0e8dfa6a43db9ab66
SHA512525c6994ffd72b26fa2cb7fad7e624c99cf449f448e95d79b4f8a7cfd06b065be3b0b4a6f927eab0690036ab51e5f236df27887c1403cab916b7b0313394aaec