Analysis
-
max time kernel
186s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:26
Static task
static1
Behavioral task
behavioral1
Sample
518d532a90b06d6c858adea260d53a22e1251cc5bcbe9c5223ca30f9e0cb53c5.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
518d532a90b06d6c858adea260d53a22e1251cc5bcbe9c5223ca30f9e0cb53c5.html
Resource
win10v2004-20221111-en
General
-
Target
518d532a90b06d6c858adea260d53a22e1251cc5bcbe9c5223ca30f9e0cb53c5.html
-
Size
7KB
-
MD5
8ec8c287f6adc5dd0e5b761e26667614
-
SHA1
7250825edb349047f7344c498675595a152bd7c2
-
SHA256
518d532a90b06d6c858adea260d53a22e1251cc5bcbe9c5223ca30f9e0cb53c5
-
SHA512
b1e18e3a042fed2c6e3dd4077bc1de2000aa4026144ee9f119cdb0ffd5d1ffc76d37a06e96ce38b985bd4d78f3ceb4420e98faa46915fd5b829d3af88da137a2
-
SSDEEP
192:sJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLr7:WSGabMPvLddLXuSwSTLdlLXugfo2Kar7
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d055db8927ffd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000e8ea56ec58783e4873ece1d733a6400bbb534875fda7d248a04e40afe0170be7000000000e800000000200002000000037dedc79f7a9c20064a8171d776cf59c994e7110603e2ef4838a6cc981730a6a900000003762f59a0f76716c9cf8f696e372e6fa12af557f866e335837a2fe11747a4a915031ad9300fcce0c6cc856dc43dfd2928038cbb45eb928539a543133295360eeed205cb5c2ac11d4fcc7f39d23562c951c716c6d9b405b94e77ca33ccf4df204bb1e11763e8d7390d95330e920dcbf8f45efa01d2e85ae338dae4b5d980163bb4dd0ee35e62cdb5859ee0edaa464aa774000000098497d9881261832e88f373a25777160d43e0e49d1a40ddf0d3da42532a54603f094fa45450004f66ca8b6fc4d1fcfc1a873b75a963cb3bc52db275d97fc6f2e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A39AFA71-6B1A-11ED-8EB5-F263091D6DCE} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000a17c41bed8b35902110ddeb6574feb906e81a9b204bd3806288afea74dd7cea8000000000e80000000020000200000009aaae75878c08a0300cbc19c6a781407bdebd6c4aaa7f49f870b066c49931da4200000006f08ba479c775734a679a76fb77657b0baa063c9ac3e289b210197726b2bef01400000006d4794d426c139b73b37aee7ab2b4a3c0016236f93d624d678255f2bac2a9a69ee85ba6f4f82e3b5e2edd0f006ee09cdfc163a07119afcd0f594f1f13767add0 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1064 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1064 iexplore.exe 1064 iexplore.exe 1108 IEXPLORE.EXE 1108 IEXPLORE.EXE 1108 IEXPLORE.EXE 1108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1064 wrote to memory of 1108 1064 iexplore.exe IEXPLORE.EXE PID 1064 wrote to memory of 1108 1064 iexplore.exe IEXPLORE.EXE PID 1064 wrote to memory of 1108 1064 iexplore.exe IEXPLORE.EXE PID 1064 wrote to memory of 1108 1064 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\518d532a90b06d6c858adea260d53a22e1251cc5bcbe9c5223ca30f9e0cb53c5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\20ZYF263.txtFilesize
608B
MD55df8a401e14b96a83a671bfa7f9e50ab
SHA1abad6370b9a5b402d4fa3e01290f6e6d501c7e91
SHA2567101fdc3e1e46ea7d60f0b0fee258610d4127cbf6707e6266185029f59a0856e
SHA512a8f9061ad49a460a4e874b1e966da4fe054885d168a0ca7c7c7e5aa3a6ca7d7235af13735b557337400de4a9b7d2eef006d119d2cad5cbe6aed7697984639ab9