Analysis
-
max time kernel
99s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:26
Static task
static1
Behavioral task
behavioral1
Sample
5180f323cd5fbbf29920379f334633ec8581538296b8e1ba10bdea7573eb7736.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5180f323cd5fbbf29920379f334633ec8581538296b8e1ba10bdea7573eb7736.html
Resource
win10v2004-20220812-en
General
-
Target
5180f323cd5fbbf29920379f334633ec8581538296b8e1ba10bdea7573eb7736.html
-
Size
7KB
-
MD5
cfd59c4fa296197807513f8606ccb5ee
-
SHA1
a98e273f236812ba53ca5be6ee986ff7310c9526
-
SHA256
5180f323cd5fbbf29920379f334633ec8581538296b8e1ba10bdea7573eb7736
-
SHA512
a11f314e378b45126e7ee4039ef8eee3971203c092074a7e195b2cc4ab94728102b2e9b6f1771fdfbba1d16b0d2b1188479acc76312e7f080ee85237aee2c6ef
-
SSDEEP
192:bJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLu:tSGabMPvLddLXuSwSTLdlLXugfo2Kau
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001accc879baf2b540b062c8b0b139bacc00000000020000000000106600000001000020000000ab48368e8cbcfe455cf851f5d18094ff83eb7b8f518a7eab78044d2977139938000000000e800000000200002000000018ac48c51c8f133d4b83953cbb4e383e460e38eaa94e6e598a5f5852ad86193920000000bece97cfc602ae13a9a5b2a4d77d8f8cc005584b68890987495fbd2d71af5dd040000000089e231cc6eafdd924c9fe9e8906cd80423121cdd8d45c2cf638e82f723cb09e9f327fba4d7f680744b4cc358f93138af905f55ab26c06708472b6d2336624c3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001accc879baf2b540b062c8b0b139bacc00000000020000000000106600000001000020000000d6ee7ac9e603de2d6e0aef1f72321e737af94e151324c86286a19555767c720b000000000e80000000020000200000002fe7e03f295bca81ec39050d8f1b43fbd733a76d69e9b664e89b604ae7ceb05f9000000061ac18f2776e3081896aa5111c7780752e3baabef4a2afc8ccbd2b39a1f99e17a35ef1f414e89f48d25d0f9103b90af9014636814c6123ccde39e86f1f84e136e3380eb355ac2aa6a40a0083f5360fb8643607b254f4aa2e05b760adc422ee45f4935991f0915c9dc63e649111112a3ddbe6da949c1f86a7caceab72f4cdbbec78dda80b92e6439cf607fd83d92b4002400000005645cb970508bf98a78cea0cfb0b6dce71354c7e2484de674e745ac0970b11a72dd8664a714dcddabc0edc8d8fe8a27f94064bb4916d291b1eed190cefe61ca1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8094f19327ffd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375964788" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE0984D1-6B1A-11ED-84FB-6AB3F8C7EA51} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1672 iexplore.exe 1672 iexplore.exe 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1672 wrote to memory of 1648 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1648 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1648 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1648 1672 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5180f323cd5fbbf29920379f334633ec8581538296b8e1ba10bdea7573eb7736.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ULI1T8VN.txtFilesize
608B
MD5737099be9eea75a4b2c511c09046c1dd
SHA10f4bfed1b4200617e7188079b23f18b4c587af8e
SHA25665e8a6b09138ebe4b4decf7017cb76627ee1c4cf4f70bc11593bd122698a542b
SHA512e7c61f987648de12c49c155a6a3055e13d1afbcdafa4adb5713377f6b2f9ad0939144491230b98b695a63d0ee93ff382810a192223dbb3305f17d08e035c8418