Analysis
-
max time kernel
97s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:28
Static task
static1
Behavioral task
behavioral1
Sample
42c1f92ec2ffc733dfdf3edfa8de5c22880ab6312fede5efdad8320533625481.html
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
42c1f92ec2ffc733dfdf3edfa8de5c22880ab6312fede5efdad8320533625481.html
Resource
win10v2004-20220901-en
General
-
Target
42c1f92ec2ffc733dfdf3edfa8de5c22880ab6312fede5efdad8320533625481.html
-
Size
7KB
-
MD5
d8dbe56eef8c51ff3ff1184df83c3e0a
-
SHA1
e4b708db8c5a67f998a02e396c7e33890bebed95
-
SHA256
42c1f92ec2ffc733dfdf3edfa8de5c22880ab6312fede5efdad8320533625481
-
SHA512
206e34f9b60159567b28aa1fbd6c0005ce29dc3eceac5a0d4aebaaa25f0a76fca80b8155e081812bec97610e65d57f76af878709034bcba35f0412c664948f55
-
SSDEEP
192:EJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLU:OSGabMPvLddLXuSwSTLdlLXugfo2KaU
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06642971fffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375961356" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0D08DB1-6B12-11ED-9ECC-C253C434FFA8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000e23ee7fa38b5b017752ca8a5c2d311f47c75a4feb413d3ef97664f198a9b81b8000000000e8000000002000020000000460479a840f64753f69d1272e9204e55bde8f7a76d012bf46fe2e89e0e76d8cb90000000b891299d080f90d7e3e491837f44016c7a902030043d399b8889fcffc37fd8d88c01ff891dc0829e644abf499a71205c296f0b9c272f3628ab881cf6704c084f2deac006e712d45b16b188ac61f9ca2c59952eab6a023c3d08725144d28130b2527a85fabf168c776d7a97da5ba608ce6bdfe41d945c48ef7dedd26739577feb89e82521c445bb077169b570eb9deeb940000000d0105c4b609d2f8b69452df0c00487d43ded880a168a5503f9d8e80e9f0137549ea416bca535e3e10448b7f9630924c537280ac6e86f38542d6f83f7d67b79b7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000962950a1be0d3081e4449a0d16fc1980ab92b00b10326c551b116ad682f5c4b1000000000e8000000002000020000000f91ac6dafff90c3d4a317fdd6e0ed77a3738c987b69159d6e812f391c45c5a0d200000005553c40402f3b5c9256cea32c8658dcb75012c12d21d621d77b89929f65188a04000000027fca020fd69564f6c78a91ea18beca232fef245edb6920a8c4c6c8f1aaaedfb67836963cca8eb86412a1c27e517f330cf2d1cbf6a284b58315f62fae0e4e467 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1760 iexplore.exe 1760 iexplore.exe 676 IEXPLORE.EXE 676 IEXPLORE.EXE 676 IEXPLORE.EXE 676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1760 wrote to memory of 676 1760 iexplore.exe IEXPLORE.EXE PID 1760 wrote to memory of 676 1760 iexplore.exe IEXPLORE.EXE PID 1760 wrote to memory of 676 1760 iexplore.exe IEXPLORE.EXE PID 1760 wrote to memory of 676 1760 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42c1f92ec2ffc733dfdf3edfa8de5c22880ab6312fede5efdad8320533625481.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2FBEJQ54.txtFilesize
608B
MD55628d3870453dfc7d7d4eb57ff97557e
SHA1129289fb6c787ebc7fd4a3b7210bca296e638dd3
SHA256064e2da16f6dcdaa2f8444697b401afde45b2ea849e0b47faacc8d69e8442138
SHA51227180794da5a01c8a299f2c6ba356632b651c5382e867673a105d00d49ac45759da8bde6b23e7c41625afb858b587b75fc8380768fd9bd04f8083d0ddb9ac165