Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
2b1c605ff03331ec184d472a0ed83608780ba56072f54fa957f57e882b1777de.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2b1c605ff03331ec184d472a0ed83608780ba56072f54fa957f57e882b1777de.html
Resource
win10v2004-20220812-en
General
-
Target
2b1c605ff03331ec184d472a0ed83608780ba56072f54fa957f57e882b1777de.html
-
Size
7KB
-
MD5
6704055a1ec027eb4d684a960945a4a6
-
SHA1
373006376342932709cccbb4ada52e3a3ba78587
-
SHA256
2b1c605ff03331ec184d472a0ed83608780ba56072f54fa957f57e882b1777de
-
SHA512
9b8e3ac93de3309150d6338a5d4ccca786722720d06e6df8b49a86a6e7876af4c4a39f1075239825aa660485c34dc94f64f73e1b08fd3a50d3a21cfbf28bcfe9
-
SSDEEP
192:/JSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLP:hSGabMPvLddLXuSwSTLdlLXugfo2KaP
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f9522b1a6e71c94b99e943dc89f3a74800000000020000000000106600000001000020000000236d5bc8e4d0c93815a7e067182171a98b004c971d678903115aa8046997dd14000000000e80000000020000200000005714fdc75851c1413f4847430b36710c5cc6335e2e931270a87c00911815738e2000000053000093e1c6e3d8e839976da63d4c451f6ab8e71eb6bc61d7b5f275d7610b4e40000000a8ff01472b2625baccb125171bb0efc6f6885978b6db9899eb23e6c46765623d144bb635465a747e45eaa986226bc8cc73d446e38b05ccea91145357a946990c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f9522b1a6e71c94b99e943dc89f3a7480000000002000000000010660000000100002000000004ee9f3dc58586856d44031a6bd9e5df237c06c86673e8cf3bd6d20560fdd417000000000e80000000020000200000004d89a1f0b431e1fdd4ed8ccf98b5a05212e12a3d3be1d32fb882fbdc33fc188c90000000f9f83869f04c59c0a2a7ae399b9a7e5b73f16000ee5c90052079d1e8bd5df08cee7422a71e5572d90c001433454424755f4c10799733cd095beacae43b8636060bed36c91f6864821980356fa00c910ecf3d7aafde476083cc8f17755817300473eaf0202d39f5763b0e1e56965aa35fd646bfced3dbc45cf8ef35bfb28275fdbc441bc16d363f03517c40d0ffadf87b4000000077352913690a5cea27685b5c8d6bd1d095929dd263593a6d9595e6fee4437b6a715da9a4bb21dafb940b47c26977bbcc1d9b9edefb3aaf69d438b91349d552ed iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9778F891-6B1B-11ED-A6C3-FE72C9E2D9C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0db186d28ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375965176" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1336 iexplore.exe 1336 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1336 wrote to memory of 1868 1336 iexplore.exe IEXPLORE.EXE PID 1336 wrote to memory of 1868 1336 iexplore.exe IEXPLORE.EXE PID 1336 wrote to memory of 1868 1336 iexplore.exe IEXPLORE.EXE PID 1336 wrote to memory of 1868 1336 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b1c605ff03331ec184d472a0ed83608780ba56072f54fa957f57e882b1777de.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5071def7f2008287f8042d452dd88ccf3
SHA11973a42c4dfa20f6a9d8a2dcae5e7781fbf5676a
SHA2562e843fed31a06318b6a7cd3779d7a288c5a76ceaccf58c1685b33870842b5949
SHA51234bd0acd603a5f7c67742ee41a94487e32c12120801d0e9e4a4eb4997d0aebf8bdfa165815fd13f842462b5800a2708c4b3d00fb1b6e5d8f9e637492438bb47b