Analysis
-
max time kernel
115s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
22be87053e13c0f3752f972a2ead09e78ae240bcba06154d2959a53480ffef3c.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
22be87053e13c0f3752f972a2ead09e78ae240bcba06154d2959a53480ffef3c.html
Resource
win10v2004-20220901-en
General
-
Target
22be87053e13c0f3752f972a2ead09e78ae240bcba06154d2959a53480ffef3c.html
-
Size
7KB
-
MD5
3ebfb1e8324b967813b49d6002ba6228
-
SHA1
d61f2e71cea76fb69d5797bfbdf14908cd7d4764
-
SHA256
22be87053e13c0f3752f972a2ead09e78ae240bcba06154d2959a53480ffef3c
-
SHA512
c83ac9f82f5c8643c74ed5e3bf45f572f9eea2ceb2fa2fda2900347ae3b159cdff017eaed14179ce6c5666cd7766dd2f27c8bc7fa20b21e26304c9f1209496ef
-
SSDEEP
192:FJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLH:HSGabMPvLddLXuSwSTLdlLXugfo2KaH
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB6FED61-6B1B-11ED-9551-6E705F4A26E5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac219e01f349bc47b4639342d276a0cf000000000200000000001066000000010000200000007aedd022ce4c98e3d811907d4de7ec94410199e6d8d11f803e18d6e29894e9bb000000000e8000000002000020000000ea8c858271742733a79212e9263d72d23727b0f12be0989810aab4518892059820000000650a6274070270d87b218d7dac2851856da79c5c8c55a775bd4e18e87cf8383c400000003a25315505d0fef54dae6ff4a1b92b980ce5e8095d7750d6dbfd305067ed93b4c71cc2cc0fd2537fd2a6f6a03bc5150124d861980a52254901328b428bea4c15 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375965284" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac219e01f349bc47b4639342d276a0cf00000000020000000000106600000001000020000000f7dc968a66782864e93e491eea5b05016713f6ae8792eee850c3f690f8e89816000000000e8000000002000020000000f4ac4b1497eb48525b35f190be504e244492aaa2779ea86a776551d6a3b9eeb790000000496918aa14cec81f8230e8686ac063f3b7a5f64f737166d97ccc03afa1fd42249e1406b1869ac5a025f804112a6220dc5f2bf30a82c6b7f9b5e3ff67596d68f0ce2c585f60529c909a5015f9cd0b9868629bf508c82cac915e6f9be3998b737e661a34ef08808592e94aef1459c152a776bc8cc95ff512649499507dd5ffc23a4935808be8860ab5230a8f7426a06a6440000000e16c5519d8471f1bf57f15efd0f4f04424ab47f6ca4b40d5bab9a2db3e37afe42e4d5981af0444eeb8be5c6a6e836b6b89bee7d9732b313473d7121bb3850f86 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504228b128ffd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1696 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1696 iexplore.exe 1696 iexplore.exe 2044 IEXPLORE.EXE 2044 IEXPLORE.EXE 2044 IEXPLORE.EXE 2044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1696 wrote to memory of 2044 1696 iexplore.exe IEXPLORE.EXE PID 1696 wrote to memory of 2044 1696 iexplore.exe IEXPLORE.EXE PID 1696 wrote to memory of 2044 1696 iexplore.exe IEXPLORE.EXE PID 1696 wrote to memory of 2044 1696 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22be87053e13c0f3752f972a2ead09e78ae240bcba06154d2959a53480ffef3c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2044
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
602B
MD5577a8b9aa33027d2e4ff3b6b2d108066
SHA1eb3f11614bdef601d3e1e5f60fe02acf64b97b7c
SHA25601a5f4ad04eb14328daca6766cb67015d6032406e3c5c83adc6192e61642adda
SHA5121c83f390aaac67444e33452ee047967bda9e5eadbe53d07a426be5dc49b963802b204354c8507caa4de8edae41172e3037970d257ec13a3ff08698d7f444f05c