Analysis
-
max time kernel
120s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:13
Static task
static1
Behavioral task
behavioral1
Sample
e8bf09e8f9e8637bc455e78ba615b2eeb73b8614bcb42803fc87ca9fab15b5e0.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e8bf09e8f9e8637bc455e78ba615b2eeb73b8614bcb42803fc87ca9fab15b5e0.html
Resource
win10v2004-20221111-en
General
-
Target
e8bf09e8f9e8637bc455e78ba615b2eeb73b8614bcb42803fc87ca9fab15b5e0.html
-
Size
7KB
-
MD5
35d953366656cb647fc69a4c20c2a230
-
SHA1
63285e69082485397cfc56e2db2c65e61bf0f65f
-
SHA256
e8bf09e8f9e8637bc455e78ba615b2eeb73b8614bcb42803fc87ca9fab15b5e0
-
SHA512
6a64d12b10eff51764a76c6023a415c93ecc960b61db553c287154f545a903795a1eab81a905f57c490f66adf4c46e16a27237ca1c3cb28c53718778600c31cb
-
SSDEEP
192:lJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLh:nSGabMPvLddLXuSwSTLdlLXugfo2Kah
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{887CFF61-6BD6-11ED-84FB-6AB3F8C7EA51} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376045465" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3045635fe3ffd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001accc879baf2b540b062c8b0b139bacc000000000200000000001066000000010000200000006244258eba4e01f5dc083417ba99123b7f9f1b6c6736b429d52a50e50ca17df8000000000e8000000002000020000000b3681a5d6e266cc29775574877a17881deaf07d9a7cd7d7e22428f442c67a567900000008e32878d8e269936bf70adac3e32949785225f9bab54c82d92dbaada504aedd10eeb0fe8f68b8686b3bd3942434daf969b0f7c73d45c17814a34791ba9c77fdf10aee18a8acbd4f81ffcd648bd8e5ecd8bb51f13751499309f6c5763bc48e8c562e0898d3134272a463a2a1a389c5ce44a89bbb60bba38d6ecbe2020e40516031fed56ed3bff6baaffe0188192f666ed40000000cc9249fd84a2f8c0cde466633886c14ba0696c8c11e4bcf5ae1a743013e1eb6463d3df74ddee9533cddf10f29dd2889697d9f80d0ea804b49203dd202cf95dc0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001accc879baf2b540b062c8b0b139bacc0000000002000000000010660000000100002000000076ab9c838e40e353809646f6bcad1edb1ee8f44b80e81f50ac2282bea0734061000000000e80000000020000200000002042d024267e60e999b87bbe89a99b814c60884cb13dd90dc107b98f145e2cab20000000bc00b2cd14ec5462e89d816fa7a5a606f3d463411aed3487f06a5abcfc3c9171400000002392ab2cbe30de692ea7b827d95f089783f5ed694894bfac3fca677d820b40b3dcf7a65803572a39f8201e14a8f802c12f7b3ecd6855b2fc6f7107b4fd713159 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1672 iexplore.exe 1672 iexplore.exe 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE 1644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1672 wrote to memory of 1644 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1644 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1644 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1644 1672 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e8bf09e8f9e8637bc455e78ba615b2eeb73b8614bcb42803fc87ca9fab15b5e0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I2ZZ80DG.txtFilesize
608B
MD5a43ebd0d10b14dfc16bdedd7c5287214
SHA1206fc4b954c09d3f0ec3b456dc30208a921fb62d
SHA25613995b9f467a3f8bde61d0bdc257628a43bb417d1bac1562e910bdf805a031c4
SHA5124b241d95117796a9280a625ad6d94997c399599769887aba0cea88b618c1b70b65da471c4394bee4047bc77ca5874575999a8808f50b8b8bc46bf726c5aa516a