Overview
overview
10Static
static
82d0d46d5-2...f6.eml
windows7-x64
52d0d46d5-2...f6.eml
windows10-2004-x64
3Mail Attachment.eml
windows7-x64
5Mail Attachment.eml
windows10-2004-x64
32022-06-29...on.pdf
windows7-x64
12022-06-29...on.pdf
windows10-2004-x64
12022-06-29...TR.pdf
windows7-x64
12022-06-29...TR.pdf
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1RE_ [SC27W...on.eml
windows7-x64
5RE_ [SC27W...on.eml
windows10-2004-x64
3Dlist.serv...rt.zip
windows7-x64
1Dlist.serv...rt.zip
windows10-2004-x64
12665187713...om.doc
windows7-x64
102665187713...om.doc
windows10-2004-x64
10email-html-1.html
windows7-x64
1email-html-1.html
windows10-2004-x64
1email-html-2.html
windows7-x64
1email-html-2.html
windows10-2004-x64
1email-html-3.html
windows7-x64
1email-html-3.html
windows10-2004-x64
1email-html-4.html
windows7-x64
1email-html-4.html
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13-03-2023 07:30
Behavioral task
behavioral1
Sample
2d0d46d5-2f07-4223-612d-e119141337f6.eml
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2d0d46d5-2f07-4223-612d-e119141337f6.eml
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Mail Attachment.eml
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Mail Attachment.eml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
2022-06-29_Circular_letter_CD_Consultation.pdf
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
2022-06-29_Circular_letter_CD_Consultation.pdf
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
2022-06-29_Circular_letter_DTS_DPAS_DTR.pdf
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
2022-06-29_Circular_letter_DTS_DPAS_DTR.pdf
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
email-plain-1.txt
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
email-plain-1.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
RE_ [SC27WG5] ZKP PWI and call for contribution.eml
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
RE_ [SC27WG5] ZKP PWI and call for contribution.eml
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Dlist.server.uni-frankfurt.zip
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Dlist.server.uni-frankfurt.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
26651877134168, United Kingdom.doc
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
26651877134168, United Kingdom.doc
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
email-html-1.html
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
email-html-1.html
Resource
win10v2004-20230221-en
Behavioral task
behavioral19
Sample
email-html-2.html
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
email-html-2.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
email-html-3.html
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
email-html-3.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
email-html-4.html
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
email-html-4.html
Resource
win10v2004-20230221-en
Behavioral task
behavioral25
Sample
email-plain-1.txt
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
email-plain-1.txt
Resource
win10v2004-20230220-en
General
-
Target
email-html-4.html
-
Size
24KB
-
MD5
707f685f9fc58d1f54e65d73949bb081
-
SHA1
40fdc8be21a874e238d2976954aba642b8191923
-
SHA256
11f74924ae96437b152f93c95cda0fff5ccd1093e6e85d3fb524fb0568ca7c5e
-
SHA512
e23c1a3097279f9eb20ba07a72e30c8957a06a732f0aaccde38fd4e3d900acf8350380a396c4a2fbb2aec87788fb6ad2cd46126b867d658d52b38912af4b50f5
-
SSDEEP
768:muLUtT/UnWB3CYWDuRscx+WDc2WSOql28QSm5oCPzq9go:vnWnWGscx+WD9WSOql28QSm5oCPzq9go
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103c042e7e55d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000be26efe5f9132c41bbd43e2cdd63a9a273082d43d848932aa1ff05e8c2d2582d000000000e80000000020000200000007eea96577924b498981db5b6562ca21f33485b15696a0ed1c1a8112dccb672eb90000000f3ed17c71e8d44e9fcbc600127b2a81b60cdc6be1c987c6c0b373d865fa6956592e7daf22bddbb7ba44d1142be678e01f40ded3e75959f217aa5adabd2ec96dd8eeecbdb3afd5ade7c13d3560f1008e8b6c019ec49e7f118650b9a4f3a9467081d123316b89a7a4535ac2cb970188f110a53f9698b9493d4ccaaf48f155f87386c4592a9e3fcbfc37faa18e95fd927604000000083e1930d5b824b3aa2c6f1dfb0e3be854dae6f0792789d1a06758a20796ca071da8e049854ada6af2b6b9fd22cb7463ebee5cb4fe44d15ab84e4951de2dfd71a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385457779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c0000000002000000000010660000000100002000000050cc14aeaba6d99249a1f775047183bf24a161c2277b3e7bb8e2e0f5a445d9b5000000000e8000000002000020000000f8acb5cd161541f6c0c9f94b0c513dd6b805b71a66a9ee944762b05881594d37200000002f886a6fbb397222120f91dced74ad38e1597b4b014c40d1a1759e351942c058400000004f59346b599f2202286d634b9abb4ff3ee5a404ea1263f405d498c8cd4e69a5fc36ccdf6a428fb8626bcbf8affe5d057e05f36a92f29787d2508f0affb8c63b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{556808E1-C171-11ED-AC42-C227D5A71BE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 912 iexplore.exe 912 iexplore.exe 1352 IEXPLORE.EXE 1352 IEXPLORE.EXE 1352 IEXPLORE.EXE 1352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 912 wrote to memory of 1352 912 iexplore.exe IEXPLORE.EXE PID 912 wrote to memory of 1352 912 iexplore.exe IEXPLORE.EXE PID 912 wrote to memory of 1352 912 iexplore.exe IEXPLORE.EXE PID 912 wrote to memory of 1352 912 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1352
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adcc17646a13d6c97d0313a1226c797b
SHA1bcd8bc12ab304b734a3d2cd9c49777fc90eb0d47
SHA256d98ca31131bb68ad21cdde472028217f3f2beed95938c12ad32f9cb00e4fa0c3
SHA512557914be18a5342a18d196eccb566da2b16a1e03f82f77b38b3e5c9c78a2fd95ea5fc9380f0603d8c9e73b294569d27ce8b05fa003ba79449408118f0f5f2e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522ad57a661220d465d79190639c57afe
SHA1c176001cf0b84a994ac110858c18d9265a275850
SHA25674c872a5b09b69d0a93e281b4afe0c9d4fccbb4705dca9942857269fcb6d3f2b
SHA512e48288358450cb53ac201d9545c426865209dec830ffe505348f74f8e10a42eca750eb0cd9af150098fc932fb8c23962b2f6ea5b7da94c273f27a2a8acbf28cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ecf90bb5ae3754acbdbcd1cc1ba8a1c
SHA15ed94911460b24b5705582eb5e9eabce80ad3f3c
SHA25648fe4fe75a6b1f493631e474297b1b8c4d33c91647405f2aca0bf8136be8c6bd
SHA5126717844bc369c619be33e57ef30d4bb0e551131105096d1796c715a888fdac1368621a767427f379abb3849970973679f50968b1972c0789c5107dff19b70c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6e266198a55d93fe5c62f490a06946f
SHA1f6a3a65121202813c01cdb30a6325843694451f2
SHA2569cb490d028a7101942c38e26f6d98e8b778404a5275f4f6fc54bbae65d271f44
SHA51283d3657a18e2509727f5b55883b4b73ff781e48a496138f198528b1a8e0efb6197848d2ee89fdc39e846f1bb2dc2e3c6ddb5de63bf90e0adb89e5cfc8e296dfe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
608B
MD5abb176097c9f14858ff7e859d0e2c4af
SHA17a116bca82d19b8b374d74a988d003d18a4d8197
SHA256425540da5b7a899ce3a8e4545bc2cfe752f63e197e1d47a8652395a625cd351f
SHA5122c25ca37ab413029c32904cbefa18f7e4c27fba4a6ca13fe1090fa713144959ad036de3a84bf410e8ccd2bc3f53007ac8098636f8d2e270505020f08da622c09