Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04/06/2023, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
weehow_car_htop.html
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
weehow_car_htop.html
Resource
win10v2004-20230220-en
General
-
Target
weehow_car_htop.html
-
Size
330B
-
MD5
01635f79a55557629f7e727a010348fc
-
SHA1
da23d9e1b3144140491b4314200889cf7284cb99
-
SHA256
04671c3862e3a00a067947b31599dcd96f1c057cce35ac3895424bdc8bd3cb70
-
SHA512
d87a8b8d48ea2311d06f80e884fbfca0b23bc1fb6bf47ccab1d236d9733bccb72d7298ec6e4ae64bf6ecd8457ca5a3bb29c94313cb573384deb35499695b6515
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e4090e406542847b77cabfbcdb0a49e000000000200000000001066000000010000200000003a67bb5797342b3efac62b66e364b590d68b13c71ca532f2c7c13c291906ad46000000000e800000000200002000000077f4ca4b6ec8664cb356091198ca53609ee6775ee2ffb8cce8e9be157bb2d88390000000f3f5280208315c05faab097c0f674d37816ac4821ddf61cd0077b4837db8d197d80ce81fc191ec849e53504817813a5f8ad0d4571f9d6193059556f9be1a12ece399afd1738bce9fd66ecb0d886ff039f0011bc35e043ad99ee97047c9ca9f172ebafd19ff4135f0746e26e3a7037744bc27ce32b42eada636f795c0d17a67f849de294dd6cfd042d1bf0259369ed14840000000b75716dc1ee43daa6bfdf1523092a383fbabcc25fbb0a3c790804f63e56a7796bb5de16e81a74ec0a1fba464996fcd2563c2121f99b2b3a1324c692832f6fbcd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E03F821-0317-11EE-B189-D28FF4BEF639} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0dc97682497d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392675996" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e4090e406542847b77cabfbcdb0a49e0000000002000000000010660000000100002000000099ef449b10b233262559b73c9ff3295df889e189e828474817bb139629253f35000000000e80000000020000200000000bb4781a2db81a15f93dfa3386b6788fa09271d06acb45755c803a34b79cefe620000000055a2404c5fe41c6d74203e40c79e414bf6d2eeb2ad24319aa4f8327798489a44000000056ab380abe3ebfdcdbe755924f337bd018fd25f814c089d84ce07a2630def2159b2177bb0978599c6b9b53defe758f0214d6bb2c4ca61669c1c5eaccde8bda5f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1536 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1536 iexplore.exe 1536 iexplore.exe 584 IEXPLORE.EXE 584 IEXPLORE.EXE 584 IEXPLORE.EXE 584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1536 wrote to memory of 584 1536 iexplore.exe 28 PID 1536 wrote to memory of 584 1536 iexplore.exe 28 PID 1536 wrote to memory of 584 1536 iexplore.exe 28 PID 1536 wrote to memory of 584 1536 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\weehow_car_htop.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:584
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5277e0e8a5508dcbee2692d60d59143fa
SHA1c78b091d0c2cd901586338cb3c58728e00e1b369
SHA256a2a3c2bc942f1c5a82aa5efc9958d80b773a0b72698fe648a27d012c224f0b5e
SHA512364e726392137f36acd480474cb63173d4fd616a5e95bf1cc667e871e25310364feb152b0d5439e91eb2afd7910ace74c856c2cc686e0fb0f10ee25f13f2e0a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bfad73319e806ea47f2c7373d7211c5
SHA17a73b1a9a0323bba3c7e935bc5723c38a3f134d8
SHA2562a17186a18fddb2e1f6fbebe75c101db7be69230fd3a99e65720b45301807c3f
SHA5124ec5cd866a73755e15ce6f7424bbaf7269a1364f99063b22b32af0e9336cced244c96d08a70ce6cd489f3d2f8a6946f568b434b7609cc498310c663fc71800fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553ad3d0d65c69472e3c288026edaf8ad
SHA10dc166921334204e026bffe7c4d403b12f910651
SHA25641b7fc8f9a01062c99ec1835069a13d8b464f4b425dbf52b75361a37e683b46e
SHA512e061220eb36aeeb63809e2892386bf7a322d3f1128801be028910bbfd7277e0a72d5b4b8e527658571fcd8325e1f5c413f21d5e06ce961b8f3780649e485f3a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530c837928ee5cc2c64996e3e85cc61f5
SHA18761fc6492ead9e864057264211409b9aa6b2f5c
SHA2563ee1a377a38eeb87f76c519f8cc2f33da5a88a68a5c6eb76681ddc115886d232
SHA512810194fbfcb710bc3f3c89907358fa79e0096cf12dfa686e2f4a7b2e22e00a795e5ddbd1e8ef9fab8295fa658030870f72151701b0a73c363622ced17525fa6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb03bf66fc0849b520460e7f0445f13c
SHA1423f53bbb042f7edf28521bd3bdae5211586c657
SHA2564cd7620ad5840ad27c02c034b1482032d29c8a6eede6b5f609ac1a49b1f4ccba
SHA5127468722d9ba1597642105d4b8184759c7cb432fc02fc2662528f7295f5a503a8e784cd2d4c57d745e6fd00c055f5c7954a10524d29366b81f75caa115c2342d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aefb54bf21ae62918074e76ba74a013a
SHA1e79e3ea552f0ccdbb0c97315bbeaeb5763ca1778
SHA2561a2c23b820fcf999745e6458b2da75a3811987eb4e3d0e24e543ac6e305fb722
SHA5126daa79ad5814e698e68177b22e0908bb28fd1fb4e1c6f73f335c5f02c656847d29450b8be91942f73235c02917a60c2321b986d4823131d3181a689bb6fe87b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559b5a185bdf17691edb42733e813dc55
SHA1921756068e4c3cbac2f9a3291d94c5d6613413e2
SHA256c5095d52533a04d1c6e0951c3b3fc569a3760e8e15519f59c731865e35e27fd0
SHA51262913c05ec4fab24482a1b4d35733ed4cc8afb98a38a60e7894f3c4a8b2da2352d9d88c64a9fafb8e0f4bde9b5607c29ccefea3937fe14b247bd16fae1b22d27
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EV74ZOZO\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
607B
MD539a614d96ecbb98ab2635f2cafbc9208
SHA18b91d1b3a0b0f5088ab17b6c335061f970693f8c
SHA2568794fa1de545006de5bd1cccedd5ef726af483b032c714fb616a5fa90b26e1a3
SHA51242fa5a6db0e118c158e41a525dc122df952273e4e024b92d72e10700c775d3dd773887b3f4ca31232770b485f9c6f1d19a66872a00ed86bd29cefc14ff3f4de5