Analysis
- max time kernel
123s - max time network
295s - platform
windows10-1703_x64 - resource
win10-20230915-en - resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system - submitted
15/10/2023, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
021e9a53fcafd58350a09245751f1127940abbbb4a13717d21f9dde5ddaa7362.html
Resource
win7-20230831-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
021e9a53fcafd58350a09245751f1127940abbbb4a13717d21f9dde5ddaa7362.html
Resource
win10-20230915-en
windows10-1703-x64
5 signatures
300 seconds
General
- Target 021e9a53fcafd58350a09245751f1127940abbbb4a13717d21f9dde5ddaa7362.html
- Size 399KB
- Sample231015-17cpsace77
- SHA256 021e9a53fcafd58350a09245751f1127940abbbb4a13717d21f9dde5ddaa7362
- MD5 1552a6fc2bc48e871d98f14246a7005c
- SHA1 b2b57fd7e855b47998c496cf00119d089721d864
- SHA512 a1935698f08d17267360043685c55888851bd3ca9fb91f5c2a8bff737f816c0391733af197aab29f518c2991ad3f80d7bdc0cf18d3ad86825679a144d2eb0027
- SSDEEP 6144:MWgcXSuXnkZi7Gyh+yr5hWxIOOQXx7wcR+:PgcXSuXnkZi7Gyh+yr5hWxIOOQdwc+
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31063989" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1655fa699e13748ab5202304d038d6e00000000020000000000106600000001000020000000e77f7dac5113eefbbb6b797b6ddbd310841f191105fbd860e34b12cfa27c9cd6000000000e800000000200002000000064288c60b891ddc2e6890410c4e0b5d2dc23ba6cbafdc9849624310065dcc28e2000000067d6ea5f8f72bbf7434a92b8758a1d2a035f2d3c0673434a08a7e91a8ed32f4f40000000b220540313963538b0029168fe87e71ee386f6f86cb7b68c9e3047d074d47c7159bb0d6354907b5114a9589de0bb943ff42f50346b7847e5e72547398a9b2b06 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31063989" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1A68DCA-6BA8-11EE-8566-E21FB9E6A514} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31063989" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1091ce77b5ffd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404173225" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1986589483" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1985026922" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31063989" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "404189819" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40efbd77b5ffd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1655fa699e13748ab5202304d038d6e00000000020000000000106600000001000020000000f0599f18da034453de41f4790fdff20c22f265f06604c6c2ce36f200da2b9b27000000000e80000000020000200000003d17bb3f6fb437e90517ea94cc5f292a0c56bcdf221d9a9926d50bd8be5f128220000000790eaa10f5a5cd154fdc5e1dc630b398a98e47a7f8fdbf4f2c1c516fc39784dd4000000078ffabc4bed6f0f1c1ed6a0d8470df100a38ae9da03b11d34b6f1fdc5ce964904958d205a4e917af9dc27485117187dd28e217d4ed5d4577b985346f0afe5a69 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1986589483" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "404221811" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1985026922" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Key created \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4964 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4964 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4964 iexplore.exe 4964 iexplore.exe 1804 IEXPLORE.EXE 1804 IEXPLORE.EXE 1804 IEXPLORE.EXE 1804 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4964 wrote to memory of 1804 4964 iexplore.exe 70 PID 4964 wrote to memory of 1804 4964 iexplore.exe 70 PID 4964 wrote to memory of 1804 4964 iexplore.exe 70
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\021e9a53fcafd58350a09245751f1127940abbbb4a13717d21f9dde5ddaa7362.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4964 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
- MD5 1bfe591a4fe3d91b03cdf26eaacd8f89
- SHA1 719c37c320f518ac168c86723724891950911cea
- SHA512 02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
- SSDEEP 96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 c2816f505411ad29f584e6514e3f7b9922d110ae6dd19f5e39e8a76377c4210a
- MD5 758855d5d31a8770fe043ab576cca776
- SHA1 a92bccc68cfd1a2c9557aa6df518652cbcaa9609
- SHA512 c7379ea86f8f2b896a9e94200e2e5f44f063a3e13169a4e5e50b3572b57dc9013064826d347ad2c80a6ea5d538abb27431cbcb1742cdc66cde00a92d0c53a8c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 e76f41874e3b39412381774b62685ca54eec85f06a4146fa4a0e254a61602f66
- MD5 ff88ad144505bcd7b67fb3328e5fb99d
- SHA1 b72f69c18724874e11a841baa2f502ad60db5bc5
- SHA512 852284226310305ec822743842f06a0faee63e6ccf45ad485eb1d415e5d985dfcd5732bfa91e542b45b931d757a8750dcda0144d7d3d45a9000fa28571bf6104
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 6ec6fbec758d63cf7ed378729225038ad93a34de4caa831df7c0a86c577e927b
- MD5 057ccb35cc4b87d435567a398d416f09
- SHA1 3d05ea0dce16504e6bcfc1f5b5f83a1b5496ff90
- SHA512 589e45c45d6a25d099a5af0e975b52068b23fdec9559b46f52000041653299ecdef04898a2e17031a67f9c97737815f16d8c14bd51be1c21a1a9ed3211f2b660
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6702.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2RZQZMR9\likes.7965f6735e8e39fbbe73[1].css
- Size 554B
- SHA256 7bab9c45d7c84255c431ca155530532d5ea19f30bcb389db20f7edf26a5cd43b
- MD5 d11928ebd8a1101a2d6b4476ad292606
- SHA1 e369a7d65299feb97d8c11525d8c831cc463c63f
- SHA512 f3999089fdd2719f70bc2999b1b282452add77eae62c4c55777ccb376bd0d0a3a738e2492301a9816df4885f2693fe47a9539a31ff47a445b2c86a1b8a6cafa1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XJKX7NVQ\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0Q72KAP3.cookie
- Size 542B
- SHA256 d7f9b703dd2014224e88501637dd420b49e2133a4b7e3fe3bfd02727d82449b2
- MD5 106cab16a7c7640a91e90f62b80aacf3
- SHA1 5ab0f8cb40d0e2d3716a33422913aaccfac7b100
- SHA512 4ec4e60dc306d949b5c07f35dc89ff1bd0166fc01b548e43c6fca990089259c81a460ce530a7c214be4d39e7e353fc20b96110683b1a5f0e3a12264b3f510964
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\GECE6Y36.cookie
- Size 541B
- SHA256 b67231732330129c8e53de9c9417b703ca35702abff383a08086094cd0d45f25
- MD5 0ac9c83acc68abade2463f6d330a7b5b
- SHA1 62ca22d71b519ec84cd27b294bebfe225fe39aa9
- SHA512 191db5fb48ef89354dec6bcbe8b2764c113555a3ff51688654e0904f5457d23a9723326f2a3ecde364088a94628b4b9c8f236cef20b7a9a48201bc7e1a67391d
- MD5 SHA1 SHA512