Overview
overview
5Static
static
1a1s-root1=...46.eml
windows7-x64
5a1s-root1=...46.eml
windows10-2004-x64
1email-html-2.html
windows7-x64
1email-html-2.html
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1hdjdkddk44.jpg
windows7-x64
3hdjdkddk44.jpg
windows10-2004-x64
3Analysis
-
max time kernel
138s -
max time network
269s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
a1s-root1=email_banfield_2023_11_17_16_SMTP-att-1-4SX34B2dWkz1jvXZ-2023-11-17T16_57_46.eml
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
a1s-root1=email_banfield_2023_11_17_16_SMTP-att-1-4SX34B2dWkz1jvXZ-2023-11-17T16_57_46.eml
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
email-html-2.html
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
email-html-2.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
email-plain-1.txt
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
email-plain-1.txt
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
hdjdkddk44.jpg
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
hdjdkddk44.jpg
Resource
win10v2004-20231023-en
General
-
Target
email-html-2.html
-
Size
5KB
-
MD5
ca140e60feaadb0094174e21dde8aa8e
-
SHA1
5abfe8aa539c4b6bebfaf814f0ec39a665ed62c0
-
SHA256
6156a73d489fc2a40ea51b5bd1d071684dfa10868c4f7cd7e08a35bbaf6426ce
-
SHA512
49bf9bcea8334af72dd26418b1f8904135d9ab5c9f823553bf8561ba0055bb5bdbb26d34e70824de92a15870af3b279e931baa0ae85c16d417efc85ff4c3666a
-
SSDEEP
96:ROZHeqJ6MPMbGFerf/33q0aO2KZKcEh78eONNNNNNNNNNNNNNNe4Pbq1+Ued9PVi:W+qJhUa+XHnZ4vZJ8fm5P2Ur
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1440037493" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{816FA322-856F-11EE-AEA7-4AC2F9E44820} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31070588" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a786c536d7cd7e4ab8c0af0cd6cbb430000000000200000000001066000000010000200000000c7cd6412dd58c2cc0ac1e585bda00fdc2278400ae89bcde296d1b72e61b4de6000000000e800000000200002000000097966e6d3a70e5152316291fb8c01deb7ca1f61d579d14b78fee929700a15d40200000009d8556e3d2ae010ee8bbdc9f6204dfd232ee7c1a67d9c7015c266c41f0f9b1af4000000087c170b6c40a07a2928a1cce6ac9bc7a2a4205768e7a9bb3c9ade87f5fba4aeb732e4fd05e92cab466b1aa9e73580a88bb19696a3a5fbc93a812fda09b4a6540 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8051a1577c19da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31070588" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31070588" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407007421" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a786c536d7cd7e4ab8c0af0cd6cbb430000000000200000000001066000000010000200000004ab0a62357ac42472de7a7668e915018ba323a3fd14632354fba0814cd7e172a000000000e8000000002000020000000d4e4be7f6e5627e019ed981f100f842aaa1960b699b417116392efa4ff5fdaee200000006e2df0d638dca7cc0f04baa15a2d0a98318170f4780f4421c24775b2999f406540000000a423dabb94a6cbceafa116de852f6cc3ef74167fd75ab4b2d99c2ddf1c0ad968ba9f31c6a7e6512c378b661db7fa0ece58b3bec689a7dd17f8729e2ebe96d753 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1440037493" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1454254251" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f992577c19da01 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1892 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1892 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1892 iexplore.exe 1892 iexplore.exe 3524 IEXPLORE.EXE 3524 IEXPLORE.EXE 3524 IEXPLORE.EXE 3524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1892 wrote to memory of 3524 1892 iexplore.exe 84 PID 1892 wrote to memory of 3524 1892 iexplore.exe 84 PID 1892 wrote to memory of 3524 1892 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-2.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD56ab41675ee418fde7cbb9bb635ddc2cd
SHA1efcbdf27b880938d7ffec16797854b197ff617d5
SHA25684dee75132b94524ad3372b2a3e072c11ff453cb334829a93864322da8d414eb
SHA5122748cc8662ad4e11bd807ed845b2477d055624bc61bfa457ad8c600034b28ee2446b8e40fcdaced77f9afada4ca873b54a13b83a3a9992c2eb9da89bf9ce8e92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5894e58590dd6c5c00e4d5e59f8739c1e
SHA151883758bd5164f291c90f67e1797570d778302f
SHA256246d4615487fb81f699cc851054deaad9879daf796cadd08309cfe24bda2a7bc
SHA5122da52ab3f02b8caa27d5e14fe94f543164432f5359f608f56981d54c5f3dd241d03552068f07ea0f8597cd0d6ea3524ba18c75180130a29782cc3ab7539d6764
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee