Analysis
- max time kernel
121s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
19/12/2023, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
1c7f99fbee49b9b96bc1ec1854758095.html
Resource
win7-20231201-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c7f99fbee49b9b96bc1ec1854758095.html
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 1c7f99fbee49b9b96bc1ec1854758095.html
- Size 42KB
- Sample231219-pc26eaaec6
- SHA256 7d6409366ef14773fa678a43533be8121d5ae5780fa909e0c6beab5edcff0d12
- MD5 1c7f99fbee49b9b96bc1ec1854758095
- SHA1 cf460c346e39a20907fb420a91e0f4cdf3b7eed0
- SHA512 7c21766e73f0a4f7e1294aade1284041f96c239437f8f0e879f0cdc42f51a0bde1a78d34954eca496bd3e340e99f38fdb4bede88c5ede9310ccaf0e01e904433
- SSDEEP 768:/fKXIkcluTMo1gRvoI/O3HCulkM0jMTl6RUz2l2r:/fKXIkclJogRf/Opk4Tl6RUXr
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1747997935" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077014" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de622100000000020000000000106600000001000020000000391c30e38fd5879440531a5d5489d9876ed34fe00d1466f429ce2b9d66645253000000000e8000000002000020000000323bef1824609b2582f95143331af537674f2eb32a58e6b2b06bba444122b24420000000ce8397cf3ad66cac0d77dff0e61484e6d2815650c815e39f17a3eb879d687aa44000000091fcac43774cfd2cdf932e729034e7586947049a4d29a0dade308a1248ae549a14f5cd46237db764ceb1cf50d5152b1684811acbf39c769242018481c564bd98 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c8b09e9632da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077014" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1752061045" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409767420" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31077014" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c039b39e9632da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{93D0510E-9E89-11EE-9ECD-FEBFAF1864CB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de622100000000020000000000106600000001000020000000490ccbf124f21d558e27c9efebc9a718404b1cf80d1a3e9345457d4eb1db7e90000000000e8000000002000020000000475f9318c1960216acaa805417a98a27a369efdbed18ab55b276eb41cda27aa420000000fa77f2c60d99a4152601ee54d41a0ce3713fffbe0f9312f37e3754c09cef4ea3400000005dcfe4a99abc41dc8fcecc6759ec19f9e6a742ba0fcdeec5a4ddba4ad4a5a2b53e3f451c356df34787ad6ac4cfa771cfa403e7c1fb40cbff3b31d00a022ab461 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1747997935" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2424 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2424 iexplore.exe 2424 iexplore.exe 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1388 2424 iexplore.exe 90 PID 2424 wrote to memory of 1388 2424 iexplore.exe 90 PID 2424 wrote to memory of 1388 2424 iexplore.exe 90
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c7f99fbee49b9b96bc1ec1854758095.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_C3562A0B8E0712C60A833D20308DA4F8
- Size 471B
- SHA256 fc11f0ce7ac933bd580b91a7900a6c052b0c4f908ff7eff2ba0dc295a70e40dc
- MD5 ffae48db55fa086fdd33a506259e261f
- SHA1 0d51f8d471c0487cd9baddb564636dc29c2fd1fd
- SHA512 fe6aa5120f5a5627e1ecbb5898beb4f471326b6cc442381d80c9544b42f2d5016c5b55e87036aeb5c6dad6c2c659a478766e62754a3c5221974a2bbdaf276893
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_C3562A0B8E0712C60A833D20308DA4F8
- Size 426B
- SHA256 dd8f87e3d80463503e056656b97157218fbaee2616442a8ada9de939526afe40
- MD5 8c0c48205798194d27720725a489f132
- SHA1 64d9a598ec43d2fc407cd033e8990f0b5c5b0d56
- SHA512 17b70ea642012c985339ee42d9eb4787f15b0029beff00b925b99035b08dbe6bbc5b4f83938ed4f6a9fb8592984d0dd578d4fbc4e0d26c6b3b129a8e3ac22ad9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_C3562A0B8E0712C60A833D20308DA4F8
- Size 426B
- SHA256 3bd8ef1a983e20da74de7000b439947e0fd9a32531bfb4dde3ab8af291909515
- MD5 80f2fe144e7436b750bf330da1c54d3c
- SHA1 9c13dadd3ae278d9db9eb1bb4e304c4e753bd21e
- SHA512 a7a87ca0af78c1cc52d7c930cade8dd2acce05fea73d7b9b1f62ebdc0a3c2afefa39083b37d14d7af9e7ec0dd994c3a186c1e82c404ea04fd85f4bfe8f43069b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\TPZ70Q6X.htm
- Size 5B
- SHA256 933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
- MD5 fda44910deb1a460be4ac5d56d61d837
- SHA1 f6d0c643351580307b2eaa6a7560e76965496bc7
- SHA512 57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\jquery.min[1].js
- Size 94KB
- SHA256 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
- MD5 4f252523d4af0b478c810c2547a63e19
- SHA1 5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb
- SHA512 8c6b0c1fcde829ef5ab02a643959019d4ac30d3a7cc25f9a7640760fefff26d9713b84ab2e825d85b3b2b08150265a10143f82e05975accb10645efa26357479
- SSDEEP 1536:GYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJSFk/zkZ4HjL5o8srOaS9TwD6b7/Jp9i:t4J+R3jL5TCOauTwD6FdnCVQNea98HrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QTPKWBD2\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP