Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 14:28
Static task
static1
Behavioral task
behavioral1
Sample
42b98ad0d835807ee4d4d01389ff1e5d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
42b98ad0d835807ee4d4d01389ff1e5d.html
Resource
win10v2004-20231215-en
General
-
Target
42b98ad0d835807ee4d4d01389ff1e5d.html
-
Size
1KB
-
MD5
42b98ad0d835807ee4d4d01389ff1e5d
-
SHA1
46fb70528627f7f30ac4a1ab84db32a8acd8bba9
-
SHA256
4aa7b024945c31294c119cd259919f52e890596ef8d1ed3924b2ed525dc71a7a
-
SHA512
65be416adbb0fe0cdb72fe4da19f13d26d6e7898e030242d7f055d00ffed1c77b5108c1d9cc4f26c9cddb831c1853662e2f22a6e08353a8b406d561db182aad2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409169483" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f8408c36544928e1ab3b98c38adcfe4a4488839b820ea5b000383ef94c2245b3000000000e80000000020000200000000b21a3a4ebd0cd7bdf743b28ae76305512b1673caf6ec18b773255ca792dc51e2000000027d1c4473918b2de188a50944b763392f467c0781c278cb747fa2943201d4870400000001a7541fe1d23783f8f6cdddc973cbbe9a3b568b86b0aa40d3946719408bcddaae8ffaa909cc6206e0a177e96f62aab534d6c3f44127e0bc7b163d0cda18a72af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA27AA51-9E95-11EE-BF8F-CE253106968E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bda57fa232da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009ae57339bba3f8182fcf86dd8f451fb95659eead04c4ab90a73874364b74ddbe000000000e80000000020000200000002e1d471101df413908caa342a665bed29f2c4517ef47d0bc2114f45716c940c990000000750e24a930b71578226b5cd79da73445a0000f8ff526325a83fd92b317048fd51f4e30f063bfead370c0adbdf63fb5108270713fc83d03030c59725b81c0bc48769a622324d031a3f7385fe1ef7ebb433c86a821e7ea0f3fade9d02cc6b82d83de90af22db9277c2ea9b717d8726016cf0f83ffb31c77ebbb7c217d94e95e2fe123aa43e3557d85cf7db4e6c5f317d2a400000000cdae5d6fb1c7e293552e25377005b983ae69b6eed343fa02d9285d0e96832909f3012e44b85b932990f913cdea880df120093170f36ea1df09e11f0a6f53058 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2700 2112 iexplore.exe 28 PID 2112 wrote to memory of 2700 2112 iexplore.exe 28 PID 2112 wrote to memory of 2700 2112 iexplore.exe 28 PID 2112 wrote to memory of 2700 2112 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42b98ad0d835807ee4d4d01389ff1e5d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa52314336cf4bfb10fea7cd8b7c70f2
SHA11edb3cab932bad76bf123a71553c724129e3cbee
SHA25668800e9814b57ea26655d705bd7295f3c79985c75b4b7f3ab5d3869a76eb5ad9
SHA51268cd831ed31f14aae043f4f98bec29a52c5da214833fa904c719b237df89fed4ca952719179e375f38a7371a8b894de0ab7b7d88ba71fd6fc93942cd186dc6ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ae0d95d35c4d884aa4ebd691baa3149
SHA1b7f2d02316353d4056454f8536c7fbe83079962e
SHA2560f5bca69715e3f98fbcbc3400c6cf031ee89dbc95ea1a48be45f6363fb903d07
SHA51236a5a77154e1f1ec69d2dd9a1f58a8ba5f26900434e8ffc803929caef13a5946c3ba6533f8bc96cb03b38e352ae91187de0661e70eca570968aaad9df59afb51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511b9a0aaf48e0c1c8f12cc3a3761b33c
SHA1734afeb2ec5480aee9c0f6bbdd3b8936c3fb8a1f
SHA2569d3bc74698aa5eb010e4efabf38825312eeb3f748bcaf35c1683c1842ac12463
SHA512f9d084b5a090240b344010d3e104912f252c39d54526639ef2ec0a54e02fdb7d175ef1107723824a7bfbe78ba7b1e75f8a9a6c14372c108fdc7d287b31d5218a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9e4ba70ddbd59f0226efa1d727be5fe
SHA1c7613a505bd108be7ebef5fc209e91d29d9c38ed
SHA25649e429bc988b018b4a42dbb5b3afe919cb2d2b3bb864dd5c293cf9d63a6ced42
SHA512e0e2c93d0984515faa146c7ceebf786c0ef402db204eb05de84e44430b60749ae776412fefa74aaabb40a96eb342cec8793e36e0a0c95032bf877da745ec7166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f9ef8deaac15058e7b200287106f753
SHA11dbcea434dfc83cfdfc438bbed7e7e6e59575097
SHA256e1252b8eb25f1fa36466b4dfa8e888fd193f2282847d51e6666839ff7b89de91
SHA5126c4c8a76e8485841d230b2bd255562cb0af21a7d57968a497d7aa47d66925d652510739a5a483e2e4fcff732669b78e05bc1338efd8aedc5ae19c8d4f38cf1bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580cc944450595c40820b6a0fa396cf3c
SHA1c0c73dc33090bb995f6efef05fcee0eb5c615d6e
SHA256b9cebca10b3e273d5b00d4a6652f13f0a5a5a78a987476f4d9da4d05abe9779c
SHA512c317c713a213f0d2b44bd03b592b1c47bab9b210124d4159430c331374ce5e59c56b865ee608b72f2a231edd3155750d8e9b947674ee90c7065621f721ea0965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5906e36d449b2bf0e474add72b18d8def
SHA196389103aeed8e19c411c6c47546152bc0ac480b
SHA2563dda78fa7984e2830de15aff13135a470bd092b7813edd962628e24f3b143adb
SHA5121b57edcbdd22a026d5cb25938a225f56b73307600cfba53182f0ecdda6957e41a7964fd97752650b873715896978f85e16366b1af8b5792e57f70a0d6107ae96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6ac88452e82b6ab1c9d0be0d149c6ee
SHA1135bfca416ef1f3ff6e686b0c6b50c6cbecb64df
SHA256cbdcaf3a98b8d8c37d602cb9f49e3c803236c780425a966387ef046e08ee19c9
SHA5124c09136d3d56dc8d7be51e4db89cd1668450c55987355c2e9ec7f64b988cd7852d67b313a0027a7a0525a8156722f9bc90bfdcbdc01808a841724876f4a01fc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bb394d8ea4d156ae88a095d04f36d4c
SHA1128dcf3804a8fadcd6a7d1b5e0b803e2205dde59
SHA256f28454038889e4d7f46dd9e332eb703d5fe16bd883a71a14824fc0de4fae62ad
SHA5128e3d6c1bdc4e13de49327e6b4a3db899acff8724c3bad751de5f34d7cff666a714a4ecf7cc18a3f89e83e51329843f72918a004989cb617dfdea81c6f4dcf20e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a10a45056c72fff2325522ac4223e88
SHA1a3ee54d84550a5167c9963ada945e856fff5c4b9
SHA256f4257608422aff5a7e811ba200c1aba2dfcf6d8145ebfaaec2cfcadc1ea781ec
SHA512f534ff0dd1e3224186f3d91b56e83e93fb0c909f9bd819bbeb60c1185818fb9cbc48eef3d3546b42347c1164166b5d237b43c793e52c5b68a776268327f60daf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2db1f8594dbcd39c733805e31947451
SHA197c85523f4138a8c88da0583ff6e6e73513db4b5
SHA256f2ec316d5c8fa076bc42bb712c20613d33d401f7db8e66d2c9b440de74917389
SHA51267aebce7297c956b0700e386c1223b0f968b1757c4d88ffc1f983710238807711bda9bbdbe498dc52af2eb4a97c76053225eb9780695ceb2deb85d8d8307994f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5054a1266ddcc485b771473112c91a857
SHA1ca87b25cf61db213fb5a13232af50df7c6996160
SHA256177846b042a558757c36c2e7da8a6ee3d2f108570edb7e0d076cb9b7cc3fdd14
SHA512496991380ffe1dbd34a28a27013cd5eac5a55b3a00a223299502120e532f19362fdf390508059c40809fe1209fba24bdc3bd01c623ce865b12c2bd9d4903093c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52edd2533ed068a8ee9306aba8089dea0
SHA11febfb551843d26aab644351bf93a4f6d4ec8d0e
SHA256ebc0de960fdd3bb8b988ceef555fcacfe6982272a98da6ef5c9843730c843313
SHA51232882d44fef49678ed81c1d3bad93dfd61d7880e08485abc1ce0b009060c82a67384a984c464f1c40b6d60dc5181ba01f7e65439f45f97b37da4415a5b784987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a3a0fedde98e455c1603970c5574cae
SHA1c24c3060b6668b01dd7e0cb7ed88d3af855f69e7
SHA2562cd95b38ffad2eb4524e783661d66f2cbddd86ae8a4fce05f1232021f1f3a29f
SHA512404e019d6742ccce574cc4a2c8d46dd641bf479b00c73d9e9dfdf243b24a052c1def73f3c5e195da6fa8fcf8d7b0b507f653d3aea7be0a1d4a8c9c57b4fc09b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526f41ca58592521ce8c3123c1c5f036e
SHA174e418f447eaedeb1ce7ac30338992577a24d064
SHA256d69cdc8bed84f9ca0f01b1b650f9fe38fa48c0d26c79594da92e5ccba5585b7b
SHA5121419c60e48ee9802a6dbe3d6ac43f46ffa0c781fbfeeee73e066f627b6e111a17ef1548c1dbb30ec00fb3e2b2a9a0307faf2f9ccc46f5685082b94b5adcce9b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa373310aeda940aed992609a9a1ff6a
SHA1ceadbfa364a2c78970b0c69a6abfa820ce4f7a79
SHA256b057207393e8b6e61a5024d8bedbe1cbd679402625f8c0fe9c43228d27640953
SHA512f6c4f7114ce8e1db5bf12f5b4465f10af3e2db16b15c990353e3902abc005a36d0f2c0351c2dedd69e43d444d420c456b53cf73057b87097a513be73c818cfb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e09ff210f1eb81d25d0d2a8d22b03229
SHA162fad2724f7277a3cef7be236646dbf9b0856857
SHA256d6d6b2db298f0b6286fab0d6a9b34a924ceb4aa0429273e8acf9c9f770a6710e
SHA512e80e2ac585f30719e9457e38198759221abfd18ccabdbf08c41d07191883f8d8d2c7a6c95b326331dffcd7ed0d880140dfd9b670c5d26509a65f112a9f9d1935
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52200aa3611a53926d07bcce41f7020a1
SHA1d62ef902696d36fe0b42373147885f8b4f25052e
SHA256449cc9ff56ae9f06dceb47042bc192412933da5e7826e85e141969ecbd58d6dc
SHA5126f909af8fc1852c08dc7348c95648a9d460e2efc77f72f63eb65803db9f917657e60795ed0488bd15ac9ddab547f397bd98006d358e90e8e3b69a6b688d1915a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c3107b34096557aaa52b12049b99e30
SHA106bfc16cd47a7e94892b002179a23a5512dad068
SHA2567756de086fd9aad63112f85be3dc41a31d5fd505b77af55bc20fbd61c6365ec7
SHA512189e59452648161762fbb08550336b2a4284877f9c723c2b39837f01c8dd3e2be70e0d2af75244c27c0640871ca49ecfb33fe00781f1bc5bad25f8920e01e5f6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06