Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 03:37
Static task
static1
Behavioral task
behavioral1
Sample
5c71e469f9aa40a47615401abd515298.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5c71e469f9aa40a47615401abd515298.html
Resource
win10v2004-20231215-en
General
-
Target
5c71e469f9aa40a47615401abd515298.html
-
Size
14KB
-
MD5
5c71e469f9aa40a47615401abd515298
-
SHA1
5700b77212013bc2ba80edbc40eb2e6e18c2c01c
-
SHA256
7872ffe3338fb09b80e6c40e821c841072056416f16772c6989086fc8a478976
-
SHA512
ecbe6b5a8cefee9f2f5f1b9316f0c51da74c979e375046cb0d8424678670ee4bfe8700f246a37ce2f7f93b08d5e2e448ca5c4c21e270b5693e39a3220a6fc5bb
-
SSDEEP
192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vCmlKt6DvE:aioWD/ZmXg8SZQNmlXrE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B088AB1-A162-11EE-A83A-5E688C03EF37} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7035ba1f6f35da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c32589fffc84d099f5384d4c696b39a0e0fef23e11f112d10074e05d50482eb3000000000e80000000020000200000003dc038bc9865b199020252b1c64cf9cffc3989eaa45b7f375bb3a5daa3fa1a4b90000000c4a31b2059a5c714038d3f100466c1507891f6bc7b96f97f8ee57dc59ba9d7c12c269fd7a856db145099687165f705b6b9cac6c34470ee48cc1017d935e3b673a9b477f9127b982acc55866a7549bc91e415c41a1a08b80b5c38014c878b84055509a2c47221dc5a4cc9a143e3322733aafb95cb0d82266bd6abd071f6a34b61d73faadd47e56428914cbf73601ec3444000000087e357242450a377e1e20606bfda6059907a6bbbd8df3e2a613658de93debf37a305115f58439ca1a44d6d850158eb6b91c22c32df131c47b7429641aa349010 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b7877cc8ae4fd69e73f66a8a922aea44aa5b18963f0202eb2c1ec05f1113022e000000000e8000000002000020000000c1eb05a110cb5444561c0030126c7344dedb19ec6cc56f3d32d2af3d00a93b4620000000430614c8f774b48dc2eb8c2c1188a6711e19350b3a370d31cf5e78b14fa92c0d40000000e7fd44b6465777c5028cc98355cdc9e0e4418360315d18d9727c8abacfb4028314959edd135feb219a9a7873c85fb6de90b7dcc630074a9f038312c1a9e1b5d1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409477273" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2300 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2300 iexplore.exe 2300 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2380 2300 iexplore.exe 16 PID 2300 wrote to memory of 2380 2300 iexplore.exe 16 PID 2300 wrote to memory of 2380 2300 iexplore.exe 16 PID 2300 wrote to memory of 2380 2300 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c71e469f9aa40a47615401abd515298.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ea6e6750c9b8632e3ce24a379168704
SHA1e1a4ea291b0ae52906e3dbece7f1de097ad53189
SHA256ae4e22362a58312bd708c630a8371a9cee00cbc87b8724bcc19549568674b811
SHA512700b28bdb3a71617d5195137a86620aacdacfaf7809460464b0e95153fb8e14b1fde96e63d69294738110cd65778f5a804ce1e470637d3224e13b64aef4fe009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f80c1e12f2c678f15eaaa850ecad836e
SHA1bb6f0302e745312acc68d28a8e52cec50eab7512
SHA256830f4a88e7c0a7a48715e8c2ab5ca570bafcb9e702be2af6da0b04f19fab9ed5
SHA5129deed6c8d749265c950db041f0d3484d53e0999ac13e73568bc921d84611d2ea460bfe5ea8e26537602490bff47e883afe52d1e2c0f4a0203b6b14641dff06e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fd33cff450285ff52d5ac56baeef25c
SHA16c8b2712b4b37c8a7a64359a67f85889e557a9a6
SHA2563657e82371fd7520be2c352414ab0246c0d779b03b0f898e898e8057f451b813
SHA5125ddd8538abbec8747ac88317336945ba2683cc6f457e924679e38f19ee6c3852456ae1d4464f40b35c8ee9e6e91fc89e3cd20c3f3f327a05cbf813490c8bc17d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6cf73432f98345c8b2b8c157eb1bf80
SHA1e31d9fd9ea2ff4387a466ef297816366a73263c6
SHA256f8150381684c594c0559d1954470af3d2023e93d438999d750bd7ad014877682
SHA512d6facf097195449c09e1a9de9eea289b31e28b4ac5a8a9281bf0e20b0ea430e3d8d652d31ecbdaa070f42b5d033599355a3ad4c2b392acda1e0147b1ba358ca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51585f569349e1e4985f36b9890796792
SHA19bdb51d2dffb72b29127beb4e0ef7edcdccb1a97
SHA256bb19984abf4af2855fb757cfa76612b0dc1df383c7d051a41fb0a4ede1369468
SHA5124636335ff9d62ae86c12b5f282d70e6ed81a2ca65c70024baebe98fdb37a5fa1301b9a58a21e55fdd769dc9b2bda8aaba1c9e4ff481db5398c6c89dd24754746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6fbc518ffae8f893577d2a7c3582d38
SHA123081d17fb9a3e18084c305330ad7c18e99d5ecf
SHA2561867614bbb886a8420db33d34b2f27f6391a8e9da9c68da51c293d7c7fc4c708
SHA5126267c57af9d64c6a999553df859c22f3775b1c87e06b5166981e81a5c956694406ca84673dbaa2b2f3092996f7a00486e34975f9d93119113572b9d4dbee3639
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c5511dc930bb18268bf342636d22f06
SHA1c4ab06d2fe7c2521ff0840bfb0d2a024d1927fd5
SHA256d12441234fc491b4ad3d5f78e49cd8c94d8d0480f1c62e4a1a751aff80bc064d
SHA512faaef090bd7d6f1d70e87ce239a494f928a3deabbed01acdcb4ff388637b3906f2924f1773a954f3160197eda09a0f24816c11d8a81a4b39015acfc16864fd71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5141a7a27386a73810ce34503d48d4a91
SHA165d03bdc38d165fe989bb4e21172fe3395638e1d
SHA256f1e30f80f768d0ef1b7ca40866ace2b40d2ad56247751d33675a9929085219d4
SHA51278d13b286c9d3daf58d428572f70efc8d573d77650820ddc97d71e31d370996c540c13fe166120b01ce89a1a6408c994a3ec70aceb9ae485e52352add82c0c51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d566519a592fd4f026cc9206ae59845
SHA13ff5916d4ba317e6655cfcefe1c7de5e8f6ae0b7
SHA256328d5d90ba5b28f4e938c68cdebd769358d2f7ea7f7fb0c97559cbc9c9a1c98e
SHA512b33464978dee5552011f5ac1e90f830ceea2649b74639b8cc40dcec91fc05c90377ef3eaa3f0f32695591c946bced5d3bb4e676c9ad634c4d61b4cee8d0cc4eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59665056d98dd651b4cfc63a8ffc8a1f3
SHA10ba0dc4a58717127362c6e7ee5e76d316ca8d96b
SHA256618e94e753067b505cd3e65acf4684d3bd9cafa9aa74b7e2ff3c6188521d2585
SHA512280f5500259a9b3197a72c6dac68ff634e9645a3c6005ff4531262977aed477ec4cbfa7e9263630e9e9fbc64a2b8fc2504c620f7b3ee3b4be7b4cd816b8df7f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575f2f83c1437ce15ac72ff9e7dcf02f6
SHA186d85b4d2fa20e6837655d44014e3e47fa1b831c
SHA256850ed0e4939cf680ed1d8851fd418caafe28c0dc31e628652377f2255c892b99
SHA51262a0fadf0aeb7ea8a781a00a299b68b8c08f71693aaf1ebc0c4c72601c162ee1ee51fee58a33875a6a588162094d09f09d9745afcd7ef2d63bed62720aeaa020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52efea479329fb37bad37c3abb55de291
SHA1b6170cb97ea1f4662ccfa58140e9830bf63802dc
SHA256712f1755930191fff4eb003958acc1e859d8c173a917af4cf40826f5643bcba0
SHA5125e4d140687c7f13a8ec941b0f554a2d2ad72fdf051c4342dd85634b4dac9a557b938764310e7d77c455e518eeea9fa37cca4557be6ac05d8bfadc19e0fb25cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3dfb99d0896c25369beda2c12aa9cfc
SHA10cca9264154a1ab43463b4d6e6de7c160e5dfb46
SHA2560d672e5fcba387d588f79191b909ec2faa54d43a0a6aa73481b2e98c2c35794b
SHA512aabe9a082cfbd7fb21107f7fbbf40244fc34bd7838d40a8837015851145e9e0552890ad192c3ed918e578c828f48b45518f29baf4be36f470f8147f9a7d69d9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545361e1bff03f0170bb52a45bbf688a9
SHA1785f4d4984dc0335f002d1fd0dd10e5723a08720
SHA2564dfdde1221e52129b36f6432b9ab97f5bff9a0da1a695b4a4b31d70585dfb4ad
SHA5123f2589a73fa044a988788f959b8f7fcc97f411d53bb29abe8ec1bd5068cac6410c6a59a7ff6fe933761f6ee6fd289f73ddb7302a7bc386263e15e93976b9384e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba1b54e721b582eabd03472ab41693b2
SHA1b75cf8e40424798c5b8a2f677a528896eee316bb
SHA2561ed2912ed0130398a95a521b115470d8067445782fd632e2d66d41fc01c5f147
SHA512564edd66b194dd7790a26c1babf33dc6ffa80e7347c54251016efaaf9c208fa1a2a71eebcd82a7af34b3424ee9000450363c681742a1cc8022368e6c284bee94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5937feeb68d9beb4d60d6ae59b5b16361
SHA119596a045b6a7a94a0f24fc302a28a64c03ec522
SHA256d76c4b8935c114d33517825a7194a41d3b8826043ed98ea8df4485db8678e976
SHA512636967dbde78071369e36c062ab3b2b53a075d092c87c46761e7e29754a8f2febdb90e48cdfeca78b99af1965af1754a1727da25c3615235e214fe104810cdb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58daf100693ee44442748fa121d3d5d9b
SHA1ca84c23193fa98117ed3488eb68b80e8f53547a2
SHA2568cf7e63da77a6a85b161b625bcb36fa83affe93b1e7d5e6fdbba399a20356681
SHA51250eb1eebf1f276c770af4cc0c7d927935b2742ec73932b6ca7031e07c62fe27c8b10e47db086a2c17e300f74b95eeb26c35273161cd5fcf39085cab91fa09c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c22ebe5c536e93212cfe18b979796cb4
SHA121794b60c0a430f1cb5da00fded872d5a08a1d12
SHA256af71c5e908f4184041bf4126876bad65f4bff70263d197a2e7fb802d47262bd6
SHA512f0a4a33435cd2b1ab2ed67ee69029d0bd6cb77e3969fcc446dbff6ff28962f52e6e6533d52bda63098e4f5e0679ab9d75cb7f4401642bb954bd3edbb3b314d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558bd30f104daff7e40be94cbd3ce777c
SHA192670e6c15254fab38228b6711aac94b165b019c
SHA25608e08566ca3f56b3f6184554fab7e8c528d6143a0a061ab0bba67b5006f2c416
SHA5122cc664e0097a13f48ad490fd11b7bd0d6a101cfeb3d8fe57eb5fd8091d3536cfd5174b7207d869c76501afff6d1f5433d7c2279f5f9f9a6e835194140daec753
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
136KB
MD50255399f2a5df307a42c446b66a98d1b
SHA111fe04483fe8aaf002f2b2843bbf4119bdb51292
SHA25667da38fd5ad216ce037504895586472650b1460aaf53ab0590ee253c119e110b
SHA5126a0956806f98a781df6124a34c3967237c59cf245b07cb9e55befc049ab3182d4ae819c97eb85bc0f8ca88142b2ad4ba81c73f8c4a773c20262dabea09c4119f