Analysis
-
max time kernel
119s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
5802f5c6bdabf71e5e9f3c9602f5433c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5802f5c6bdabf71e5e9f3c9602f5433c.html
Resource
win10v2004-20231222-en
General
-
Target
5802f5c6bdabf71e5e9f3c9602f5433c.html
-
Size
1KB
-
MD5
5802f5c6bdabf71e5e9f3c9602f5433c
-
SHA1
64038342573e109fbd70d45120e2c0c95fc3b818
-
SHA256
6134baf8879e2cf7cf8c2c3bd257bef6d2bcec931a899a7db8d054f980470fd1
-
SHA512
c80cc4d9be5dcd79b02d55bec3d1fa8bcf4f6df293fa3bed6e3d6661844c781ed5fd65dd813adf9a7a199c5605cebb2bdbc4fcee5f0ca5aebd6d4deaf8373695
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{831293C1-A15C-11EE-BD45-D2016227024C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009bba8ea65874193aca06f7dcfb350bf4376dde3ac39bfa4e23f5c0055ddc4daa000000000e8000000002000020000000f688e31969754a578abedb37780d0e93565f550adcfc00bd5a89a59127a7737b200000005ff10f27081f9a7505eb488d05743866c6b1cfb1045aaadb10817558851d8e5840000000e38a890d76742c8c3ebbed8418f8ad0b5e3e91083f8b38a68a22af9dd50deab579740c36792aa36f1878f194de682462b8420d2f3be272e38ac3dc5ffddb3e78 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3014dd596935da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004752c7a34fb71fac420100108ca4a7c8fa794101d94c6e0d4909bbe6b6920980000000000e8000000002000020000000029b6581ae97b62d844641f3cf39a712e10cbae9014c0330523b85e9a9c91f2f90000000f782599a111b54ac37ffcfb580ea999b93a3d3c99365e33ccac3e80012f46fd786dab2456f6dde624b9b8b2d23d1d6709a2181cf53a4d8b8d0b3c14b704fd3a94611e8a4f8504207610894bb2f82bbcfcf6a45a1d21de60733a5c7d7fa4cc3a2eb3a1d25a92a04fceda10a15af4a775fb69fb77ffbe8d4ccdc2707dd2c3e317052c965ab02b32e551b6e323fa991beb8400000008680ac5bb60af0d7a1e75a0943c7561f2fab8d14036a005c3007ed39ebce0d816143ed9d770c079b45623b0cce8c1d9cfd3ad73f2021413f6e1074d15e93eb37 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409474790" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE 2292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2292 2224 iexplore.exe 18 PID 2224 wrote to memory of 2292 2224 iexplore.exe 18 PID 2224 wrote to memory of 2292 2224 iexplore.exe 18 PID 2224 wrote to memory of 2292 2224 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5802f5c6bdabf71e5e9f3c9602f5433c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55240acac930069bda3c46ee051034cec
SHA1f1717391ebff1c1512c4a42462f045f279ca4e06
SHA256fc51235b7e7e63fb31f6944bd13e6d63ac4cdaa0b07de23def174021468893e7
SHA512832592cb889d3b0348724e9df30bcc0fb82dbfe9f83179d44c1d423c373f413640e437d7f778320bedc794b7733d1f89968cd64ac8cbec5275294fe52c5cd29b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55af532ac6799aad91dad08d2e1394bcf
SHA1268ac1792bfc29b6071bcbbed1013331db7b6e73
SHA25601ead94fa836996b04e61529ab3722d14671b1622b56cb993ab8f7aa44ae1745
SHA5125098a6d4e2f98d4cf04d54606b94dd0b0eae599e4e5a36e8d247f912b1c363bf695518bb70fb1803a7fa7c2ebb9120a1593792b7264ca797aeed4648222aa627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bb21bfa31dcbe7cbef956f7f5231988
SHA1770f800b19638e2308fdf3e99735b0476fe028a1
SHA256168bd45330d1215dd4c65b7d0e7853cf4b5646d5d1589ec19ebef185026e2375
SHA5123d19989f01f9b8f9f0cb206c5ccd30777740ccc33e3a5d2d377a3a445deb44a8630c5c8af3611ba3c4f2c03e0aed78aad1ec400ba8c53509ae48ea3822ef6bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe5355221337e08ceec888cdfdf3bcc1
SHA1b6c09959fc16539958697ff60b7e6664f332ab3f
SHA2569d83b7085ab7dae9b9c90937c4e5eaafc5561e202d66f9e3cd2aaf574f6f7a42
SHA5120399d8373275c197fc05eae2c689786cefc6a982126a6f31de4316aefa3ae984a696c0545dccb546612b5c1bc583218a36996951c55b78d1951149683b3ad84d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a347b489122a7f39bb2df047627c80
SHA185c7519a61e9618a790c20f6b5541e16c96c0b9c
SHA256ddcf36ca24d5834c01608357cb3f2248d4d34b5b90312c0437270c7cdf2edad8
SHA5126b7d36b77fb3f196bbbc70159f179db1f9a7cbe01a570c41a25382a56dc7a1db0b36dd3c578794c67628cab52ca4ce9656fa8821651961c34285cf1918839231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1b3349ed335a01062986b5832cb0778
SHA1f8010005db22e85106fd003b2fa20bbdd6eaae7f
SHA256af0bd91b3e8f667a449eb8b4d610a251da31a48026f3034cc202775b059f4431
SHA512cf319977e231da2c71851147ed4187ba9de1acf384401c8b90ed5b3ba55765a0eaeb9f07bc699c115ac336a1f836ef8b5d7a31ffd1ff702cfa20fa3fdb3c2288
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57019751b0339a2babffa43a89f52e3ca
SHA1868d8c68571e9e356bb38b002d73b4b6592e56b7
SHA256de16bef5de05975642965ae6ead6cad4fdc0ec7de9fa8bc49329f510078f444d
SHA512abe6f4b001c0cf34eb616bc4c5914bdb2ea86bd673f12c6ebf13f2589035bddbda38e762cfd785bda3fc8de99c91f504ce905e1196d5ad4a216c6ef9a2abf5a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5348592c151d5fd48d79fcca836319f8f
SHA19d718dd6fd978fba0c5237901560d4a5a05e807d
SHA2564461a5910292b91cb0fc2bdb448d54de979225ff68f933d64a2d7423f576965a
SHA512c542c49a98a4faeb1f908ba61f730f6cc481ecfc3d1541d020d1e3a3d7af6305b6833a27aa1ed8c972c945632cf755d36e2a5fcf7d4ad572cc5e5d5ca2469ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5053f6bf5bcf21e30a9d959f860ccf3ca
SHA1ee299a5c5530ac91bab577e1455ad4631a2cc8bc
SHA256010d460d0335a366d6410fa20db1ebe39b075978d9fce45b605da4fa62f73f26
SHA512e055fba18a895c48e69f4a2378399e41244c2bfb32f6166b406a98661f81856107b46209547d72a973ebc86432149317133cff2c835b83a0a320ee3b49eb8ba6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c23cd1474e8c4b0506b8b7084bb7c04
SHA176c3cabdf092135a384f455b0b060c504db1f292
SHA256153b7a8d8527db48ef2f9704ede4aba063fc1e3758a328886ac14378c78d5c07
SHA51292fe0e5f31f77d1c2314418a4e9b560342ec5619d6b39aa13dd2afe89dfb28903e9126d6bf86fff705ad9bf1cca94eb0985e94e67a02213a6242c33743b6327f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53576e847418fe70871c2c08518de7d2d
SHA100eaf8b83ffcf359a2c64c8e4e4425bf6a87ba5a
SHA256b8763f80a45682cab3b8b26fafd4faa84fc15f85af013c1ba8a6934c2aec14a3
SHA512f59b0caa2e049bba65eda8bc0dda033ed90adc33e687fa09d3258718a6f8b37303ee44318ca2fb90167fd414363c894504284410c0c18c57b3f2e7dc05039fe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fee253a95529869cf04ab34b398dd9f
SHA150fa06ff2429ae36143871e6e81435a9a86a026f
SHA25675c00f4c27719a4e0c316ffe5e76a9aa6e4c5d81ad70901e34de7727870c5bef
SHA5122b5f8af6909cde96277b83a140e406ef58d55860fe4be4b9de09b32c7009b21f2b8a62527a8f5464d0709df8ce49c3475ff51a6d030341701c69bb24a37f7f7f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06