Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 04:09
Static task
static1
Behavioral task
behavioral1
Sample
60ee1d4114bcb4e97afcab786d7c4abc.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
60ee1d4114bcb4e97afcab786d7c4abc.html
Resource
win10v2004-20231215-en
General
-
Target
60ee1d4114bcb4e97afcab786d7c4abc.html
-
Size
25KB
-
MD5
60ee1d4114bcb4e97afcab786d7c4abc
-
SHA1
1b77865d1da96f02db5eac6d5f6674885cf8dec1
-
SHA256
a7dd61b5836742af9f7fea8d9775ec5e974cb56ca7928c22e068272db4529e89
-
SHA512
83b74409469fd9709f021ebe2e3b1c965869ae1eafe1e7b5e47270bc8d6279c0d7f581f46da91ea290cc1f7b1e3ff199179c12ac5553688d1963daa82419cecc
-
SSDEEP
384:xy1R1QREDBeCliOBs1jBD5hECCa6XYa68ls4K8dXwRcYuo6CPRrMO77OM0TCtxYW:xy1R1DeCUOm1jBD5hECh6XYagLV77OQB
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a11f9e31de9af1ac7872e877c19f787b4f042051c4af8af81891ee7341bfed20000000000e80000000020000200000009f937596654246718006018130a724a0f8464073f86dbbf0c9c95f75fed1ad7a20000000176eaedac4607deab518f1cc7b685bbcd7241e8415f7c703af1a3757a2791edd400000002cf1003f0a4ea617981452355c2041cf998712f0ba1bcfc03ec505801bdac287fb0c2db984a83470fed9a8ca144af3b839ae08cc42b09fde350358b7aab6253c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001e36387a2a628670bdddcedec0ca913516da9a4e888c74dd1049ce0c626af14d000000000e8000000002000020000000d6fcb0bb9de481a8bb8724ecbab113c08296ec9b61f35b5bd4cb870082d30364900000006162e7d8547d9f164d31f7a5fdd511bd44ef5c18e7c374648e620b19ae6763a83d461a6d5d97e45e1949f53543140226e4cd7450024c018a43a1cfc30758e928bcce2620edce547a1d88d046e6de8efcb7e813ce28f1cc5d247aa5870f34abedd1183271a24fb81d71b7b263f4a449fe3fce74c7c5f03689149386d888fae44b2a9956a14a3f21046109ffbb0408e18a400000008c8906b701aee190931cab213102cda81ed70fc3df116b156c2066ab81f8ec1a46988f8c612e5d3ed4911777597b2de2cd506ab7bc58fb114deecba7ddaf85f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0022bac7aa34da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409392941" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2610411-A09D-11EE-A2F4-4AE60EE50717} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2488 2932 iexplore.exe 28 PID 2932 wrote to memory of 2488 2932 iexplore.exe 28 PID 2932 wrote to memory of 2488 2932 iexplore.exe 28 PID 2932 wrote to memory of 2488 2932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60ee1d4114bcb4e97afcab786d7c4abc.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567817c79273895aeb794b3e485c481cc
SHA16de23ff1228c139625b774d727a7658c00837356
SHA25687ee5419a4a982c240078af6de6663106bc6a0c27c103238646b27b61817c4fb
SHA5122406a599e5aada10d00be162abdc04b94e970af0f618fc37e25f51c84dce42b4584ccb74179e77d7654496c796c8220ffcde70e62ac55469a9a16ce279b731a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519e0119f76f2686f06cbe7fa7f1f1ea5
SHA1dd3f822cf9dc70c1928d27a6fc125c9e66b687a4
SHA25619722404393a3b1dcf6f4a8ed2d5250e57a5126b560dcbcaf8ab8b29d60540dd
SHA5128a0d75e0bed57e74a508b0527335497b707ded4944c3d3f2b937a1b9772b56bcbbe1d560d06b241a2d822ea4bb88eb1f8c2629bda60c1725763886f0b6f967f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5131ceecee2dd2460bbea9075c74371c0
SHA10f11367c09ff68696b032b1f382d80cddc3ecaca
SHA2561551a53324ee73cd480d4e9bd8e91b124cb97f0aa841fb7d5db45aa1c1c9b530
SHA512ef9418dd384fc933445f4565a1defca8225333f758ca92ccae2ccbbaab3e3e4c56786d65d239ecac299681c41efc1f302624df61bcdc27e4c0b131b899b8501f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5a1c078a05f096f6ea8e8e562255256
SHA1650c0da077e8d3eb9417f4feb8c647a56bcd3aa1
SHA2563d5218baaf3485f424d8a89d4e2e42fe90b2f8c318993d43c18e6c2922dfd45b
SHA51233b1c8de01eb1034dddb3fab27bdd59fbc5994b80e6766dc830669e0ff2410a3fa492324a474d334fbf1edc64ab75ea97180900c3df524a280366f9d6ed1cd2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564e5ad85131de208e11b56512d714982
SHA1f10582466abac6dac50527b2fb380974352833cd
SHA256ba10c364f454b1e75ec338c5bc43216170f8307200308fce5ffd3d7a0a38697a
SHA512e40cead65ac56c08e2c9cd5f4f1855a3cdd543e992f319e820ab68e7bab3f771bc72444659f1ba68a1bbfcfaeec818e50576120b4de23ef08c0ee36ca3fa2b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9aacd0d2364c084c2df6e4cdfd75e08
SHA102d0f038ac79638da03ec740f9f6ea15b695d7e6
SHA25615899b81d7f1112cb915146da1702058fc8dd939039475427c02d063e8643b6e
SHA5128e88cb4dfa34da46d923d92afc4a172d156dd76c018a6810d165674188df012b856f7511f4d75fece0bcd6830f5d9298b42ce74e84cfe5eff5832835c3700028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e3b66734b9b3db07701a55aa01fe363
SHA1ee1f54d89e5da02c08048686700a8bfee07f4762
SHA2561485d774330d0b1bc6c0bd56439238caa3250fe1fb049cdfefff78cb5001d0e3
SHA512907c261a0b2a91917a3246608de773eb81397d430ecbe9becb6d4f11ce617eaad49ea9dfe8dfab7b1fe32675d87145b86b9ac230fa1be12b077238694834bacb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b36073d27771590b64e4b550e3280a1
SHA1018115f25823c54243cf03a9a104b1602cbbdd1a
SHA2564c630855433c93a8166a476a1ce2cbe22642930e843d9e5053e0bc07b57d3760
SHA512bb075db13e50b79f643f63271a7546f8b0f5e8e508467d8450beba2f2a44f439fbd2337b7b04007c9b55b2c59fe85a6292fc3335e73983d5ea9a95d93d4c05b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59984c09677432e95e65e132f49b25588
SHA1c05d71fec3b980c3ba01a6954872123f55885b1e
SHA256cb5170a88b5ea89e060dac0eb81970ae3643351185b824185e7c3250b9998655
SHA512ad3828b4f37ffef55554871654537293cdd90c154c0b4bd4df5acab0b2a3f73f5098f39da5c4f37f118542529b76db5c9e76c3096050d7630beeff7b0228996a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f506e7d10c091611a9e5301ce00905d
SHA158c597628dccacca09f641927bdd1021f7f9e123
SHA256facd28635cafd8396a62e726cfcfd9c379e34090eb6281c62c11514ea86e34f2
SHA512e509b68b5550715127d8acbc6cba50f99ddf6bc6e958267ee12434c6386d10059441586f40e9ce602ab90e4a26422fdd581ff65601da0eb913ea4fb1b317372c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e2e8af646565d90fb1449b8208e52ae
SHA1092e1e45e381ede0b5af5a978a69f6b08ea647fb
SHA2569c4cde21d91b16b01ea7853f1fa5836f63af7b2836d93714762351cb7b03c5a2
SHA5126d930c3e27e65bed4eab57dc3f05db683ba7fe83b55eba290f62951662a7050cd2ac87d80256361b87f112bf94cd3035ba0b4f98d7402644e3cdc04b0b9bd0e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb185cbce3eb95e794b3ecb37ffa2c50
SHA168bd617e9bccdcab87da37455b498764af04b829
SHA256d31f19e0b8e68c001dc0679f85c051569f6ff88b778feaf44ead61758f6d47f8
SHA512a19a0252ca9c99d365152200e9544395945ccb0c5e7aa8549299681c9b45aa54ac286217e9f5fe9867c8aa795ff2e1e7520160de17a2c9d0b80344e0b52fe939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51975a96c4e22d6e05b7cdf3e814fdd39
SHA1a82fb0c56f449c860c03b7e1d714addf1ece9f58
SHA256e48e79f4d543d63397ee45b07bedd83d4f67b08f2f084c8e8c3e0acc8628b6d0
SHA5128aef61790d9be0ff3b6ac364264ed20f106a74f3123543a2906069b191a0cdac1cc0913c77c2f924f40badf580599d268485177539569f4c0273f8c144cb2415
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5080f778d82a01b00eaee12b90dfb9491
SHA1db4584b7dd4cef8ee474192675ff73f14c8035e1
SHA256880a36ab468cfbd79036370aae3f4689cbad838802bb3d8bf55e0cafaf2d0f29
SHA51271735a0c2ae8f5565fbcc7f88b2b1075decb539e74004261540699efb0e968344b0c5b74550f59b30fb5aa4787b7543248fac0383ecadf35ae854876a1c01277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc04f2f2e51a1b06b77cbafabf167600
SHA1d5fda00fa6380b4ae221d26307782eae02972cc3
SHA2564e3f651c993d31fcc7c570de182773f60e13a0ac713df5cb75c90b522d1c15a0
SHA512854eafd42ee357cbdacf9355e7bfdf29e40659078346bb40ea152570a1072b1953a3caffb6479f6ade14ddc1d2a4887354f4df9bf9f77d4230ba2fbb8645f428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a63d5bdd36ffad429f02a8399f6a592e
SHA1df337fd911644056bda76ee6f9d62845cd2cc149
SHA2563ef18a2206b4fd1bc9e0b2de489894459ee26bd9b55d38e023f8ca09b9f230b6
SHA512a1889e43f306de8e3a61332ebd6215162f14226cd8e21f9595b4cbb2a80e96f97981ba4d81f50d71b3ac099d42748b9e714b24b8dd51e3822ecfd5ef7e1b7140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a24b39c5387b0e1f67fb2b7e4d98246
SHA1a63e8bc71711d2d367d67d6a1e187cb9fb158323
SHA2563ec00ed86276d8ec8c1cce26edd790e99d19dcd456f7bb7548910a84a5a4257b
SHA512f5d6c2a4310c667192ea7a8e793217397cc68bc6db2ac27202eb35d40b098968d863ce5568f89ed7218144f9f01e5f017b6c5db72705d5f8166608365d541cc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2f0742cfc5f99667d1ab6922f26a246
SHA1862ed878c6ef2ea813a2dfebcd620667b3424f6e
SHA256125ad670d21fc0815d94d45242c1d5ce2475ad735abab0adc75cdc20d6701a0d
SHA512eacd1e5aff5d1f4a8985bc82515348c137777c5738adefa2ef5680c54a2b225f423409f8e5fbed2341156af7bfb86febd0425d15f584f1819807b6930c6556a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55364a7380e9384d3d7cf92f8127ad296
SHA1fa2aeb2598176d5fd0470ec0620d4f8c12d3bbe6
SHA256b9b82f4ba55e931d08e36dc979237490fc07b29b4cd031315221464af49c1ffe
SHA51219c06dd834e9bc50eaaaef4982bb5c53a838cb6458577243dea32f829cbd2a79413b33ddcaa831d06547ff2574635123cbf3ce8cf22b6fddabf8851ffbce0f3c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06