Analysis
-
max time kernel
139s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 08:54
Static task
static1
Behavioral task
behavioral1
Sample
7f200365098fc02b69df2cece9cf7f08.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f200365098fc02b69df2cece9cf7f08.html
Resource
win10v2004-20231215-en
General
-
Target
7f200365098fc02b69df2cece9cf7f08.html
-
Size
568B
-
MD5
7f200365098fc02b69df2cece9cf7f08
-
SHA1
1d07fe5224fc54784e6dbf199fdb7a75d70605c8
-
SHA256
f45d1c448765ef7ec8e449e14f7ff0b3e88d87bd12106a9948dc51cc7028682b
-
SHA512
577b27d844b5b15356450b0f24d6d15bd896fdf6ca2f35f7345cacd9a638945db6b530d0114e16ebdaff02ae04543b659a82c4bd409bade762125f5763f337ca
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B36B6D1-A193-11EE-8183-5E688C03EF37} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000287096aa8e07babb04b29249a94ad7840ae0aaaaf59ee862eafcd5699e08ab21000000000e80000000020000200000006e1633296d174f59fef3a1e68e3f8d240636b3a311fe18c123e9e32b36f4dba590000000a4f3bbb771d35878930deaf46449cc1da1d47f6ff8ce5e8d6b663708a21fb974aa7346446441f13be049e6f0ee3606d5014b25c4037c8c10d16880d59897533d586d322fc0dcd20f6a3ccfd1d91d3e6a6045ced13fa3e9a48c103256ce9705be278c4a3915e0c3ab3c0c8da86909ed7f48841689ee13fe0ee6300cb48cb064bf7036e82f400a61b15f6e9431285ba21b400000003b2c566cddf7ccbdca164e7b7e59b4aaebd5ec83f1fd45fd9682e512541908c0bcd4a8f60f6b95ac4cd7cd9e80d7b3abbcf4f819c91b07cfa21b0d7db155a918 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f27614a035da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409498295" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005ab31ffdb41a2705606894c5acf22e29324d39b58dd9315b100a2d6ac3f437e2000000000e8000000002000020000000203300b52c504e61af3459f3efdb2a04713c7e27dbb4659918b0d56e427e1da4200000007905a94cb6476096a9389f10c2e8db5d4dd812a6180a1c0dadcbfd78808778df40000000aa9ef2344f3310ce710ead87e8bc65a8d59153e7aec467079c1c3508e0fdcba03b68a7f320819f95d48efb259782714ae6a3ca5facf1e7dd4732a5d97328fce1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2672 2184 iexplore.exe 28 PID 2184 wrote to memory of 2672 2184 iexplore.exe 28 PID 2184 wrote to memory of 2672 2184 iexplore.exe 28 PID 2184 wrote to memory of 2672 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f200365098fc02b69df2cece9cf7f08.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53de36f3e45e9cdc67bc4276da55df5b5
SHA1520028ec6ee3a64622902b332f5f5f1e5da3631f
SHA256de2ee335073291c9c348bb13e2477decbabcb2461ca0a46357b4c278a174919f
SHA5120be36124c35e07a23a2ee146aa1e53dfbf1e5be22d78eecbd1fe89eb1529e7488c162d67a803abb02796466d2eddf9aabfcb9b75a4e0781d34354552ac80b9c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e349ea010496c44e6a6fe4c37a02fc0
SHA164602fec183c8da179dc80b73057fdf70e595ba2
SHA2562637fa8b7ebe4e43ce5086e4ece931814dd8ead4a4fc2d43d7212be71c16064c
SHA51272b91b5fd0d794af26cc89ccb832a6c8dd8ddc849646b48334480efc62954e61e4a3b4d7e99f33b1ef95205e5a8299888ca3614358f3a37cb4f9b6ded29254be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9c865244984c441c13620afa69b2464
SHA1e6689aa670f71b0c21fd611acf2d0bf34d7c654f
SHA2564b331f9d13c568bba4e1405ba025c9310ab26f9f62e3a7fadb47eb5d41d6e0b2
SHA5129a149a6a5983d09996afdebb416f764ca4dbabf00157bed10442c7dee01318571dd21333b8117e0059f0b7dbabaadf3eb5391a31a9a0b772ff0ab971de63ee9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563b301cdb29f48fa33eb77c0c925b2b0
SHA1c58d1cbaa1b992c70c1d2efffd7fb6815f388c13
SHA25686ee6ad564efdcecf3bdeb0919f95f61b4eaf2031ca94c7ab6993b9c4c624fe0
SHA5125709fcd82b7f9f94fba445bfae7503c8103ab4383b8da64632eba1dc4fab6cab5098731d0307518631789954532e29441c24505821679d2e7df5467ba190592c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564c6455d1887ac7b154db88ac815f108
SHA19ccd7493c186dc924e90edb4dd291821aeacb550
SHA256aeeb0aa4dd6be9954121918ad7e1e04717fd0780d176174e52c3aa0c199c7ef9
SHA512ede09ef98ed3562bff7ca5978ab25783ad8af7756f964b94c7469e2d2d71a76a37ada9e82d1e8eb9f691c14032b60b87469fec936ef40cbf6592302b2052b439
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e9ed70d541c2d6255325ce520a601c8
SHA1c966006fbd049e8b1c59b2dee58a63e83783435f
SHA256f8a9cd5751e385b4cf27c300c4aee5421c75109633d38a98362a701603681861
SHA512ab1b68401b27fca81ed52e74f2e72a76f3d582f2088c1586460debe6e173c0cd0faf82f7548b372dbc619d7bab67c0c30d8145b8a7d347bb130abd3d9dbca612
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590393544c674e34246b5248b1789a7a6
SHA1adedbf0896626de1ad35bb91c49aad42a8a18d02
SHA25651ff25225ded88fc3aad5fa3cdedaf31c19b3378203b832e077582a7fd56be70
SHA51202fd6ca5a8e30a64a84f5c1068c54386a5c1853b20aa9b850bbff219065b065a9ae7a837394f688b7b1c08a83a6da7bb261bb38cf6db7b847904b9846a51318d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522c8c98b2eebf11179119b6136b0e03f
SHA11a35f572068c071ac5c207f35dad645d1d7d5782
SHA25605a1e8a22498079713faeaed7ca72ace3cbee4ee852a230109963ba1eaa773e6
SHA51209f6226c6f9445fedfaccdf020ada6380151ba1d277c8fd151161b73e64b702237d0fc501bf63057d377769164abf0a7200acc5e5f08f516ff2a3b2735a2f9d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acb559ca8f48944e5b48825add7f79f7
SHA15bcfeb29d4aeb6b4da90451c536f2b324e26ae63
SHA2566e4c23ba753e89cdded45bbefc33ed2af4eb3a1f5e37773f6688c3d775cd0f32
SHA5121592ee68e6cd1cfb08031ef8eef6c4546d25f968f2684167e4ff3b353fd6f2ebdc8f556938a4de33ab4c1f1a7a9a2595c161a4b80c2c1efc905734364f6513b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a3bdb780565a032f61ab86f1ad1539a
SHA1db0d49de3a15c0c28aff75fe010242867cf5ba00
SHA2566c3b95721f0ac44431a92cb3220a6d685ec1ffdca9747747a683b14a14ce0b82
SHA5124d2cfbab2777fe0a9a6348b8bfd470903455e67459f7befc27ca62d2a35e3111ae712b70e83e13612029a8b205ca247d302986eeeaaf4f893c979961e90ed95a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e2f74893dcc9241978526ea49281b21
SHA1d0e09fa348e48d905b9c8d1ca132683a92610d53
SHA256e5d83b3436b48c5c988a66e81c708088dab1cdc0b2dc7aa36d6a15be36cdba63
SHA512c72f45df433282ca51ed74adee15778e32d37e5c5c5e0afd32bcb4ff44a85f5c10ba4802801f0e6c9b2b02e3d99cc51d3969ce312e7529a0106cb065722445e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ead97eb01cf4632d138e8599c5d3aa3a
SHA14c80bdfc68ee60a1dbfb60c963ca1d90c4924bd3
SHA25653783c707dd1e1dc3af3ad482d22ce970d69ae2fcc7e21a7b27f090173fbe2eb
SHA5120983054e25e1903a132c9074bab5c84f380d8f3f6eb68df78c0afb46198b34b5a2049bcd0b44f547fd27c45df1de513871c33254d933e699a5ce3d5f260677ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c145eae1b6aa95fd9ba34953ccd5340
SHA1d900910a755a048813e7d447c021b8b92b379e5d
SHA25626c0b40f553550657653f6954b93bbd127d6f29e967557c53a3dafc88b17efa0
SHA512051568ad3eb1b54f031581d7def80a7f0d5c460814f7c788370045cc0e0c22e8e90a2f4513e88544d559d68304d1fc4adbcd75ffd18c47e804397dcab28bcd51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5673626196050b68266453d03030a9a6a
SHA18cff0ce7d5facd49f28c0496de7c7338fcb3a6c1
SHA2569c0c8e7ad4389a7552177b15b2e1150b9fd4b892915e8db9c05725c9397fada7
SHA51281d099b55142a6e33b5eab71424311e77a03ef04f95f8d67821625064125e78952a611295b017327e948d808b7786277bd19d4263cfbcb70eb660693e69e87c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be95f4aa91596a2ab1fd74501a248854
SHA1ea9e1938a6ad51f8f9b5ee18e31f140ceee9c50a
SHA2566f2e9d15acfbe729a75d0c285198e0017397d90f2f540c43264e85acc1fc77ef
SHA5122b32ed4f2d52048f8c9e46da3e18c87f94d0c1c1438766b80b556d344401aee1e655dde04e95d9e1ba12d4c823c219c9e33e88d1107bf7f9f774fa60309a2fb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fcbbb52225aec361c93ba6dcd8e7199
SHA1cec8dd735f8e92cbb7523bd09af6e040362867db
SHA25638176ca63c5366ffb904a8ae16415d2b869f3c56574e53389af7a205c8db7128
SHA512d5e11a2bf0fc1ce2beeb0ac361434dbe686c84d103f435e9e18c57c76ec0d96e9fd76e7cf4a19a447ededb09144508947643dce69f7cc98da5539c47c9477180
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9a92a331aef4452e546ce6bc410a772
SHA1d4c8c47c0a1479963ca77478008e1e4c406f477c
SHA256e7f431a60ae011785dd1073e83dd6511b3cfe515b6bb74876a1dc4bb218c14fe
SHA512a6ccf2d7e0889252bded1c5c9c680ad4484c71bec7a111d105154ae391b3d35069b2f1925fd529be2aea345237a16b306f32fb736a302da5730d6b075efc7143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc3ea106b826957b538372b308652dd1
SHA1cfc94d54466dbbcafe031e2f75e129e3a6a3a2eb
SHA256830542101aaa7d81198f618885d663cf46d06d2c52afe243b9bc4dee2beb9ef9
SHA512e4c4a70aa89599044791e02dec729ca44ca9a918ea4c5bb73e401515f8c24b68371a28ae6299b1f27b108a34eea8ea3079ce88ccc0f6354669dea0cc2bdde5d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4482d021c9c593d28d4db78acf5c7d0
SHA1461703b76a55ace5f73f164c93a3de22e20ca448
SHA256def1969c58b4b280d770eff55e377d31555a687d34628304f0bf98ce739af59d
SHA5129845e903d288ea54b097e9f3a0558806f6f2e381f71a1641fbf4e66ddb974ca2b811352049dd5303fc2605ded03aca0f9b813abda63a96f7eb8c484844fb770e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5a4142c129cd698d0278a4fe1f10b4a
SHA140492784d2ebab585f1cf0022e7922523c636936
SHA2561fbe8aa23e6f76553a5acdf5d313b3377b2aafa844e62db59b9978ba109957a2
SHA5124028ea61bec9f43cfb2298dbc6d6cbf22b3e037dd196231bb50dd06ebc8fb110a61ee8fea73c324bf31a7cb6bb64088c907191516a6432666e1cdd18ff7bf491
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06