Analysis
-
max time kernel
0s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 09:44
Static task
static1
Behavioral task
behavioral1
Sample
824bbd6faaa2b88bab7beb5c710fa628.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
824bbd6faaa2b88bab7beb5c710fa628.html
Resource
win10v2004-20231215-en
General
-
Target
824bbd6faaa2b88bab7beb5c710fa628.html
-
Size
79KB
-
MD5
824bbd6faaa2b88bab7beb5c710fa628
-
SHA1
bba97b5aceb162f024813c39ac5a6b34a9ecd6d4
-
SHA256
26563df98872c1ab6a6ef88dee7daf8fc726a1d090ea87cd3e7a226f850f8a72
-
SHA512
7d6f701a04dd429c12d62521bd5b9316df7af9ee99a2e290a38ad0b2269a0a24f454addbae59f5766c641820ea1c12cd02c2e84313c80c5329b3da4c47717d8e
-
SSDEEP
1536:xbIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sb1U:W1+7GgOtVg17eiLvnN1gA
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53F7FB21-A0B7-11EE-A140-5ABF6C2465D5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2524 2348 iexplore.exe 17 PID 2348 wrote to memory of 2524 2348 iexplore.exe 17 PID 2348 wrote to memory of 2524 2348 iexplore.exe 17 PID 2348 wrote to memory of 2524 2348 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\824bbd6faaa2b88bab7beb5c710fa628.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
21KB
MD50b31bc6582dadca6555bb2a8b6ad9903
SHA1d566c85d8c4cd9a0fdb732bbfd89e71008796f46
SHA2561392ee1b2e67e18a95ef55709a5966f4907f937276c02abc060ddb883895afd9
SHA5120a039f66109b972b6dff834bf7a86c75279a4b9561fe7c95502387328eaff01afbe9095b85492dbf62f462e3fe642d49d1456eb219a005533b28095be304a9f4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5ff8cf9f2ca8b5406f1b2085a8f82dde9
SHA17a53b1e5a602e3461ef7eb5b472fa84c8eef27a1
SHA2564ca858c851147cba39e52f240cd1b4cab6ec0ee05621aaf8ad171ba6d44c7e11
SHA5124d5b682ef6afa58e230428187390fb785918c645e94d24cac07a450d7abaa800a5441888c5a76b12361b68d67c4914d8644e5abe8b62eeeb12600dd123613a0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5491b34c933077e0dbbd0f84766da67e4
SHA16bc91f0a59cd52fc30fc2456dede7426b6df6788
SHA256f762bdb570ed0f45a58b28d92a730647a21895abd02b8ddf6a6f10310879c358
SHA5125520577fa115c40637568d33f6f81cd5e66e2f2d1e0365358da76b4114606b627ea0c3960f3e69fca57dd7d0066eda95459fcba902e1473c7613dfdb633f1a2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a02cec92d5c9d423bd09df6d8e418dc1
SHA192b21b5f4366b3e22c4187ee2ea72dc653902b8f
SHA256f01ff68c740839be049eae04cdaf1143da3021718a921491092d79a17459e306
SHA51239f984dfe4ed0331f9b90e4a75883926caa36ea9de8900e42b842469f5242326d83732b89e54240eeadf8b3217d2f19b1592b71d38432edbc70281011a37fa32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edc6c82bd4474cf564a06b223e84a150
SHA1f72233ed333b565262ce88b61cdf2c294e8f13c5
SHA256dd73c3e5ccd65983199f16d96dad223a14626250b124aa7feea0070933c9df65
SHA512f98e82e169e7aeb7455c95fd4fcf3b081bd37ed63140305437ff41a4dcfbed4e9eb1c315e73b1fdb2d2dca90b84a821771a10ac65d1b1a190e81c3d4ca46e707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc7ce8889cf358806a164dc364ddb5d9
SHA14c93119cb528f0dd249432d7a0205b484fe2fa88
SHA25699c0d66b8e1c2886bf4e1672e35b20c219498618dd3545371c31634dccb29a61
SHA5120bcefba80a5127b4ea881c354e4071b15cd0c4c8d3749ecce8a4583b5c0eb5c84308720874a8203e6236f2e05f90a516c073c2bc17b0b75dd5da7abc466d989e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58abd02b0b57900ab664e760fccd2c91c
SHA1549de8b541963d3ff113a7dfd030fd2efdc2f3a2
SHA256cd8c3f46a2745b9334f233237ae49158527788b44fb8d9c007d53e967fad83c2
SHA51267a8df7a8298146df6b2f7da84a3e28f5f419b9ae0eae6f584689884255982640a198ae9ee49cf2bfc250c2907271b9a158302051592260c6399e001e97e6edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5110089d7b1a71b67879956b375e905aa
SHA1c70980e31ad8c94d8b3a6ec4b98c98a0f05aa7dc
SHA2561768cf4b43831c0535b5e2d790e338a1659103f6de5abad1028549091cf2164f
SHA5124ca79e3e8bfe5109416011c223eb582d491ba485306c73190ea8c5730e9f6cc1ef6192bec1e82a2b827cd1ce4ebdb0e4da629fa0f382cf15dd390e99dbd2e818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b401a2ad63ff0545ef47624bec61263
SHA1349f0bf8b65f411ed6fec53eade950174a244081
SHA256a3d350cc47c573b0220195891e4bf4a496b8e5c8eac07beaf1d598e16cff3de1
SHA512b523aab4eb5e81564a39da081a1ad513f2ef68c4a2a162ecf410b1199f282e2afb066fa0cc8bbcca3384da4295760e288e84e02bb08886a8abee89f63f64c436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0cfb898782e055ad9f76539ad2bb707
SHA188110a1a7d38e89f94a3d67046cadff9d9d7d0e8
SHA256259b36c61bfdc914a83e702b4253848e2dde11091beb187611d95823b39dc708
SHA51205351c07daeb4f75f39c6ab6f5fffe0b7c0ddde3883e4a6a2d7b0ff0f3e1cb6cffdfc69957bc7e621ec26a2133437de98d3d444075f6b01e6134d484049e280f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5794210c204bfe92f67911e9743df428d
SHA11d049017597dca3444fde40036ae160299224a1e
SHA256c16798208bd9408da94f60a87a7892ad13a3e84383e46cb3658e3eb649976a30
SHA512ecf1a588633fb0bacb000952191aca3b266fbcbb0403667a8fe06f4e0c5ba32d2330bb4b33079ce4d698d24d9636ba3f53f0c5fb68871ec89d12ca782317b51b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb6e8de638c4f4c1de55439f0058b90f
SHA19edf9c59fb72d1dfb978ae8bd168334473ef431e
SHA256949ff54286eae95028090a88c8b1cd1705d7d6438a3c13a05f56b54a0acbba0f
SHA512806ec95b6c3969cfacbaffcdb9bfe0756a478dad4fced24cb2670ba24980a8f1aa9080d28ec4798087c786794b6bafd36d84b7a3e55c3809e7946c5a9703a3cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd11b0eea617a5091f330d8f913a3a59
SHA1027d82d2109e53613bba0debee10c5d8da0f80ae
SHA256cfe19b55ee3bf2fc30ddf3cfc1e8d4988fd0cfb5749e92358cda432c7eaf30dc
SHA512e9af7a63388d8be33bc514153a7100c4460dfb123288df525f71d8563f43a8d14d76c19d5beef99734e09b851c3b94143b0fe83237f82b56ba629e913e43599c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7a3fc908b04a642f8f50e407ab200ee
SHA108e7438d8fab76b5279231ff132d5899964dd838
SHA256b951f75e48b8f458c192a0c7b15a9d3cdeee7d8a82dd938baaf3fde4a1f6ffc4
SHA512df1eada45b5f0ad8763434dd632bf02d6b20d58b64c7c0cd313f2a04e622a9fce127e6398c6aec924c97058fe60b83deabd80641de3fbb5ab61190d3034ce31a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1de9136a23689f041123db146d2e2eb
SHA18188854a9580b376409cd07a271382fdf364e3ea
SHA25645da457f4acf45c170cb09fecc793432b14702fe70251638fe245aa34fe3c011
SHA5127e2cb339b3b761e10bd7353089abcff59ccfbf1ec8c7c2723d4e1fbda2a0db20c25553e5c957dbbcb458c21ff323608f785835542951c8fff1a3ee7fcf9e2e08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fc85b3781dec0bee0aa437e09823117
SHA14a01f6b50d13b4800f080be5d32904620650a40d
SHA256e79fb4a51f3b9ebacba14e7f3ed0591d04cfc8f2a141362c9d90f0b06c398f6e
SHA5125ae98ebaf566e3421ff71cedea51f95810da56e94c7e2b88111dcecc3c5b9c5bd4b1f5beb6ff4dbdd7cb8324201ba4748e149c0bfca7276ca1f4728397a19d56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d4a9aa68f58adf121dfaddeb28dd418
SHA17bff019f5f8204e75b999f2a5ad4e4d4dd9e73f8
SHA256f46a012da64848fd3476ef8dd2aac77efbe9322dd45dd9142cd8509dbf3ce8c6
SHA512f8bc6dd0832c8e2db410988bb950e37602957d1779107de4fe75927ffe1242b88731550d710a48469df432a9a6bc4936392fbedf3e8e2c786e3e9bc8db65f506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510a75616e8b667fd07d907ebc714f30c
SHA1d68a1deca82ce9d68192ee60b6fc4f4d8c1bc7eb
SHA256e51050d9b97d767bb06b973948df61b82c84d3fa4cc4c6b589fb69816b635b33
SHA5127e2a5f7bd23a5430eef916d706f76877ce574c0adf77d951cea11abf6c8eeb9c7f589234c9e13620d1bafa5cad42495e12c7c9f9ac9c9229a1b707f3adb8316c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8ed3234d7017435e37411139bb2ca27
SHA1351264a3af344e436335948e5898e3061441c782
SHA25662ba2876b5e5c82d959a3df3d06d59d3e3282e520622a14a706da4c63f9bbeef
SHA5127386e6a1ef4498c298641b48346cd02ad1968acfcedb7ba7b6ee3e9ee72e5523f717b86e2336984d864e59fd5f3fd451ec57414bdb592b2a5812db51a3cc2f34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e239b67ed11d74197dbaaaa7cd808638
SHA121d57e13494bd51f7f7603f9e92736346a548a15
SHA2565afcc32816ba029d8c90f1ab393b6004408c53748072cfdb3b4c9bc63f04a85d
SHA51261fa8fbe310892a40b773ac8433195727a174cb0a24f8e9b690063d1b1360c731f658b53c37eee4b26913c57fcab5f4a346648cc124fbd7c0384b706e666a0ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538870b5f348a3d7a4d0a2b660b53cdec
SHA13feea1d38ee1bd41792592c65c80a5ee530ea90a
SHA256d2b3c4e190bf4026e5d3f7d78d63acf259caa4de5f30a2c687a63fd8886b01fb
SHA51299a8d3f27fce3b0a742397e2a25a2db7a0a7b395bfa2d9347715d411ba49d574ea6997697e99528cec97a8e86f2b05e862dc4d798185d006260a1b6928bafb16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5df9c6de395c023e4d5980754dd683d7d
SHA175f25a138069f2c9435efc9d7970494f5df0062e
SHA256c0b7962c2263268b22f6c1528f0bfa0c3a4fd4817af5d679c89b1eee7ed431f0
SHA512014a4c3ac681ded733974eac9894ab0a4a80c405f99fa57eff78897472e0b9d5ae1c403914c78f6a6d2ccf3deeb52e7e7234326f3d237a7c3465c2b6c9fead2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06