Analysis
-
max time kernel
0s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 11:19
Static task
static1
Behavioral task
behavioral1
Sample
880655367dcf4bd67d01fe5465c7f861.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
880655367dcf4bd67d01fe5465c7f861.html
Resource
win10v2004-20231215-en
General
-
Target
880655367dcf4bd67d01fe5465c7f861.html
-
Size
9KB
-
MD5
880655367dcf4bd67d01fe5465c7f861
-
SHA1
71897e14825a84ee8441ca23a2e6ede8a053d717
-
SHA256
6916f0ccbbe43529fbfb60468fa1ba52f19ca6062a8c756926836d1469e187da
-
SHA512
a0771bd1dfe7d620b962d10a7994f6e76934c6712861f4cfa7d92d9a01dffc2457dfbb8080dbefed7e11c2916703ff84d05a4ff11cd3240b1691f840ab4b1f8a
-
SSDEEP
192:UYWa12+YkA/cuxx5OTuKSxFyAK12yvsQYiZa6eMjF3hAT6am:FJVOHkyDIAK1XHzZ1eyRAT6Z
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07339B71-A1A0-11EE-B0EB-D691EE3F3902} = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3052 2872 iexplore.exe 16 PID 2872 wrote to memory of 3052 2872 iexplore.exe 16 PID 2872 wrote to memory of 3052 2872 iexplore.exe 16 PID 2872 wrote to memory of 3052 2872 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\880655367dcf4bd67d01fe5465c7f861.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
44KB
MD5c3a7d15e1d9bfc0f38cdecea1b806c16
SHA18439a5dc86a35494486d617dc422a6e37fa67b51
SHA256c843c522affcf0c2f9d131a6d3b19f8428ca99e586d07bfd760ea0446dd9e158
SHA51268a0e2879da44682c50e97af5db1fa83bbf4a8acd44e80040e14d4b88c118bf5b107d1167cd1b91a99c904207deeb471851577ad1c92949989870d00ffc15a92
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5bd5af67a041a93fdf9ffe085dfe2034c
SHA1a77588f74bea264040aae29763f5bf6181338247
SHA2565c136dcbf7217b0cdd1b1a123481a9829259b27156a756329fe4eaedddcb5d95
SHA512c23e56709a820ebf8309af1131dd833687491e679ad80c1552bbf20684171419855ec924a5719f1e89369b9374a74a2f221b9f83550484729c63d5426303aeaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9fe6e00b10148bf1d5df8090d1a3c6f
SHA1add5ad4b034c223284402129c291aa0ecb9194d9
SHA2565d05ef726f9cede352715257e24666e7dced23968ac43bd05d1326a53cbd90eb
SHA512d9223185e4bb29912bd1eaf9e1cdfc2a45dd83f5de8a17a2cae3b3e7f9384efe5e89aede1f6c2f154306d88f27bd3808a403ea689fbca53bc351f66fac22ef03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c61011da52934e13897101e7a02fee8f
SHA1d2b3daef2789c13f7023fbf6de8071b3dcf25868
SHA2566d738df54ba9de39e33ed548136ae04a3f3654f688271fcc10e89ad1b310c5b8
SHA51252f5b595b11d6b862ff7dca62b82be73b892720d8b6c82b4bc775fd78cca567afd874e9d263fa45e3b1d931f97af25971f435e617f951a2d5e3fae159893b8dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e4d2d82b9e31bf01c73d6402e041a9f
SHA1d13ecd6c55ea6edc4624f6e4bdb27011c72a295d
SHA256058dee14ca4f279ec1b3d7fe07abf7c5bcd681ff394885716ccdf9cf48109852
SHA512699de3f1793e8706bde522cc444553aa522a52123b6a80985598cbd1cb2e6e38372617ea4fe4908dea9de405dea3f4ebe40f7b976472b7a95508afe2d3d68cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eddb2327a5c54389a3c4a4022d7977a
SHA14ae8ed19bc58ec36fb217017bfd440363423ca82
SHA2564c88f839f491cbd0ba9d603215161a1f49b7ca1906709ee1a41c6ca38c4d8896
SHA512af2147da233f770e2a50af5e459b4da73cd8528cc372350f87de48bb8cdbbcfac95c85ab7e0a96d679032df77a2693b48966f82603e23a74ca09e26fc0d11788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b5618ab78582d077e25b7dbdc4c737c
SHA129ace12bff9624df6a43e8e9b77892f78cb4f21e
SHA25646f880f6c3c1c4fc71226a1d51a5059ab08a3d132675b372ab4456bfe5cdb587
SHA51295fd7592b3af26947cbbe4e7cf21653fdcde120362911591311944e537dfa9b78b057c5412dd398533d9dc9cf7482e9e00cbfdcdf92d66ae095aa62d3a340ba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5091900d3dbc413934ddaede2a95f3e1f
SHA1a2624d6a95c8a98248cf385ecae3bc51b3e973e0
SHA256afb27e38a8c60c73d61220a4db56ab80fbed8ae93ae0ff2776d11201ca962e08
SHA512b38ee800a210d3c02c992d4df2d4ed0cc32e66bfa1398775a26e49dbd4288f3dfabfde561d86cafabe57e7c9fb43a28e62405b60a16203eb95533ec739d9da22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580fb7fd80c7d878cc2dbdf204287516d
SHA1de3b79694d04cc1716a16530a5354bb71563725f
SHA2564903a278bf782a01cac8f1ff263d8d2ad100bc9f6502400fb37ef4ee7f23b6ca
SHA5127b5caa2a9bb0b40cc81108274d7e453316f1c1537d6b4031bb8f8ba4cabf93c8c76669f93e49aded8a0646e78018f4e38043298dcfa47a26ae3029e41a91f5b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515f500e857694fde4cc08628b6d360fd
SHA14a5812ba02b0706d01021b226a2a9026796f34e2
SHA256bc16016c2aae03c550749076ca702ee1425d3132762570ca1989fca5cc3f49f8
SHA51277fa7fc5fff5349bc6ae0c2613d1bb12254425aa64f2c89f3da61503c4877214c6481e512b9f43ceee44193f7c8219ddba373888004ba307f329e709334d77fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b563478ec42add3e06a66483d99c0425
SHA19d8ca2371d83c0fffa086f9d4221c46f0bb55404
SHA2563df8b62513f29421a5a30551a74256e9e93b49c668de50c41285b5184e0ffb05
SHA5125afca1ec301958a6c453b2e81b09971dd68401963ebe73eb18c9d865a1cef2835f9ab0a17a0543d387ab86f28888ebd1f47381d27ea5e9190db125cf3392a5b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e31ff4fc790318f9f6d9071a69687cd
SHA195cef1304620e19bcc9e6d94586151d892611b36
SHA256ce0d4238c35cae5ae3b3370cd025e8111d6ab32ee656a868d65486e40e8b3d01
SHA51201529f67e9d8730d49a6ae3ea1d253724bb4e76d9ede1ebe944a987dbbfe0cda1fda9c0dc6207ccc99db6b0520011589983a429a12bd6d5247ee4f4802db8308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcfd0eee1af1f97ced55bd288d44984a
SHA12a79cac688346bca1fb32df850ad38012be469ee
SHA2567827853157c13fba6e3e1b8314247ebabb01096c4b78295548d8cdd5e2ffb921
SHA51288bb8e1c116abb938a9a018989abf42382be433c13fdd1e5636c51c8a13ef170911e5b1a4b14b8d20e7756f2893e88ee999a9da3877893f28a39a4852de30cbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f88d670e85cdf02507bf06f7b7d3868
SHA1d275e3434addc88f71438845044320a4964c6f9e
SHA2560a5d9be72af0402feb0d61e74ab848b51e512398888c2a9b7037f6dc48a5e218
SHA5123742a4ab2a701fea66df47c2ce9ac467b88381773118777f8a77548f61b80349557b9be425873a53b04fb0b9e00a62c302025061c72528ee70fa7d70028e5712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf8b009b5f3d50396d8b5d1b955e23a2
SHA143e8992c0047d6c423f56ffaf1ccc81affba08f3
SHA256856ada74c781a1f57fa22024e14a2be0eaeb9c5465463aedd822297fa19e789d
SHA5126d0bdbbb7c27e5121c5e01d02e91d4e62fa3cdc0b1a355ac0926927fc391e8990ae34573f4ab3f9f09f58e07d41b25708a3df82c882a7f30c71832c469abce4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55525df5b3bdaa5396a8b8eba567d356f
SHA13eda627fb80259725ede44885ad318139d4a18ae
SHA256a0b4cacb57fe8fa468ceef5e07d6ab96c6fe3ac10377a0de2a6a793430908043
SHA51287e91913c4d64a9e8021fd7a93e419637698571fb40f3c8c7cc0b6dd63fc94f94805837cb1d2121e9a80e3434f4118c5429ed6c8b392844217c46cdda61ad5c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ba24641cd726bb35a3a34b53b0e2dd8
SHA19c452985fb10b40ae8a773d3671f0f9d9ead4c61
SHA256356b4a62ca1b129395084e9e16a619a4158c5d4a7b1293a230d8063d7538767c
SHA512e4838d2082dfbd47e44123ca4a241182ac0dcbb1a4647ca3641e47c9d90dafb24c6ee6c95c251c56ab5e72b29e30b73e7aaa222a317befe8c9186e714bc85e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e81302e2a8fb1b1196fff5d7c04dcfa
SHA102214dac9c3ab236dd42cc1741308b9c615e02ba
SHA256624cf963de04d9f113f1386e9b18aaa11112e8937f2ab6201be3056db0b8c7d8
SHA512e93ee207cf7f7d5fff693889ddfdedc9ea4853a7fec09c82225d90175940231b98143aae0fbdfd0b923f17d786aa05df3e6ad3a95e8504e422aaceb780138bc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566393ab437b826398b00f02876ee794f
SHA14c2f044e90c84255ad3126d73ee975943daf479f
SHA2560537f917d2d25e241a80c1bd18a029e25e4972d0dc682dc269eef695ca60c79c
SHA512d08ef725171d59a7a3d45fdd3cd293ed6892c76beb3c968a20930ffb6962bd13b7b163c3bb8041bb67594a0d2226e536225507382f432f5da5a4dfac5dd8b679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f5951070583f0cd0c8e409cf3eedbfb
SHA184ce01d7b3be659dfe18c253dd83560d72690830
SHA2566fcf586dbc6b4a54fc54034b1eaa40659c2210a646439b9458ddfb7ddb4653f6
SHA5126f9816c585d678d8a3f62730e03f024b784e32fd869ebecf41fcca04ba28cd4d4904cf2676b32ac03fd1f3e1130a2547ce155a94be915a292062bf993525711e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584c8800691f9705579f2f935a204291b
SHA160028f380a88c5121dab36cf2fbf0795fe24a332
SHA256f0757e9672357bac5c16e119ad7445a4a12a0734b2d6cf00ce12f3e4f8cd1c99
SHA512a13c5f45fa4c0fd95a73adaf99a52c43459270d884e940203a84c5998512b82f3e2a1a8d5963dc2361491c01519ab79a499a75e0dba0a7dade672da5cf6c16a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ae4a190d781e4e3321f7c7940bf6581
SHA1e33754bd74f9b0f606ad1c5de61d44600d18f711
SHA256f0fb68b069cd27cca1e891c420825f76d01dfdbfb264aba7388a445991582735
SHA5122ca853c1934af0b9c1e3c296a0bb721e41c2847554c1828504c3e89c749926666f82dd73d65d178fea33d4a2805011080342ff1bf032ceb7c93a5e89b13016c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize262B
MD5643d5cda495cf009b36e39afa548acfa
SHA1c81947e8bdc999b576bf56d426349f21c07993c9
SHA256533650758e441a80ccc67b2459bc8f0b7ade539aacb2cb33a66deb2ae4bb86e0
SHA5121e6a2f3a93d46f14faec624e1aa8ca47d94d7037c9d7f26be610e3211799eeb0e549b2354ada01620568b7981fe8d67520d609f5f27e8e72950a3b3811008faa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a917ff535ec7a71b9ca86fbd9bf956b8
SHA18e7e89b22126302bf30cfa08476256e8d394a55c
SHA256256b63f020e98740e69d084afc25976a680595ea3320043b7e3a5b3490d2f66f
SHA512c6df6b6d58ebc3511e6eed55537ae110ae35eb858a07be373bbdeeac8381967c98d0986ebc05118351a81f0ef5046d62f5e62243f4ade089ca74d4702287f4dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD53e3df43397f586cd509c0ff9c2b4edbe
SHA1ffaea0dd14471bfee8c6a35f4979b61505a0ee94
SHA2568168b6034b5586f289072db92d0d0fc46271906071a8305254873c6dfb18dffe
SHA512cfba268432d32541b24de3ced68d59095735ef8512aee61522d32c503385aaa83b36de0a57c1b453a935cc31b82a1c319f5003a39e414c2cfdbfa5cc4284b319
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06