Analysis
-
max time kernel
121s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
883bb712d187f51b01eaf4af10d73d4d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
883bb712d187f51b01eaf4af10d73d4d.html
Resource
win10v2004-20231215-en
General
-
Target
883bb712d187f51b01eaf4af10d73d4d.html
-
Size
1KB
-
MD5
883bb712d187f51b01eaf4af10d73d4d
-
SHA1
9994cd34e862bcdabc6087aeaa050f60dbb151f1
-
SHA256
ab4d7af5bbbb1682e44289c15e1595f9127f0a665d2acf5c12211d90657403a5
-
SHA512
9ece1335e30de9c45785e3de2616ec1a6b1b407704ce0e29dae388ec731309dd5dd1c9ea65a642081a88fe835a108913b9723cd646b15a780687720e86b70ee9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00549e3aad35da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{710D2C01-A1A0-11EE-88ED-46FAA8558A22} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000034a0bce47ff17b82ec8eb40e64a07fdc6fc62176c96783f7f9cfe94ddef767e4000000000e800000000200002000000001f415d6a24a32bf7f454302897e5fba7d736ecf3d18b0b19cf687edd6d04ad9900000004aa0e87b31ca5e8f2e02ba39fb53333a51acf1902b8b9227743cb2718f31e203e0d3482cd4bfba6c5da172c88241a5422c5ed45ddb7e7db11f835abd5ae064f3722e043ea4b801bee96813ce9ec315fb69a55ecbb945a7d551d811248bdaf595b8b7e3d3d2915de3672bce94d771c6d86e8ae30caef2c0e0d82dc9290d5a78d9ab9417608ff2c2212b7ce7803446229c400000008c30bb796695d01f03ed236696744f5a5fa40c8d8beb8fe731db0cc22da1c6f51bace7226ec2c7d494bd577836f9ec5a5d557392bfe5e69872556a069c6f5d6f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409503966" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006195cd0112a59999811d206dc903b3073dca7a32e7d37f991cef673667579af5000000000e8000000002000020000000ed1a9516df46cffffad1729b923392de1482992e84821aa0b35ad4ab75978f82200000003403cf69230c6f3fd39d891dbf536389ab5a848b1c48b1d4eb01eead038d4e0f4000000071d9da44227abf8d0728650f330a56726a57e0632011f7fe3cc620553af05c5c168bea705165fd889f174505f930c5f4d6f4c9d2ed21cc73c71c318be52a1d6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2728 2908 iexplore.exe 28 PID 2908 wrote to memory of 2728 2908 iexplore.exe 28 PID 2908 wrote to memory of 2728 2908 iexplore.exe 28 PID 2908 wrote to memory of 2728 2908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\883bb712d187f51b01eaf4af10d73d4d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5609147e5a78701a851a77967fafd1b33
SHA11200a9e010b4effe7f8659cce2eb40710403d5b0
SHA256efa6f5d047e4472ccb70f690970741cd15526b123cd55421494a3dd98b69adc4
SHA512f42323af140418ab294d1e171c0a2eca1b2eb22e0e1ddac177a2b701ebc2c2910474a2813454eb8a358cac879de40cdc3259ce5838823a865e66d1c3b642279c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537c6d8dbfa052d7c44faabdcc3145c82
SHA1a7e652271998ac833e05befaeef52dbe51eda075
SHA256c7a14ff45892184425f6cf6769d8387a0818705e2023c6b921fb57b81098d420
SHA5129000a35d4afd9ae76d49fa235374ca96038421a6bf77e8d748e1435c783fdf31d19c36fb902575be9c8545d7ba757be5e4d9e658a25015cccd6c256fb7f47a63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5072eb1b6602d78950e51694eadcee0d9
SHA1156556d7ef883f82f1d7fed9f02fe0a4e91321c2
SHA256102afc93826619bbfe4f452680dce67c3e3a40457776a7dc78891baaa75764c3
SHA5121c49a1300eb1a4d4fa5984fdc4348dfe19ec73944bc1aac15c33b8e1f62b38279179081e5f97ac5b15fbf06a5a7483eb5dbdc9b01748daa2f024a63c9997286f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc06edf14c000e6f109388d5b3a79df0
SHA1774351d6b15dab268b5623294c752928215a436f
SHA2563315bb63510a57a561bfd899b2016f4bb5d31dba25368dfb4456937706ef3149
SHA5120b57a8fe9630b5ca0b58c8bc64147a635d3547026a709b686a0a577e882a8074a16094e886527500d4219d835e3341d1b9ccd72f26b446243c52b93e085a5c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf2c2fef24180b3bee83264014e521a9
SHA11e5179d98576f358538888261a3ea8cd0159d83f
SHA2562cd8aca164d53b7f6fe8d30a225ef37ea0b3d191dd1798c57fe9c3682c50de2a
SHA512bc627f122bd79a8c1d079cb0de2ff407760c3035a4008aeddd74ed766a4ddcaaabbd0b8c614fc6edf563484243be00b97b3a2522d1dee7d2d4d18ea113d1f0f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5385d170d84d8de2bfeb7f96dd0a684
SHA122f4077c5c83e2aed2bff86697b19d9ccc403d57
SHA256688b11d7c5ffb417ec125b38a998c40c2f579300f25e15af488fc1317a3484ba
SHA512a853d54f03349480a09b960156ba5a33b012c313eb418a4d5279565ffd335156a27e5bd611fbce0bce5001c1553cc0128b3ee189134542da00513b2a5a45292f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d7cbdbf6824851e7144aa2a850ab312
SHA13f5c2a10841cb9fcb2d7de57b9dcae5ac8883963
SHA256a1521d5174c43d474c45658501ec7bc964e1eda80708363d149941bcd8bf77de
SHA5126e84d365f02b62d48be7998ccf43a904bea767d72ee82fd71fcdc8b985a4e8af84aa76567d20e6c1348a601de47f769b4722a7286cf47214a0ac6dcd97d75bb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cfb7a2f8c8f16e6a2aee22d0b6eb625
SHA13807c8d61899c083e8652346b475dc40c5806532
SHA2563f0d23710fb5103e3a01efcf4f8f03a2a4616f540d207d3ee7941947620d6bb2
SHA512f852a4937f3bb771b51a0d5c6a800aff12e86085e5a86ecd4c1222d04ff3f0bd11f4cb96bf8d1c932ff48d0114307c0af6ce399bf2f13ae456510af6e1f9ead7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1601efd786600b22de1d37803d31163
SHA137d763536d80bb84d6d95714f61cfa2b8e7f03ac
SHA256b7020ba540f2c74a50517ad4f74694d51968ca7d3086961075b60898bc172020
SHA5123f00b5c5a34d86a3bd3f932a5b391ac26034b9cf522b7eafdedd439bacee513bd561d7e1e0efbb62e03aa046354261404f0cdbc4e92bf2db8e0ec655f60f7855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5553c5667b65d00bb18ccb54fb4de767c
SHA1650e9bce9b2888ab22a859c308f482dfe56a7285
SHA256c7b52245f59dc568d7dbb5e703362f5d95aa13bae2cc38b3e58d18b53c5276cd
SHA512ae2c11c88bc61381b63cf04b3808b9bc56c9df8a3eda38a19ddab3d9ba7875dc73d05ff18fe6424e2fd7595b129e2c3a9902dfb251d91320ed16e9013843c3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3e325463e1e8235fc8a4fc2a4497537
SHA134d0a5609525dec1cde974b163641ada188fd621
SHA256ddef3550003ed7635812ac8e98758824cd071590a985027f6fcd1b62fae7b8c7
SHA512eedea1f789a8cd63ad23f2c3104ab49da9e240f0fc824507fb5b5750eb8b2c05467937ebe76a1e046843bc20289f41880c996837261ba15afe708dec02dfd3b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c04dd5daca685fc7ec17953e84df3e8d
SHA1eeb306e9b5fe0eb2e1b4b14c552edabff0f14418
SHA256d6d1e9933bfb5dc3e889d9d5fb80c85bc02721ce96bcae72803904eb5faa4cd4
SHA51284aa0b03deb296dff22a4d71218c722f0c4e6c75194229d513809f8ce06ff5b550dbf4d9f2509fa0aeb9bbc0ed01aa68cd3a4c83551647c0bcb68c3d8d2ae04a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5713d5d3a1bd886cd0056f440ee593b17
SHA12038615716f3f380e343ae4f2803bddb79045f0a
SHA2567f96233d0bba594f25f4858032df2a578ea4ac490ebf34db7a5e14b78b2db43c
SHA512fa0689bdac11b1edd56920ee7ab8ca0cdcbf958994a1f0a5bbfa6fe5daf7fe8205a4bcfc362dd7d841c76d03b40f52bc24bed441993f8176f85c69e4af88cdcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f88f3282df18ba68860c1ff95ab8d239
SHA1a1f9cb5b2bdb73fea863198f9db858a60a1e02f9
SHA25619c866720ffd03fd9e42729a98494506f725fd643d41d7cb0d3d75e266efbd51
SHA5127521625cca0a340d140eb5438d7513cb63d1a1d24b8223c4002fc12bc6b86ad9c960c88fc8856d4e8828e4c9cf80b21aa30369d025bf318a2a687980455822c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f77d1d66120315209e6646491dd143c
SHA1d8d69885e11ba6964b2ab316191de91a92bdd973
SHA2567af550747a1d16b433a74f2ee4c10d49947bd45b6cbc78c6af1423d21d4ecb15
SHA512ac97bda379c7c6701ab679d9d4bf1732d10be30da28769b88572ff55eaf06f5b46988b9a0f7f1872902929230282e0f49dc2151118a556400576a9d9af82a333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ade37d98471e6d31ab508f445d8d6d8
SHA16f27fa1a762afce6d941c2bb420606181ff704bd
SHA2561128f12454f12a873b9348c89112f1a431719446eeb760fc725007385196d22b
SHA5125cb75c6f252aee4462c0ee25dea93cff02334c22b89834f1a6800af6a289725cbceac905134e2108b44ffbf26d7ceb3eab48e44ec42497ca79a47846c88d59c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545d00d2d0a355d3bfad4cca794190796
SHA1fcbf02bf056c72e63dc7c0bf1ddd6039dfc9e3b1
SHA2561f7960ec8f88eb335652f69cdb2d9d47c19c67ad3c7455593318f84efe21adec
SHA512678064c9f552c834054133f004fb33def1515ae156614ddf1ac32bce163bf4f3d71c91dac6efa8680c9285bc339bffb33b6d2ff920d7c6e445eb8629ac2bb029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcb7b8f85215019903a4d5954dca45c0
SHA1c9284ebb3deb487619af87dfbb402602312988d6
SHA256c516b3ff4cbcf856adbdbe2b770a60b26dc306b0684b06d3db6af30fa494900e
SHA512ead433a0795dbd9c91b01c97efacc11b2c89a8d420394a25ed3a715404b7a053eebf6f1444c6278e35c36c9b454132dc18a0109a0800af3aa3d1fb87c3721849
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9cb4de1e195724e1a800efa03e3ec1c
SHA1da1bb748cc977d3a8b0e2904859c5e97b12fb1f4
SHA2567fd2679484df57e4abdef974749a6418ba2ceb53c0b861b897dab9ebc2984f96
SHA512fb3e6fd27dfbd9501ce2a3396de0f91ed5dca28c6192aef2e71304f8873bd445d8d8c97049aaaaac8e6fa6f679a7aaa50231e3cd16df91aa6fdd819212ba18cf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06