Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 11:25
Static task
static1
Behavioral task
behavioral1
Sample
88663bea694f3b08f1447fc512d72533.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
88663bea694f3b08f1447fc512d72533.html
Resource
win10v2004-20231215-en
General
-
Target
88663bea694f3b08f1447fc512d72533.html
-
Size
25KB
-
MD5
88663bea694f3b08f1447fc512d72533
-
SHA1
35b291b55f4cdc4895168216149d1f5fd720ce1f
-
SHA256
4f11b168d43ff3b13bbda7cf920cd8be3c8176ad06ddad242ef7fb5de59b2400
-
SHA512
d882e7f4fd7e3f897f78a8370776523ee7cb7ed1a7c21c227ee3b02beb48e897ba3c6ffc21bfb3869906154439d89e152c7eca1c00c5a12d9b10b16149eab0c9
-
SSDEEP
384:8onA4ywu52pY/hGztvukeKXXTukwNmwfdgSLIWQQ/U4cR1LeeIYECdG55LkuxOkj:B1EatWkek7+P+S1k90t
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ebd60971520ae8d9ac3e7e1c9c7cd347dc14bd920de6f618cd629f146b850829000000000e8000000002000020000000ede0fed8208735fcbfc3ff33c9a959edda1178bb5c4f42f015b5cbbb07fd0f98200000000e4c1b551da021fd367ac08a10cfd63fc3bf46c1a59c5dd3c933effdd49a9c0d40000000f9b50a9b1a1ee7924126b103663424c8b91aa0f76c13df5970c9f2f63c74eab2b897810ff90e903ed0a8e12f2c3443c318a8720e1b229739d7a864857fdfe042 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80759aaec934da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409406214" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9C8B7D1-A0BC-11EE-A892-DECE4B73D784} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004448af5e23a98e82ab762e80599f40acf385fc9e35970d8c330a6e40194559e3000000000e80000000020000200000006f6e5453c7ee7f401b6e75894e6d0448b20fa7c83e58960d5dc368b6cd78041f90000000087e683c1ae50c12fe87d193823f482a0e6b0828b39d510b4e315576eea66fb72777bb7543640658b5ab8ce35d31d90d117ba49df525efd9c07cd3bb578701d9a02c7ff45609038e4e1990ba54904db4594260115ffe04bc7518b2a8093dac861a9b1a203f3dcda26712da5b05a3f2c5d5ec3b340811f6cbe0911bd589460385b16730ca9ea4fe8154c436d9c5394a0e4000000062d7cb233ec910ef1b3b1f1ea5c83a349bf1accbc14ed4f7e21553b8a0d91d06862fe0e780d141e8e0cc7fb1fcb16b376ba7419bfabdef133b917cb4dbdf957d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1972 iexplore.exe 1972 iexplore.exe 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE 1032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1032 1972 iexplore.exe 19 PID 1972 wrote to memory of 1032 1972 iexplore.exe 19 PID 1972 wrote to memory of 1032 1972 iexplore.exe 19 PID 1972 wrote to memory of 1032 1972 iexplore.exe 19
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88663bea694f3b08f1447fc512d72533.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c9e99fef9ab1f0c82963c20f7d1d456
SHA184528313a887d6c53835cb15726e8b81d00e38cd
SHA256a93a74d2f0289b6730b7bcc5317a57e536fdf3d3b8704e02631ca8b4cbece442
SHA512f92c198e10f1acc7b830124e3940e466a03ec76d2ec05353d7efd079a59c48fbc83f77c7a383ead44f23a2d9ce5bbf7cf28f162d82fe6dfcfcb95ba898863e74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aadb8f48fe205a92a41ee15727feede9
SHA1b35f10fe534c6cc053af6c97d82483ce861e4caa
SHA256b7604bd7ea86b547c94869429485ac65110597c7946ccaa500c26d533fbcd888
SHA512e98543c1ccb006281c289b48f85bf3d27a7faf46035ce32ac9c5576e835bb0cca9cfe665f64a77aeb4fdc533611c9f4e23717013bdce4df07063cb0530fd17f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56956a7216f4d8d0da2348831bd07627a
SHA18eb08d6838ffc7b605fa76486a09dc1baebd2d6a
SHA256ffd3cbbe685276a2dd2d37b0243cf9e28e0d635ceef5d7f1c62ad1a5322973d6
SHA51252ef146879d21e4662a770a92e89ab090cbd97abed2767c4ad6d8b6d5395d7d5a2f24db9256e32fcc44dce37827f4799bb1e21f678246e11fed163bf3176b7c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54df50cfed39059a4ee2adb202dadafa7
SHA111755426ac1f48124cce3b1552891df077961558
SHA256dedf71f204765a8a06e19012ce7ea69676ad6b0fa3d54c202544c43e735d6623
SHA51294c7fc2a7526fd84777997698e2fa3ff031c10c759d42475f9de428f9ade4fc49c2b1f5eb689325683f974309818d7d88df394dcd560c50cfe0633e85d1670e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56153a52df6caedb254a1005ed930078c
SHA1838163c6b712117707b0e546b3f35ad28f725aa7
SHA25682ea0ecd12f69199cac6e5b10f4da92f32e83a2a49a20c79413dff7524442ad5
SHA51249083186e18a9cfd97f0c00be2da64891d62f9cbdc36139b1b33dd96e174aada26cb5f3a61de5a8d9f521361f871b22465437b59f45ce00028ee8ee9381a243e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ef0095b359bb14631590895b4d8ef2a
SHA1aef4989c26b8279e0dfaf56024b336dc425d57b5
SHA256e7a17b64bad8d5555aa2a2786208c8e6b0d16087aa50ebe868f3446b8b537be2
SHA5128e573252a511dae92ef1760778389e5fa0c140ceb2d96e6dbeda3b80624353f538210293b719259921a0d8b49ebd529d02cedfa718c3f370b928cb3e078c3aee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c9b1960c1ea6e7ff6a39dd476750add
SHA1b9014e9e6b43f8d6cf400212dac1be36b59882ac
SHA2562a9d9bee18f5a554ab4d9ac4cee634d40508a7e8709f81bfa71adea9f13cee8a
SHA5121d154a95a3c48395ba9dc5f33c3e2c7c281f6cf984a820a3d1e34edcea08f69a12c040a9197a94aebb39a5f4cf03bba7b499d31aada102ea01d5bec9e9cfa590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56429342a6cfc1b902411a154860d1a36
SHA1d72042051860e9e1c4438f806ef90f6e65ee769b
SHA256411de881225b1a0403a322b285d07748db30ef11a16f6418a0ae8654d9635b52
SHA51260d8dccd75a3a99e3368b71396767551f55b00a2b80c78c43124cc42ed1e2af6fec6126f18db628e67a46ca5015c024c9e6c4c0f8c5a6a8a88c22b61608ece95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577b08c0964565467a89ffb99c0423a32
SHA1f4be12b8c5afc48768f0a890395e7c8f7fab2051
SHA2563cb6e80995960b63c3c193465247a5136aa7c538f00fdfec115fe6f69e713020
SHA5121759b9cba47fcb7776236e28ec29878587ebf7f5a4f47b710c302a71ca495d4789b6c28863285304984778f3b7e7eeaeaed6c87fca78a1018e163cc69bd8fda1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c433277db5faf93dd43ff55926522f7e
SHA11ce02934ba717dc098687191a0ec9a9b1dc442e8
SHA256febb0d9c9297b3fe4f03aac4fc521b92c124c8bd0435b20c402a6674bcc4083f
SHA5128fb2e6ed48022c434eef268f862bb5f2eff9981359b67521ed79e510289cbfd6d32927fe3ddc23be30fc73cb4e1e244944150e073762f5589fa30bfb0d7d118d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6bf60e3d19c120cd348ae4f74625d78
SHA10a29f2dc155cafa5492a8a3d313714a05d5c4143
SHA2566498b363c4b2049eb4593f243a814cd5c13cc04feff221863666fd0364dd3381
SHA512b24ba9058dfe3f3e12afa37de82e643c2f1d43d56f23fec692bd2515c0c9fd66f5d3a9080b4dbd5cffa98b78b443bd2797a790149ac858eeb5153e16b50cf662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2eac682a0b52c37ccf72cb45d454be8
SHA1cb16637e8681b5dad7ba70e23840e7df3379aad1
SHA256e89f985abf38094b7bc12bc0801197103cf5c01e7196e712e12fea28ec303a6f
SHA51204d40cb63a6556837c2f6793d7056cf347d6170ff149f356dd79978019feb95d4d0dd151af6301dfcb05f625bc339f865e7ff9f0af9a7444b331f8fec3a1b4f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50252f613a524a8ae5f83fc980fae6cae
SHA1c06949e3bab5da670859736d7070e754a9adfe97
SHA256e0e30780c0f7ddc750514e0f6081eb236f8b54ce6cb2cae5dc0ae6d3e561afa5
SHA5127332a9411607049bc1b52d2f1867b4c9a21e1f8116fceed75e7cdc86fc9db29df7a16d6b1c2d707dd59ead4e713b0ab14c54ab4b9f326175512c73141df99265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ad9a77efe5a7280ff5f9fc80ac5559
SHA1c5b16665c4a7193f3f90a1848cd2202da904ff58
SHA256bbcbf8bc406d9c433586a4f3e0e399ee9191cbb79ca23f168ee0cc3f2c015830
SHA512b354b7875f601c3582b55213a566309d08daacac626f449df4740e2241c47a83a061c4be05f6c8fd2139bc174b2ddca58433f0be47a115f893f54934dd8cb7d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5794f6bb3a1ba371a4dc12c3ff12be105
SHA17853da3975d3ddc416746656d0af9b6751dc9413
SHA256108d5e5a5ece1440e30e42e1000594dcf84c8f4562fb47439b65b212f35a541b
SHA512c7eaa10025edc3e91d9138c7a34a03cdd423fe51c06ed4e66814edaa74002fa8f473b9df06d170309cb1775915a0888967154d15100b851a372f342933ae5e59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5762b4eeabc2069c1c89ed395305e5617
SHA1d6419e6bac242a3271afc1c3b372f09a3cc84595
SHA256fd2db7888f665fc04a50c5bf5643cde24c474dbcf3d5a96a6fbac3d94c8ba7de
SHA5127b3df54115ed7a8387803e05d3e1125c733fb04a9e53d5804239c74c173ee020f0c062582b83bc41324b7d02347dba744a45f374d92345d6a07d2af1e08e3c4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ba2b182764454fda80439726e7df978
SHA12e8cc6f3dde583eca3ecf342ba6ad4cbd80eecba
SHA2563529e29c436123062fba85112c291deb478cd5c6709f50c703f7b0e9271e406e
SHA5124dc81d11e01017878f97887668605428a5700b9dfe45ca8b9088173dcda7adbb86dc8fb278c10cc94dc07d39e9bab8c65d050bfdaac8982abd3d23ede2d1a556
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511c5653bb0a44a96c3634fd20d8fbb9c
SHA1f57a7413e54fe8e30adc2a25332c2f4bcadc9cf3
SHA256bba275a06f9b1149ff1c0f95663768598a765569d73509404e749b34afc1e52b
SHA5121f78e0e1167660cf0c01c8c49e57375482926cffbb94326020c0ec1d344a426c1354112a9e545cfbfd66838bea138db721699bff24cc1eea8c980ee3625390ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aba88f99355cc7837f5bf5f615764dcc
SHA18375dcd2f598668a9b27d22b0af5e5f21f3a2738
SHA25660935adf72b508353c5de05b9e3ae87bf3b8e0852dff0a657b621eabe9aa8ecf
SHA512dec963713a98984c19210792b0424a1def8346e0973b7a4ee81425706454b7f076882bf9ae903ac96a9b45212409c0514e6c8c1760ec154694b85faf788f7122
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06