Analysis
-
max time kernel
119s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
910e39fa3246f5907739829e057bf5a4.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
910e39fa3246f5907739829e057bf5a4.html
Resource
win10v2004-20231215-en
General
-
Target
910e39fa3246f5907739829e057bf5a4.html
-
Size
1KB
-
MD5
910e39fa3246f5907739829e057bf5a4
-
SHA1
088e75474e2f9178c42fadaf300e001f448b504a
-
SHA256
70688e2be2a15826157a37c5d2a971761ff971d7304966311c0db27d424fb764
-
SHA512
0304b7d31866615c2b0a60bda6c7ff1d593e1c129861d38e30ba817e7ace016235eb57b18fd939025d0499fa5c22c4c4961af0925a16c4be456cedffdac4f6e9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f003c9a4b935da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000668263d8959eba3998c39c525c78af37951c7b53cff223bab62b36efdf447cbd000000000e8000000002000020000000258434ee5659070018faa697c6ddff2b4398c0aa17db46207ca006c928b6fbd2900000001251c1a552fb6945ad87cec60c1b057c01c45d70021346ec494dd8dd94b6718e192dcaa32a4e8139027b3aecc28d8175a95da140e62eb90b91d6c98538fc39e9b420f6b6dd680359c3b349e8d532ef4a432ca9e74850215efe1a464b2f3dc2d94069994a6a72cb9fd1b2daf8f2d98cb97a0f0176ade93df5dad70934f1555986a8cb4cad26744cb07cab4c175e877dd8400000000e520ba05649c70b2d5ef7f9058d13ae007671b898b47a8543ff3afab3e4bd2ccf77d405755fca2e45714e516f6e0812a13480932583dedb7b043ff5a576d9ae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF2F8971-A1AC-11EE-971F-6E556AB52A45} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a037f66f7fa6445af4cf0789ffb9dab88d608ce74206d1d1ede3dc54b8648d6c000000000e800000000200002000000004affce836d53c389a4b35dd554806a7f1cc25f73b20f979ebabcacc8e0653242000000046edf9be3d9f6120ef9d64e6b67e4f71a3d66398eab50a60d59a731bd93b4a184000000081149e896b8bb9cff18a117fd0e0148f4ff6fd347195203e0dccd439334a42a40cec632dff83badbabaeb4d499b83e6cc39db5ddd96d88f9a87926bc06e462fe iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409509279" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1988 iexplore.exe 1988 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2140 1988 iexplore.exe 28 PID 1988 wrote to memory of 2140 1988 iexplore.exe 28 PID 1988 wrote to memory of 2140 1988 iexplore.exe 28 PID 1988 wrote to memory of 2140 1988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\910e39fa3246f5907739829e057bf5a4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5c4b74f6061979697d0a81d0d2f2cbd
SHA167003c509001fbe48161eeb4a4e1c454793f116a
SHA256d4b10c3251a9d26b186855fe050d9347b25e3f4de386aa16779011f21a1cd68c
SHA512994849b0f21f72ca725099ec5c7b9fe76ca37ec5ecdac8afd0cf635abfb84a72ed2ae4dc37640f7b7756f64023ea0d80256cc586d877f72bb157521733133b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5819b7c251e7a00cdcd0abf14ae256ef6
SHA10724679aec9da5bae9aafdcec64cc0e001782687
SHA25629e8e8f11ec024299cea74163150e37caa1b82f258553580d406c027a30bb1fb
SHA5125f1ab6c1db2ef0528435feee21dc4ab7829539f68dbbda4956bfafd0b6de4fd7c523607dd3780a4e0f6b25b47dbd47acbdd6170002e536a57a543790bb9d070b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c973f3e0bc5b59fa83f9d895e5195022
SHA19d8841d7d8d6f02e535b3c00694a6ae3c6a7400f
SHA2565fd91cfaeb31e8ccee12c8d7816246056fdd279c25284314064b245ff31d9524
SHA51215dba1679e67b8d8ecee39532c45de0656ed72677c031be0773bdba7a0b3d1ecf3140f0b3160c005a572334dfca74d8a1a04a6b844311b3a93e83d32881e5907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d44a6db4f0134bd85bc910446f9f2f91
SHA12745686cd41a3035fa2a71a5fda802f51d6c199e
SHA2563f6b4acb34c307652ca2d5abfa0456bf510ce370ab3faa3f9be922519511237c
SHA512ab69ffa6076e9cc1633289ce0fc315c5945ca925eb14ef6a11cb6c812efb8ebd91bd5f00cdc05f685f4fc67929d1f6443bbee71540c946df2c9c539675053c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594c2748e68f0767ab19a44f34b895713
SHA16c9d9c9a9f89696e40a014b55fe1a63b698171f2
SHA256d22b617c1a03702cfab66470204a5f9518fa4fe4747677e3f4ea11f9c45a5bc8
SHA512674c2b368bdb40efae776fa00afd25cc25290a45b48c7e168418ceecf1e2e29bc5c99a4cd8b2f990e9dbf5d0501a0f058a1452f35fcb8a8d83644d25c64031a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbb6b2b2d2836a489c642f41b88673a5
SHA140d49571c2cc0c7e7afe1176b626f5b0f35bbafb
SHA256effa9b7d9760cb3a521b729624ddbec046dee18cebca2be7db7a83b359624b5f
SHA51211c3eb22c12de84abc745e38406216f8d4370698c80424b94f3959f13cc9ec928cded8be23cb1715de20e3c57c76e9af29a91e5219fc46359fccf1a6d99f0e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c8687c06abc1d6654f819e8849749f1
SHA177150ea744f1b81fc24f2a136fe22de3f90c2e42
SHA2566623f58106ae0df8bcbb2c7ff5da578ad26432000122324177f290de5b36f684
SHA5128df76796a5e6cba8e0a65ae5853cf1d983ba460a711e1e8c0951fdcaf7f830604959ac4a676fec02ae79025ab7d50e3de1c21ca3b1ebc2983c7eb78a49baf2e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ba61d12a1923b823c9bee98a4ce9726
SHA1c3d4302c6675b6bca0cc0e1bd8bee803116a9998
SHA256a48b37573ce2a1cb1306602d422f265f2a829d0ec06fd29bad3c6e88e149c814
SHA51224078b4ce12550fd5b7459a1f54021612f32506b85f946b75bb15046d6539c5067db6a9b3bcd4805676ec30ee12a11279a35799f67e615d106107377cf9a9cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc29bd8bdef85d43f3dd23020af526e4
SHA1f7a082236fe53c9b2bb038e6ece6bb04234359dc
SHA2563301524b56418b3c6b1e10a4b07aa9d75fdf83b607bcad4c5cb16f8667c9bd96
SHA5123c28480981898b35b3dea0e809ceb8ab02efe6b754191db756b805ddee92fd5fa9b12dcb58c0897850b45c9c1112de327e0108607c4d83b2a13afb23a7a07437
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549ca7565765134bb33ad13acd2a2c566
SHA1f4e67eb1c6f4f8f5243074a9e8009ba89921cc35
SHA256ef3b8cc14fa36510e7d3c0616239280b007f9f4ceffbb60b1b29904d72623453
SHA51209d181273498dbefdc74277f5b5aaa7ede2c2b765a9b6c0e77137f4ff3d43910c7a7dd3698daa052d171962ad7502ea5d29cc6ab52b611d2d8a749cf82fb691d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea85c690e26a7905f607420b7a0cf5ce
SHA12ff3bd169688a553a9ca88bd6067711dcc84fe5a
SHA25646b8d484b979531d530fd1a4c830c643702016b405a85dd8fabc6c9df3ac1de3
SHA51265e158b043cb5b64e7204b0585b126caf7a5f1f715df30f6b70c99587d7e0d634def24e593c31faddebfdb9d44dba3126b5255dea9f88e77143cee07cd44a686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573c2671e919d3cc270f28f3f55adc6fa
SHA18524b83dd1173d9836ca588511bf5031f71bf6df
SHA256e7af84ef59a1b5c5346e3d7394927e3d5cf36371d257cd6bf867550fdf9d977b
SHA512b169770236fb9e435509a153a8dba4b7b9ccc8a961e101741d706437528625a746daf0c610b26406c956b43d07237e1323bcbb7f008f16abfaf6d6b1057db695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52989d136dd08a98b6937488e59b439bc
SHA182812d5e3f5dbbf722dc59dda1ec5cabe52a53bf
SHA25630fb34d1c13e26a0a0647eec749b311d2920e5ee13535a4e53b86778c09144d6
SHA51227131842a7a7c016bd01728149b02dd6f38fce5741c13afb1bd4adf2fa50780f10f7ed9faee17693734af2a27927631c34bc6593af6c691a06ae9d27f2bf4309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bb8030b8021c1deb3617af63089c9c8
SHA1c4d696e1b1c2310d2463a78d343fa5f6097a4dd3
SHA256340e4aba5f42aa7fe7a25a272c11d62dd1780a2905b6784f22fec3a0d5c6bc9e
SHA512c73d796aba83e4ac13b75f5ddd818fffb31e1437fa4b82341bdbdff46cf59a7bb140b7cb04c5bb8014cd175b40663217280204c15052f31e9b620fa6bc25000b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a88d44e081be41d8d60461a9c2e92e6
SHA173cd026eb6669f5e9d15e5c0bf19694079beaa9b
SHA2569691b9842d63c6f92c3de80c3e448c6570a29ce2d5155a3391336e9efd6bf678
SHA512be5f12e08c96a02b8f8d043594a71ed383af375fc41f48243116193c225af3b1a3757fa4e9ced6773791423863bd82bfa7853b54ae426bb6983b5a871a5cd344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc650ead4446fa9ef78983b9295aa9e4
SHA1f1e50ab0bae0b9bc94aac0e553fd5aa5cfa5c163
SHA256e7192cbe7b04516d6f896e2ace672016ad01a4bc7b5c28f5a2fdf94b9541fcb6
SHA512b1ce3941e2c993ba69b98902923cdf675e7542f32531df470429817706bbb794aebb5410cfa368f24c91b071a4f7cc6722729edc51f7fef34df0823f07dc5468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529ed95e68d853452416d7cb86ecc3f0c
SHA1f6398bbec8ede755ea76f7785c28de1cef9ce963
SHA256f87bd6eec339e31d66058dbcd9208220ba6e1ba9de2a0b9a4f836f2a2fb0a103
SHA512e1c604414191045e46e8381a619ff54278a57263881323595fe92b3670086b287f89d4b61683c5d12fcb1ab065105eb3cc4f9b74f2da864bb159c20ce6a35af3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4f6ebff8f468b9034b5bdaa92d54e79
SHA1965e913ab954ffa588135084715beea1da3350bf
SHA25625408422ff8c2a50ed4d25d4f2d596d6440c63e26c1b0931db747ac12bbf44a9
SHA5120478be4e936808f618b8e3068c6978376bad228df6ef85285ee118383bde04a2304ff9f5081dce9b31b626e672fc7ce4f6b494c473a0a85f0dfddc51e5a71dd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c54f1da7d341c5532525f6de4ddd5cfc
SHA1d8dbdd3a6333fd78944293d1dd4c46e1f0b49ae9
SHA25619f91d8f19fdd62fa4e4ac86dbde1da680e1083dcc94f6d81fdf586825bff37f
SHA51260dfa7091acfcd5829c2d73ba1c15701af1df4babb6fb215c8548ae7cc2860692d7018315dd727972291d3e9096c0eac8988c0e17bd045acd8c08872e76f7838
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06