Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 13:05
Static task
static1
Behavioral task
behavioral1
Sample
97783f8753235250a22f2682b74e0799.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97783f8753235250a22f2682b74e0799.html
Resource
win10v2004-20231215-en
General
-
Target
97783f8753235250a22f2682b74e0799.html
-
Size
25KB
-
MD5
97783f8753235250a22f2682b74e0799
-
SHA1
3d10dd4e053d8662a4df6bd474ad1830884de9bf
-
SHA256
bc0b4e3379794c955ee5f7ddfcc11eb686acb50ce470e39b1d7581a29f39d200
-
SHA512
2ff960b9368788b56c38664a90be96f70d2ac3c7274cfbe3cb449758fddd267014db551960ee6c68b5302f1b7593ff12b9d63eb831e059b6f7b46e5d0f8c5c04
-
SSDEEP
384:unA4ywEIpNWhXCztvukeKXXTuFwFq7iBzLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:m1SWbtWkekKmUk1k90t
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7000ee3fdd34da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000000cf766c369b45addad86babade7cd515696afc091e9314a9b8710fe09b934a9d000000000e800000000200002000000030afbebee212bef70fb5a055efb20eb54f1d6150563876337a0ec1819aa0e3e99000000000e07719b345dc58266e3775ea33badf658e685775ca181df04480cc9f36ae32baa90f3d8c3a85f4456aa487f85c5b6f5753a4e70373dd8fb905006fd9c67aaa3879a4b933949fe7159483c010e74489042f88fc936b6e2e9323cd87de9a83fef59fc249a3b6183deb7fadad017352bd6cf565959610a94e0e2d0c1a9e5c56662efdd28bf44f9389be25065f3276f30940000000612818f8897e25f1a6ffc354b046c93643e66cc412cbff862ad6ee44c50bcc7b9d74246eb10d318cb68ab7bb10efcb6914c44104bff9e71a28757c33a8fa20fc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409414618" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000508a296970a697270f9f5a0921f94516c9d49bdf75b55b4b4253a74b0bcc4e3c000000000e8000000002000020000000e8839eb353f6c58ab74098cf65a450a45c4581eeeea79c67b1647688288c956f20000000692868d2c454013dfc7645f7c2ed98c423bb40274edf3aab7a9d6d1c01f8a018400000009b0f9058dc22b884f09e94cf17f93d5ac1df2855cdebfb8fb92a07f528aa4a0cc44f59ac56e260805e9f3de22ace7cb80609d6480af102af756300f0762a9f01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B8CFE21-A0D0-11EE-8837-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2500 iexplore.exe 2500 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2516 2500 iexplore.exe 16 PID 2500 wrote to memory of 2516 2500 iexplore.exe 16 PID 2500 wrote to memory of 2516 2500 iexplore.exe 16 PID 2500 wrote to memory of 2516 2500 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\97783f8753235250a22f2682b74e0799.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5f266696bf9d4d0bbbc8d08b604afd0
SHA1ed9db4826df0a972010c795ccead9204f2880c48
SHA256610bc7176819083f24427ab43de55192434394bcbe70d47ed283f75d704bbe92
SHA512229af164ee5905ed58d5ab73d43e7098d644a5aebdb85a2514daa21e0f6140598bb347a423db901fc66903b5a0f2001268d03fdf15dbb9302769ccc92d5e27cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b521aef41d451ea7eab3b40ed8205466
SHA11b4c70fd7137253012cac27bb64554a99a1e5710
SHA25696e6beca4b973ac444abc75bd4bd923b8c434744203f87dca38c398f839c5e6d
SHA5125fa9b7c4815dc761f98f889225053cf7100a053d31419975c29ffa38da5646f8d37807ff939f53d4e70d524230d84a893db4b4cef41fd4d3826035bd61b13869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ca0f8d2b03f6180faa7c978b7bff6f
SHA14a1a1eb4ea6a362405469c7c263565477ca9e1f5
SHA256569fe4f02fe0e183dd83edb43d1a83be6a2d9dd031a3e61c9905aca7a7ed5f6c
SHA5120a855e69a3472732ceb7dd2317a8f0c9c3511c1b0e9a1eaaf87fb5cdd6d5c1e212865358efe5fbde0ae249cab4db4d6589ebb7c7d9f6582d89d86b9e897c6aeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b50cb576f036416a73fdf39acda44e4
SHA11206c192de626a2fd41d9a6394caf3e3c362948e
SHA256bc1878f9fbef854c4ab337d9f22663045114148d6913abd300e6f7c5d8a3ef58
SHA5127282cc3621a9a69e002640081b642b80e14b6b5ab201c5bf89cf98148a8c8c19783210758f7809a1994f7458fc79f064da51cef021c094e67953b52178a59c94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9efaba213e4631e6e63042ec5f987ae
SHA1275192c9d425d3a9ed3e515c554add7f9c3fdbaf
SHA256575b55437bb8e23a5f6ebd0522a61a80ac88e26c3039978f13492ee444350e32
SHA51208918f5b38beb79c505b48ddb9817759106f176fc0389cf79108041048f51c1cce039724db2e4bd447d493d1b58d2e1e842511b2aa7782a0e8e63f27593fe47e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5061f856aca687a05487f8599564c75ee
SHA1dcd90681225d751799ca8d5c2f502507c0a181cc
SHA256fd3b408fceb1839e44fef6c4364e2cfdd1c1075352a10fbae9ca55002d7a3c05
SHA512dc23fa86c1bcde367b924249d5131f945e0e5f50c63044a8db775a9f75621bcc3c36b44112074f8f89f89e02adcb4b14e242f0631824678ae3de726b2bf38a3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af8f6fe4a3d853734ba261da3bdd88ed
SHA1b6ef9e9e15d5e3f3399286cfdffe71f1d74c04f0
SHA256d76c6a0cd7ffa3cdd1cf01ea2f036c0a81d5823c851d1f716e5dbbee716711ca
SHA512769db731bc2eb6a74abfb560debabe646e57961f743128f2a47ea6a7f171effe5d247857c63da5806aae653a7a5cf754e50e74b065b5c90ca704fe8d954894ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5916c2971fc469a7edba155a068a21e77
SHA1d37a1be1d0dc9fa858712a99efd303f26d84d649
SHA2569891638593090b68d0cc34d24844b888e0fa4fcf0b83f4bd1c9910beb33a34c4
SHA512233fcea1617c136220e10539da9ade9e634398d1c5e31a1ae45e7a89cb1f703ba817537940ca6cd1e9cce2d87c06c4ebe672f3675fa170ed17b6bb128f758e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56558ca5a9ae60a2016c7f3a2ac975c37
SHA18a07600e32a3fd0e0bdf79f3c93825e7e12bf93c
SHA256b27f27533aad157bf0b6e1fa95907562e54231111703c64e915121fadf73bd8b
SHA51261b2ae3acbb7144abba038fe3861ed83c5998f68d91642352bace383e79889e2007a0d9dfa804795e19cc52669cb31129d693de3c49f269ecae104fd0bc33913
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fa98722e4443314c74fdf96dcd15017
SHA1e75f5d7e811c3695498f543265f45eff56e4ae32
SHA256aff2ea17210fe7cbf9f5d754a3b6b402ad48c9e0cd7e6b878ec8592268ee4c94
SHA512464e11b8f62c11efbf2284389894c7026a5467424f1fe97a8c54bfbf6dc728574e242a19f2e5d3ad0993bd8279837dcbf60376d551ce871253225b024605628e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e79425345843a832a4a0131043b8029
SHA1b0306a8f662cbc5c506191739774e682752976f6
SHA256bdeef1b31d43b591cadf99259b7f6cee78ad9986ab92069a5ba74dce7e663143
SHA51219e941fc990e79293ff11ff4d3b287adbe2a67361f895ab5c508d222b0a8717330018485b9c121b4d811bfc922e4f2ece22da5f737afc5df4d5bfe4c0b90dbea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b82930fa60bb20b7379b867d1155c71
SHA1df7717ba25a2a0ec719224eb35f7d50cc539eab8
SHA256e3ce9385f23b10afbb6228034918a38ea6a38dd92f75ba9650a8642714429c04
SHA5120acb6df8ef90d3d1d956b42fe465a1a1017747cd06b8a1cf5175032cc543fb4a8911f6edd10324e2303006e514c8778611147d013bbe9c4f975d1d41989daa84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549b055f1f58a76dfd5d18a82c77afeef
SHA101b5792161bfc00d4ce1810c5ceff138b80f98fd
SHA256bbc785756b4a22fbb77048a6e367bd516282004757580fff34e1f2caa16c0edb
SHA5121dc8febe0bc834c93e647055c6f3ebe59b2aa364412720299f368b1ad1f2fe89dc512cd4f346b0e7db738c3a80c04abcfea6e3ff4843c27cbd48f5b24cb0542e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ea4dc493def2bc88771caec22b4c6dc
SHA11bf8e3ba577cd23217fdb411d1b12a6e710ffba5
SHA256bcf2de1be086dae5d61331cfa966892fec85a093e00bb8343094b03eaca758a6
SHA512013eeae528d2adc89e61a84502227a6fc315a1caf37e9b911ea809f52da1036a145cec3d4fb3e770c05f6a46617bfb0ee89647fb8bcc7ac03758071a46f21cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddba60c02040a5fdb1d77c6f6e309c97
SHA1dafb10170c1a7cfb955aab982d9e33fd6c2bdd53
SHA2568a4bb7439566c173cd55a7d2c7f327b161c836218be967291a5ed60ad83d252e
SHA512158a630abfafa351c646bee24d45bc83c4973132360a5cca50cb2b2fe9fc8d9ce3d0d0f906ffd2060224d9c8995a4967175d7ac606f8480bcd7a1698691abdf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599a443a7b1afdbf93644dcd064ad4110
SHA1b1c4435d83f970e62e05e4dc8a8cd58c2172a432
SHA2560a46237d63ce8e05aecd2521a67c7fe4275733ceb85a1c6e407a0a84e73aa2f1
SHA5124ae9c11d18436bc67b9e37bfd9929fe3d0d3e60f6fac4ea6623a631a4bed22a0cac5c74c175ec73663b711ea154d0073edfb5238ed2e0450b1a1a6ed33154abe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba4f943eddb1aebef01cdc969c731c86
SHA1af1b9575abf3204c08887b9a5c9ecf4ad0133e0e
SHA256f7887adf7b55b29d143e3ba7f720224a530b0c9a8a2f5a15bf299ebf3d415607
SHA512a37d02441aa14008b36ba20f862577f82d68a448b4ed698a83cdc4c4fd655ae784c1785c4a2398d00cbafc5957a5aa332b3f646fd5cf1658b00dc9664c931ada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570bc09cf1d3d2d07f71cbf3a823a549e
SHA1c44eb9c52728583e5f0d3821beb0c505e67d3eeb
SHA2563b845120cd9c8189fd9a332436a13138b815e6619a4216b254287ffdcc514c87
SHA512403e566c07b8c2dbf73a98866e169ce2765abb6f44f1031bf03de14605e0b3236f5d9fccdbc24f67291ba07bccb565146b8a9ae18fcb0b0f72ff7ac01a622fe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fb638755a724cac4a13f999fd281590
SHA139017d8992f96e1e708c0dbed2675e561f69be41
SHA256ef1a1a6076965c31a7a581fb95f1cf0a1bcea5c56192a79268fc5318bdd55172
SHA512cdc6179f1d0b25b694bc88525ef68ff5ee8dad880611230cbc570b2471a1249b55a73a64800c54127de43dd7ea4fd4cabf2996fa7fae8ef0e88502a786ed6698
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06