Analysis
-
max time kernel
145s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 13:28
Static task
static1
Behavioral task
behavioral1
Sample
a3ded7cf9eb0b6ce9f2a75b3fba3cecf.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a3ded7cf9eb0b6ce9f2a75b3fba3cecf.html
Resource
win10v2004-20231215-en
General
-
Target
a3ded7cf9eb0b6ce9f2a75b3fba3cecf.html
-
Size
43KB
-
MD5
a3ded7cf9eb0b6ce9f2a75b3fba3cecf
-
SHA1
5755100a05e62173b69786b4d3ab0478b7d3b01a
-
SHA256
117170defb20746b7dbf3942173345014c173d5a9dfbfb3a0b6dc1c52b68fdb2
-
SHA512
125139eb0314988472c95ebe76b9e755d1a97c2c32a00f04f7e5cea149d8fbfc770610072cbb4844a163069b6721a9c87add179f35423e7c09aa3575b1d14534
-
SSDEEP
768:qNY2ZGjs8lyZcAUmLzqgwIS/Nl/Lk65MKrL1Um7yjbS9XG0UYX6:qOwGjs8YZYmLugwIS/P/Lb1Um7yjmpGv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000cbccd376843be9e900bf867850f230ae757e2633662ff8fda7b226cdd1f4606000000000e8000000002000020000000e8cb84a651de6e1d1f185bff3d94154e24ef023f5af03bfdfd13528ef5e439aa9000000053ea5f7ce56f11d4d8ef03d6884ab59d53273683bac57b204d61419043d43ed94adf19b54e4788ff68e4b96e8ba72845320fabdbbfea40b8bfb9d62a86cc58e675f1e4527d1c398a4c637e217e7ddb860171244b9f31967940d97b2d87c52da258bc548845569073832df717bd001874b4b422d71401270f48f2c18ed1c47210033e13b4d8e9252ee744f91919345f2840000000900f13e6b039e5efe4dc1f7b5b7167fe9fb8eaf11c7b8b56904c43dca58fa64172ef131799525a72f5c2f466b96c51d3993374b020c141352a82c946c0faf87f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409518704" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f062e09acf35da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFF79811-A1C2-11EE-BF28-E6629DF8543F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e86a677f6d1522eead13e02223e2b11b42de5ba9a021c8a2f39ef35d809f4020000000000e8000000002000020000000022c71c2226fb167c14749b50030a8d8962e218c4cca98101c66a6a33a6cada020000000305e750a4318649c3e574fdf63d3fe10099b08b0e1495eacc5f324a3740b36c340000000fec37dd68c087ef665a785047e189a1fa95f29659c49bb09cf48236aea149809da3dbcebc4c2039e6b29354daae91958da84e5f2b8104665603e1e447bd3aa3d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2644 2028 iexplore.exe 28 PID 2028 wrote to memory of 2644 2028 iexplore.exe 28 PID 2028 wrote to memory of 2644 2028 iexplore.exe 28 PID 2028 wrote to memory of 2644 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3ded7cf9eb0b6ce9f2a75b3fba3cecf.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508ffbbe7eee69ef92d973c9af72bd4ca
SHA1a706b1403a0261a2d504b4a61143ac71354db0ce
SHA256268af6045a14a7010b213499b544a35e5c76cd877b1ec59e312b9576d7a230b9
SHA51282031b37aadd353443979ad5cd48d532704ba70d4529a37e7d79b41654e40ad28971ad2fe002d0b0a6d16775b65987a5bd40dd10d265446b1c64f63aea2726fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f21f6ba80795c1a6baca1ad206f4a644
SHA107f3b58a0816f2afa4a13e9dc36569cd27908888
SHA256ec1c38f665ba18db3ebfd01e7dde5611c16ebaacd4ab564f3e3801080a9c9327
SHA512de1716f290c1dff5ff20054a256771191438c16b4122b0588ee9519fbfd60433575b89be0e76ef2681a81dcf535651ba3ac210b10ced6143c2c6590a3d9492e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eda115907ffe3753978cecc89aa0508
SHA17a075ad302a067eade7323a44b8ad693f50ab9cc
SHA25647844f122128c5e4792943af218c9f5562f021e3c92841afcb96d80f8b37d924
SHA512360745f9aa3ee18aa41d13e48a7d6f559839590e6f8dbb7bb673139e699d4c4dcaf8a3f25f7072131d3a2d18f501571e132a72f7ad85f279990a7fe5bcb13943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5368b71866ed9cc6b08be2d152b11e795
SHA13c6a4d12e2761e1583a514d06b114bd5a344be7b
SHA256379f7a3c72400a7b22d559f0c1401f7270ac6c99b70fd91602d24a98f3f4e2ef
SHA51298cae0938ff11d30bd8b031d8f19b198baf205cf4dce083f964796d7999115dec6c231fbac2b1e033dc64116286a8422ed537ec391cc194d906a97b6a46910ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a6ccdbe94ba3e9a1cd45964f0fcf07d
SHA14918a2fd7ef2d3617ef39f13c2940c4005fd9a9f
SHA25627e47d3bfa7e21281bb4f18d9110f8570444e1e060f28a2fce5a710baff4ade6
SHA512e5a1e0553dcf276ed43091819ca6d071c616e720698075f521b441ed6e57812b4a01e9255f556b607502fcf809576becefb1c24ac82af1db5703e38904c78938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1b992d45d8d6a19e3f380755aa8397b
SHA128ae40f02b7a6cc2d329d2d8e6ed5d4ad3272177
SHA2563553fc8cd90cde5fbecb62b82423a5776f7dec11025a05f9e7f66a97c2a0ba2d
SHA51269fa6c395bc4b1fe1464c8ac2ac2b1c01f35355e750d6f2198836752a6c9e5cf9294fd193581f32750f6e47b6c72d78572374f3bf26eb02d210936618902e648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c3f6a0b607e8727c2782f2bb3979740
SHA10727fde9dc42153d38f714d1220d217d50dd93e2
SHA25633fc29217835f196ed5b932a6eef5b3e6348baf3bf3c61367c123b53ab936e45
SHA512ef97fee447ab28f486fdf852ff0f6f6c5878530a1599bb9cfae888a0745c18ca4c29f86c4820964246339060b711389ba74cfa16627df959adc0abb80cbb7549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552885b018ee399a2604796c923012182
SHA1a70ce9e983e757795492e3e2a49f01ff9bf80446
SHA256e8629cf5747cfeecd83083bcb649c8ef25002993a7fbe52c077687df15059281
SHA512d1ba17a0da69fa801ed7556f6886c5c3d27b2c470a668cfdd7b3ffbef9c562a482364938ff2cec219d0245ef7b1ec4c22553df5f2edc053378835dd0038ed778
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577aa7289780c1abc6d8629732b8a9338
SHA11d89944d85854eff23c8c2a8e671aa7ce64b9fe4
SHA256fe3558b53050a2b5c8cc5825c9566e12a3d14140902d154cfc0ede1cf9477eb6
SHA512c2d16d848921a8dcbd492cbab3cdbf4aa79ed858057254658555f652edc249c00e9e38a2801bc5947431f194709bbb0de95dd164c0e2a8b2687243473f3be82b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bddc36abd4b013d3d42f3e2086471962
SHA1a52c6ba222321908062ebb65797389a68b44fce6
SHA2563ec9f8ae7cf7e8e1768e99ffa369d74e40aebf839b0c28b1fc048082e578feb5
SHA512ca57c45a46356b4b6322ea277b97aeb83b896b30eda2e154f6eb1fad49163d7b598a42beaf99820a92d1a7a5908155f31d3e7d847a9015a170ef4d83767f512b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ecceb1a776cc60b8d97233185a3cef8
SHA14aba2fdc6e795040c42fdc364b31d89337415cb0
SHA256d9cbff43c8f3d932e3ac3ab78582e452dc2ac5497c65b90a986874eb664b30a2
SHA51227ae98f7b1efcbba3e768ff944321a6470cc6f516e78768cab2b91a3324cf81d4daf7044285ef5ee78694ecfd05f20d9aa64a86f14bb47764196a2bb91f119c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de03301fe0851687c49b7346f955b964
SHA1a2acf6c052669500a6de11ca6c0875d8cc8109cf
SHA2564d7d8db00e346a6edd52d4c92e92ebbb57cbe58806307266ee3dc38d697a580b
SHA51285f7dfe839d663f80632d8244aebd28bce50e14ab7ebdd578a9831272e7cfd2ff997183ae54b6cdbe63d1e75efffae302066e83ac2778b51887ebb6170dae0f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5689b4ec1ac07194ebf5f1f0172f3078c
SHA12d78c28ca8c494072757b165263c2307fd453757
SHA2561482163e996d9655ba12652601e2f419de4e813d9bee2db6c383233d542866d6
SHA51231e0fa17cb1a8cf9e5ca3d5c58f09e23deca6c6737abb4599662d600b15dc77fd9f29dd7b3242fd2384fc56ebca44a4c358b8cba79c674c3cbb5e4534959d1e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f527ab77e21658629931eb8e0ce3d37
SHA18855ef463df21d11af8e394b9f988b4a76252521
SHA256e491853ce14d2f46df6310c334905dab07e1ac35e418ee207633dd9e1aefcc42
SHA512477369ab1f7cb9f9201f248fc1954e9e9851f894bda7336320d68df34190a36905df0df44fc4591274a7777627436a989590e12f0fb2987177762e651eae3ca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a5553d1bdfd25c21285f64399132752
SHA14a99ce8559f869239dacc11fea2611545ec4c174
SHA256e9ad71ad9fa0a990d71671a7d1987fe5a8babe943ba78bcb12fa4ab5cea03917
SHA512b2cfaeaac05d1677f0025b992a69337a97d338dd00d778f4f795c91e4d8c31fdaa9e9b0c0c2fab4f41dfa453844e80bb5038ec338efe78acf85a2224f6171fac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566c4f003e1d9beb780a734ef3b5f0f75
SHA104dd754b23f54b17f5874284c72b89a6b90deda4
SHA2569342a7ab37984a25c8ac321b42dfe5f68a7d7bb482969d6764f3dccf63f6806c
SHA512b90b75132ab9c3faf49a51844f1cfa985ccfea41ccd1578d1b761b78d569c9465a1eda4002a28b9d113f4f4045ee7d52c910ccdbbcc11a7120e12b1641fb7838
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585b4d51b1d7c5c35f35809882b31dfc8
SHA1b8902d24ee333f3c4eaee00d6693645284d877c9
SHA2562ad483dd1e6923e123dc1e8f186dbd9a7406b45e31301f13fe77beb36c5ab693
SHA512ea2fc250f8c215da5d3ca5eef731ded13d81884a376000be627cc761b30a5b7a5f79db98799bfbaef00bf693b5d4951c86d6e47463e529d53785e4c4ebf597af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ba4203a8ec9642ff8de7b31671318ec
SHA19b3ffed6da046bac4919eff0634516622ba35485
SHA2569663b9d552ee47ca4a484fc6459bdc9ed635023c18325bef2a5fd3cebbbb6a10
SHA5125c8657059db081f883ad620b79218a7f5f1981cd4fc8023eca6f6ed6cf86a2038734a9cac6688a538187ba345fc4f3f9aca629de722ef106da687c599dcb8c2e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
92KB
MD571e4ce8b3a1b89f335a6936bbdafce4c
SHA16e0d450eb5f316a9924b3e58445b26bfb727001e
SHA256a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5
SHA512b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7