Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
a976c2997d928f980f54cdc36b68e2b9.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a976c2997d928f980f54cdc36b68e2b9.html
Resource
win10v2004-20231215-en
General
-
Target
a976c2997d928f980f54cdc36b68e2b9.html
-
Size
2KB
-
MD5
a976c2997d928f980f54cdc36b68e2b9
-
SHA1
bc0e8f6dac2abf3f6769785fd4235dfa522097ea
-
SHA256
34cd41e06a83be93e09674d2fe952f51bbd09a87815dac4f1e55bae115c59d7e
-
SHA512
6ecf2f33c67a4904b2422fd7a9f5e24f52e989a4363b4ae2ad7dc58b7d67cf5105621f385e535b70210b8132503fa02c380c72b82be387e6cd3069ec3b51da5e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07b8ab2eb34da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409420824" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDD9D301-A0DE-11EE-BF7B-F2B23B8A8DD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c52b2a0b8d7ac979c4866056802865d7da942760d7fb0a9114930513018ea2c8000000000e8000000002000020000000299391e3e119e81ff57a8d12b4947abf80a09d1fb2621b949c6b5080a0c3a02a200000009e516f94572d7e95b1ab3a68d9f8e86e88109af7085dac34aff2c995071f500a40000000f87308227c1568773f0c405a2062cfbdd5a4bf5a20678d87954528b032dc4d34a3e8d0287dcfb5e6646d5db50f4970840276c1e6783a191523cfc97ee95ba4f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000088174f6b1428b086076bf000081493215cbfea603f661f9a5ec4c049b9cc8e4b000000000e8000000002000020000000e669cf34009bba32bb6627d4d0c2c811a06fe7db35b4d0b59f31154ffffa677d9000000006baa890da27e7c24c79a2e7c44f35273aed0f30cd87781a24fa0b74e5210ed6d438865f0f66d4a3e81057c63dd03e166cd502ffa44e6b690cec0ccdee79daf05ed6f48ad5ab15512211ae66cc699d0b48c61551c41ad33c8d3d9a4de5c1bd7358575c86f813b658090fec9dedec4edf0edd5479d127809c647832a6e4bdda0a3a3fa4ff41ac002085c9471f186bd4b340000000ea46aa4da2e442aa2eed1e8caf18cd4fd782fd20d11009edb63c46622ad0491f98f66c77a1415b07a09ff81a6d11802929fd9d33877dc690a9e5dc1b9927a8da iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1440 iexplore.exe 1440 iexplore.exe 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1440 wrote to memory of 2024 1440 iexplore.exe 17 PID 1440 wrote to memory of 2024 1440 iexplore.exe 17 PID 1440 wrote to memory of 2024 1440 iexplore.exe 17 PID 1440 wrote to memory of 2024 1440 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a976c2997d928f980f54cdc36b68e2b9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5741334fa3b0d057687a05217d421204b
SHA16d376f8f6c9afc3e04387068b3a4cc12ce25125c
SHA256badc51b7e03dc1f4a73db8b1efa6c951723019eea3180f27317a343abd10d537
SHA512f4dcb12d8f3d3db0f73ebb17cd2bd3a4d670291161f3d9e28016a7c4e3abfc3cf873a220a44d71098a75f12ac78621410ce6ab3b95e83da4fe1df89a44ad0b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e87321081fdc6bd58194ecddc6f9d121
SHA1dfd3b656d6cb889a43e12ff9bc3632f279a0f467
SHA2564f099bdcdb21bf20f1ba7ba4d6c6a10ec71c9353ed1484a2c2a729205048c926
SHA512356422b086c37fff37606002fd8f1709430f97036c288a79631c518b5430a3abb48c0dc6762278b07335e91ab6cea336d8f8795808a675a55fb3077ea87baf61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518f68b427489072b1f9a7063bb103e25
SHA10530fe2dc12d282efd44507a3237e2bd49ceac29
SHA256d27ce8e1b17d046b9eedfcd9f8271613b513c31d948e5198fcd57588a09fdde5
SHA512de7bb1d9f5afdbf0389a22909a6cfba8ae05116e06874887105d834e4e1ace216b1580580b1e885e5395c3defe2987670386238293f44488385d13298d16b9b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59575ce1bb40de26fd6a38ed973af79f3
SHA1271486f0c7d6067a33c8fa7a705b0f5746fc5fe2
SHA2564c3910e139273cd312d2d217862a0ebac8d045e649f4bc4c005a905b1b146477
SHA5125de6037ad7f66c32d49d731c79fe990c6d1e7b6286cceff02b1abf6f7fd72c29d346a01fb26b5b8cd3bacb0b491573e7c6c9452d7f877722d8bb54fb61d2dc66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c11ad06606434ce003350b598f6d7caa
SHA14e3c669461da973028a4fccfe8e084b2d81d1f15
SHA256d616c4e5b8cb4fac552a655529619b009fc1386d6d889506f40e4f8e60323bef
SHA512c559c52be179060f09198d7905efb5644eb978e2d0b984c86dc821a390e231f05c784a06aaad58e4732ee9c86acd9cfef6ecbb0146a9edce344a6eb6fabe7b02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b5a7299636f3c7f09e39b56a0ab8bb0
SHA1ccec08c9a184951768977824177844a8735af0ae
SHA256a317200d331adecc4fe6d6bcbc3ebdfe02eeb17210259d33a77d81c4afa17c81
SHA5124accd65e65a8706ed68ac2f0218514b1715e1b5903481cd65e637cdba73ad60b93f952de3d7511b4227c7b845274b03486d0128e0ca361d292d62a6fb434bce4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c442b4546f32d7d67f8b01da3cf0023
SHA1a3ca56096751f47d265535946fc09ec27aad992d
SHA2564118a03ade0156fbc41fb18c035e7c6a379c0fa4208b06b1b2df4b49ce197010
SHA512d0171639809b510c1e4305a00644f755e1a7b0c6633dc144801439e7494443654e28ca293a10e13656541e164c78e578e6d4a42ebcea5f19370f5a215374826d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b39842d4c43f8ac1210fad4e538d674
SHA1eb46d6dd6f2e9fe0c864475223052f331dc44dd0
SHA256d657eaca9b5ef8f89ad2be874fb06cbb5ad7eedf9e5bc111f23217d285ab616c
SHA512497e2df9fa6a30b241310e8ab57e3c0f66d7bd682019f65922917d4347734d96cba748b07349cf8a5baae6e493f8bb4d3b79b86e9161931f7103def84fd441b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52af12f08c485aae48db8f8f4d20ef4c8
SHA1ffb1bd085da879360df39237b878949808455812
SHA256cff5bb0e536907ac1332ad2185a6382313faa09b19459eabd87b3aed117dda9f
SHA512d06b3736c33ed765a07357e48cdd8b1fed2c74523b56c789e944794dbec207d30d773c941e696bc7b08493fd06228c3d0181e8fde8eac75fce4e3dde714dbe0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595edac36260e02f3d4359c29b0d1fe73
SHA19eeead67d8f922cf79050b81c0514460f6cc968c
SHA2563732942c92cdf7e844bb95752bc2ae5c60d7ab8c3fd89c3682ce1f3c0b1275f8
SHA51256cd9913a94d5f6235cf82982d1e81590b5158eb66cd9aff5f4587cc85f651c946627d6515372f414891299c1cd4a04f253309890a7e8de2c4724e6964d05d81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593f863a3529264e88b70dd9a0fa7a954
SHA186e8e37e7686ad3b18465b23f48c017bebcc8350
SHA256a9cbddb003243d31f0a477415e505a24f9a565dbc89ae924a9aebfd28b05f325
SHA512b54c8ade06fbc8eed4a64be337101736408383c347c91b78df29eb2508904b959d5f9f425f0aed40ce56a8fb0f5cba11965202854f08ef53bb708047070961c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f3e0eb28710b578446b6d7d2141a652
SHA16eebb5ed49671280fe9371504ec139f1164e60a1
SHA2565f5e48a37c9e99c8b90de6b4cc79966d4a1c576ae12c734f2e2e782fdfa99e39
SHA512b6d9cef77930ec6ffbe72fc8accaa949e44ded4ffb14a8306b5dd2eaf40fc002c0366abde521917ebb946027a3b9ebc901922fffa540f2ab3b08678deb2304dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b78889c2100d2604bbc80df7cda3108a
SHA13cd7b9ab106b3f69c0211c6f196db5d981977737
SHA25697934007a6ddb9c482d21bfbae154c3fde4be3cda6458253fc65ee756759f452
SHA5129d0ed90687150922f4a67682de949aeeb8c0c28953db15b630ffc802eb36058fc2228f1d926a241af40f88257c9e701016b32b34af7c9adc90ee13ac27f4ab47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f87c989c5b4b885a5ac6d2d03a42309c
SHA112967c444163d04b99069ba168ca5c92eb042587
SHA256889db080e6cfecdea433f0b3aa4e219c978c3ea4c07399291a5c15167dfc8529
SHA512ee329872c62af7303e14d06ad90ae1bb818c9a47bd4e21ef0f6d82777641c2f8fa8a5d864218fd0ba2d84b073eb5a6c1d4487db101af2e6f0bee3bee2e5f3fde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de7a26d62773412708d72ecad5e2c99c
SHA177661f4835ba430e3d727c274a97ee3c15e72e8b
SHA256bcced54f36e261c9c545cfaaf7d69549662647b14eccc228c2c803129af19103
SHA512a9806e3b30c80e2614f74882f7e434ccbfbfa72baa95540618b3b0a20d47a2862fb7eedb8124489103f2d6595419cb3c2d76a26f3f197827301c49b61edaecce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595e0943e73eb6741509ca96deda0193d
SHA1cd13ad9eb8b68aa4149a888db2931bb359d457f0
SHA25643929e5123029b4b4adcce0645fc02bab6e016e3c42ab8f21f8431f81d64ee3e
SHA5128b7c4acf5ed3415ecb8c05517a8ff388d59d44526894be36176a4a14f78ca4d52d01b88ee2ac84ff85a722017d602dfcf94ccfb76bada6fdb4501774fd646455
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ffcd13cf5a3b65b1b33fb1cd0d33e6f
SHA13e846a615ddb10e393fb44068073783d0ffcea4f
SHA2564bd6128ce9ce777595a942a1232b4608aa72328458c9a200162603d0f2d0fb11
SHA5127f8633bc4f0b1129ca48f37dad0a9c03883a6a30d4100786173c9f65e11fb326b6bec0216ad46794e8a7bcc6606e035264395a653ffc8776e59bcde14d2ed1b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c5953d1a04d621e4eb267e43ea5bbdc
SHA1cfac5e37ab1861dee8b9f49a9ef9b445ededee33
SHA2562901678e159b50baa67d1edbf9cfd5e33fbcf10b333a0991a407c226cb2e2b18
SHA512ac85aae4793a72365d35184c9928a07e1bce468a53b4f6899afe97dce6a0e5b8ccfc537e9cade05ebf4d856ad1550af4843f91c2bcd164622a1df678bc610ad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564ab10b8e26a1ce18b7a29be5f592ac5
SHA18c14d183e00ae3723531652d337a35d57c9ecf76
SHA25680a35b6a3534ab12e5b3a30f20ec148baa04fd88b1d98e57a32e48555138d483
SHA512689ddce1824794eda619ee8a2afd7d1c199c02a58bc0f1b8bef5650d9819fac650033630bd8cc103e9b8a5a5c9b1f5a2fc7a70afc5f70ecf4bbc24183fcff880
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
61KB
MD5a9221c32e2a8db03ec9c093f97df8721
SHA163605d3226f92732b01378ec42556e40cf9e6c37
SHA256a8c96e794955747be941b5ce504843b842544fb08d67e8a9da600967eb4979a7
SHA512924cfa0f0c3c53f8e7ef2d9a1ff81fcc4f331ed2a4f1588a952e060b6deee0be73817642614e6614fa374a4e501de651f57cd997984fd9ca3c9d7649d6fca05b