Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
be9ee0fbf52d5bca638973108eee2300.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
be9ee0fbf52d5bca638973108eee2300.html
Resource
win10v2004-20231215-en
General
-
Target
be9ee0fbf52d5bca638973108eee2300.html
-
Size
4KB
-
MD5
be9ee0fbf52d5bca638973108eee2300
-
SHA1
82c2ad479aa46449dda98f5fe0c9ca9614a93193
-
SHA256
64b7bd3431dfa68970b89720ea1826713b187882e8c61409eff91262efa78bb4
-
SHA512
8ed1a942bfcb89ecbf428c392f51af434349c7e6780a141d37ed5fe4536063b28574d8c4b472b26aa8d8d18c3310d7875b4c74e6b9854609d9a07716796c6859
-
SSDEEP
48:dUomXdSez50+4QNzyIOo2/GLPsEMwKHq48DilQsZd13JOsk8zwVAWwlxlG/OHctY:dUoedSjoVPsjwZ48PsZMbQGWyorbR
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a7b3ae0de1a9b4f254f6523121de383f699a280db1ec6f68d39bcf7f76fdfab6000000000e800000000200002000000078221ba91016b54118d2eb8a65b7e1d88786a94706fb4131c0cc98e29a35fa3e20000000ee7cf60830be6a4217f7ba2851e90eaa2ba377187ebcd7965af237aa96e2f13e40000000b24e739582ca4de35da93c63039d8480e9c4bea3d51cf464af9bc8d1830ba2dc5cdbc10eb3abf1b35ed73456f43c3d71aadd8e6931b0c77d2ba5baf50e46b94d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000003c3206fff14b77f59b72329aaf02aad9d3f684deee7eaeafeba6d87f2ecce54a000000000e80000000020000200000003a5e7d9f72183ab542c0e7f272d33d5b69b63efcf190241c39eb156fd7bd4df1900000002cd6efd27cd559c203e7321ad5731768dcb73c3a7689d1a61465902efbc481b9c5c30be4a9ac8fd945079f93fa381f608d6a8f579a51c5bfff9513ac84f95ae451dea149471a2f298424cdb36834f9a75f4baa3b14fc56994c9d7d5603a9404c319aa5d498213a1f573514bc6ae5db3a582add8772dc90f32a2d23881041a9b25455178aa69c336dd5230b178e2fdd654000000054c1e3c067465ee44526f5da013046c6f18be268739857fd796b90b87cf7a06391e84386abfbe27f29e7fee0b6dda43b9dfb389ba8ef67a217cdd95a6e1a079b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409428283" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BEDFDC1-A0F0-11EE-93FD-5E688C03EF37} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60156c10fd34da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 3048 2100 iexplore.exe 28 PID 2100 wrote to memory of 3048 2100 iexplore.exe 28 PID 2100 wrote to memory of 3048 2100 iexplore.exe 28 PID 2100 wrote to memory of 3048 2100 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be9ee0fbf52d5bca638973108eee2300.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55703a9951c40bf0be13bc9ce7c8105c1
SHA1b4fc988d8d26c62f34339130f12d4b2e382b4d29
SHA2564f3ba2159846c1b24e98ad007a9083f63145597d14f1e9cef4a75af436ec9955
SHA512d25e1a9b0e3fc05b8b7ebcf86e4dee1ed06700edd57442ff95fe9bddf140807eb1c6e78057466d48b90e77ba43f5695ff3dd4e2256d7513ecdae0282f5ad27e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568eb77869ce5c1bb78b041fe5fea9c90
SHA11b99e8f60201e8e058e16abce0b8bc1a9f1f779a
SHA25612073e15ea295abe475f4bdd74a4af2d641a7cf0ba524d4bdc7e3d73bc1114db
SHA512259f6906fb4ca64243e85696137229599615a5f1b2da1ca860a74f62c86a3da872002239a4cbc0e8be03eba3a27d8e6590c7b2fa1b92fedab46a2910af84a52b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579b72b79937b16f1240fa95f524f7249
SHA14d918a6e7d53d9de67041559eb6345493a60ac30
SHA256873a06b93aa3fbcb9ef81fe246accd8700fd81f8365c53b769b16c2e0771df6b
SHA512ce136f215776c674f55c6d263ffa2504424ab34076ada83fbaee8475cc410b7d430749d29c1df4c9bd89c037c6fcf84125522c6890180496e00fb65492883d68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a68b581ac044c7b0ea7923a06e19a5da
SHA115ce50b0ee6a0840987c4c78af198d67ae2a612d
SHA256b00e08a2d4b1ac5316304601608da594ca2f713a397e07e82baf2ee3bce25893
SHA51226ca1e11ac386fed834d0dd87d15167a8fbd6c3db5298592733404b0e53ba8c81daf0f654e9677bba7f4ceafd4e597a49cadf3ccff19c130827dbf2afd09bc0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539a3ff323908cd174f1b9725a9dd5665
SHA1071ba813ae349e1dfff8f2e23b71994a8dbd1b66
SHA2562c10059badee3470d6f199514a67e61aed6cc54dccf4916ffb39edb8013d2994
SHA51298a0b342ecf5d7751a3ecb41bcdb3dbc1a7492f9019de3e9df2f2e01ab78d6fd25112820bf9223f0db3ee6dfb3994de9614e68fe48f6a1316b7f5fb2ef889e76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7c70b61deb1136f9a6f3e6b068a57c8
SHA14389c95cbd07280c457b78e94d848b68b1d1291b
SHA256856a6d96823abef84fcba7a7d7f917fd12fe506bc76be63e3278259b13b3792c
SHA512f6776891af93e4645bb193bd7757187b091154bc46997b60151049b6915319cb65639b673ff9bcc7920844c00973e8eb4ddaa0b7705bc704aa23c37bb90167b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523ad85c3e6e4b0459826a138d7d8c589
SHA1b8135de84cf5ca74814c3ccad77265981c2a4471
SHA256dc7acb834824e524f844c9a94b7328fa2e8e7f1d8a221491e4504ab03ebddce3
SHA512abb092b2e3f2e8e84ac7f4490f8351f0c778946361ed1dbfe77298f87188524af465119a7b6e6554162e142173a168de7767255d5373e259f20ca656450fb985
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5488cab098ab42748d1e13ebc2d9304d0
SHA11717f29fb16e5109d9a361506ac2e2a940e17fdb
SHA25667d9dc98e832043845d3c2f9cb3e3f50ca37c72f89bad4564be521af2f0d5618
SHA51262a7e6e5464b7660c18af4a30e5cadfb42e73301ebb8de9bcfbd771eeb7ca0152e74c9e0ae213052fcd2c0c3f39e936f73360835adc20c499dc15d57f0a9dab5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df14220d0dd5cb49df6ed5457d563067
SHA12560387909e0b891f9cbb516aaeb47ebb0dc6b8e
SHA256606225b791e9ac09588112bb1aa8b635ef093e2bfdb5e532ba32941c568a922a
SHA5127b06112bd2aa27e4bf27ffab992dc53622b0ba3eb81a56e5a982146451f90fce551ee22f97cc7576b4102007a83eeab8ec6565228ce73e3180dc1ff993f3dde2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2453deb44b86e650be619c0433555fa
SHA1b01256a26ba9f9efdb4a03bb01ae27395b5d39e1
SHA256f303fdc20331e5d8f8953802aba879cef470f98d73e16bb65e09853ef05b3357
SHA5127f70866ce7b39e9b081e04d9c73934eb26afcbd7a25e4e2ffec4458e2a5eaccd3b04273d8a840921831a50948ae6c6a8b2f90a78d6b9e1226e66b60f15855ac3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5803f566ce2de6eabfaae1b6b731ea767
SHA129f9eb90f6a3c7291dd7e17aae1049df24bc2a31
SHA2564c513cfe35a7815b849035a2a1f5ae0017f4f6fd4c78a26f94e87847659fbfbd
SHA512c8cc83446d98d1569d2dd8f49759bde78a89084544f97c6264c45014ed2ae095d2237b1d56a19c23d54dd94d58a68337494d1229c60c9df88908c1cd4ef4d917
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e55f5e4e022c380a70b57e287009f86
SHA14146630b5fd7be5c6fe9c0fcff148389cd465ab5
SHA2562f8020bbf53be973ee8aab402c4ea73cfd943c537ecc2f79216d9f3e6c0a35f7
SHA51298293464b13716785fc13dcd59ff352cf1b765210d5955fad7172372206929b1338fecbef8fe783907fec286267b680bb7f29e6b17828f60fc05170dae452f60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53350d508d4db046973fc1140795c546a
SHA10c077b33c4b07c0279df4a5e26b955c5a2510589
SHA256587cbabab677328f7a99aff75740bf93b02b3df743b822b2486d645e61ebd137
SHA512901f386306e519abdd850db8abdcf0671a1bea0c3cbac722b8c4ebd6e30c85841e0c89bd00dc805e9ed129f6ed357f5ef0a81b9d3d4fa58d056a0cc2c315d610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b7450dcab47fa38240a277bcebda950
SHA106acb314767ebbf3e92f002b43e47c44dc9221b9
SHA25668ffd079aba727b46f66475ad84da2e43386d75a26e9dab763786e12df44a3b3
SHA512abfcc9a271fe928893e2df4572efe945a91aebcaeba94d6af0c895481ec8b6057650b16f8320458fd9aa6866ad7b7e495793445b4df0d47befa5cbc98ff7a215
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d63cf831f682ec5b2ebf6b2e59e48ef2
SHA122ea7ca4e1d36ba140d3e7b727da319bfafe06e4
SHA256a326a33d078f1cd5d885051049a3df45df44dc00d72091956c7dea2227a56f60
SHA512ad4b764f048a352993cf561fe9c401fdc9f15b74d3f6630b737e90f814510bf5b4880eb27268bc01464aef74b427aa5173cee5ad416fa81dd07378c93a0d3026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5e0b881763d976d18add407503e9fa6
SHA181a8ffadab135eb587897729b6e7095ae7d68641
SHA25600c9bf5b6703d48059e5d32024485363ff799b9b093bc893b32507893922813b
SHA51272274e60cb87984ba942dd31e72a087243bb3772b64a2e010e28e0c4b6cfe9370b8da19dd2784892a933f5eaeb1514dd36d44712b68597b3457055aaab8c1ead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acfe74e81bb7253147cb38973eff406c
SHA1d165c4fc0e280f8c806d40446f14d1c52d53f8cf
SHA256096d615b8bc71ebc91aee5d352ced23f28fe95fbd8a599147f8926cd6debca95
SHA51250d3e6f7c8e45a238fd6d193db3269fe0efca8ebd261f77d230ff10f448e10bfca56f2090a38f0ec40f5e5b1169f7515c4c577248ecfe7732ebac86a340bf4f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfde537eb2b5a57b510d54821b086ec6
SHA105a7b7481c27070f4e77cb425511869e7ae36aaa
SHA2561d7007c61b2fc05315629581db91b55fede9550f0b702c6a2dbafbbcef301650
SHA512c596c0f42be76d983714c0dbaac47edae9b2ef5f966fb238fa25a99d02800eb17551218ce4563e3411a6610727770003713354e6fd59c3cc9d32e396bcdb637f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52493330596152ebec4a8af24be5b9840
SHA16f5fb2a64a639e53d30cf58dd161d6629e972d43
SHA256f16a0ac4629093f0e1aae90324a44aeffdd6e4425221d0269167b181cc7d98e6
SHA512e0b7c4cb2263c9e07bb9b9c1134173e1a03af997c5b98b209c6c8236e2b2ddab8623876c46e8a390c784ef062724fc835db757aed6e89983e17e8c3522832df6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
146KB
MD52c80c1974e4aae8f14bb5b978f5d9a3a
SHA166de52c82a53364d9f535e09c8839caac9e978bc
SHA256b0155d090941a888fcfbb7d98378a4cce530231f8fb7fb4f28926e4d74689684
SHA512ac1ded6916ba16a356bff448b743e8bbffd3fee46830f00eff466bbbad2c261fea00f6179fb7fb399ae5e901132c4631ac4f43fd97343ae1fa7a67083e2ddc30