Analysis
-
max time kernel
120s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 14:33
Static task
static1
Behavioral task
behavioral1
Sample
c610d285cb9d788a8bc981a6ff1cc689.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c610d285cb9d788a8bc981a6ff1cc689.html
Resource
win10v2004-20231215-en
General
-
Target
c610d285cb9d788a8bc981a6ff1cc689.html
-
Size
25KB
-
MD5
c610d285cb9d788a8bc981a6ff1cc689
-
SHA1
f34421baba3fee4d1c7802cc22611e3b71279573
-
SHA256
270d4a02e1cd7bcd0205861ffe09de5a0d37528255d36e90b82136e8cf46dd8c
-
SHA512
48ad1b36f796d45cdeadadef97be8ee02619da792e777cb747caa2ccb7f9a7077bb3a8c91c76ba2a25a69c54eca11cef24e84665312be82ed12f2fabac75dbe6
-
SSDEEP
384:8AnA4yw+xpPX1ZztvukeKXXTuwwBllY3iLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:R14ntWkekza3Z1k90t
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53F9F081-A0F6-11EE-8495-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fbed280335da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e8377f8820edab308eccac04d038ae732902eb711d8600f5ed2e7954df898d95000000000e80000000020000200000006458a0e5c3b1d9eb0cb90859164c7cb397d1b45962a933a28bda2af25ddec47a9000000081e7837bd1e411e51f642309891cbd0014344799c91d44e89c5d049e935f4ca44191ded2948aa6d9660213661b8f3aa416068192154e211020c78e8de182f833806abb4fee49b2ff3f63f0f3ce47677601b289ef4cf0ef6048f7108435a2ef145bdeb8f03777e8c777f1add2b2c173e263bd86d37ae93d26b3b159a5f34635b0e1d2f931a25288ee0c4ff6eca42efd1e400000006258955b064d476428cd01dd8941912450b2f15f2f9b4e230d766be8bbd63bd62ec3e04aa129a8e8f6ffd343c187cfeb4bfa10c6f327772a896db8befedab37e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409430904" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d6e498bfb281c8a6afd9c07bf9da9e362a4446a11ea52bdd1954f3de26d6b49b000000000e80000000020000200000000314c701da5af1f21bbc33811cef4d97727ead1f8dae3c50e7f8745e5e53bfbe20000000c14186f4022410e48eb570103c45110dcc11bb0623fb19501992701df620c3614000000061bc09f38ac2cfabb163ac4bbd38c5ebbed6a1749ccdf26f54dfb64710a161ea8d4269ce0f988726ea7fe12cf432692591fa93548d7abf0a751890ef015a38dd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1932 iexplore.exe 1932 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2716 1932 iexplore.exe 28 PID 1932 wrote to memory of 2716 1932 iexplore.exe 28 PID 1932 wrote to memory of 2716 1932 iexplore.exe 28 PID 1932 wrote to memory of 2716 1932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c610d285cb9d788a8bc981a6ff1cc689.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b068e811312dc0ef4bff6f6c84a353cf
SHA1058570fb31af16e0ef96df8aa8a7d56495de3d6a
SHA2568593775a28027dd23fc3bc473c90c13f28182cb9cec2da3930e49aff61fbe233
SHA51258db7920509fa392a5601a3e44bb1708f6051fdd4e6178ebcfc41f9e03af01d88ef22932ab3e71b99ae6d5e3c14a8b29a95fc623605c51fb76f7924760d5d4dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb1610ba4afd3fed36dda93389d879df
SHA18dfed27fac8d426956d670a3002b79e276e08003
SHA256102d93612ed72c5d99dc297c00ef65a938161d1ef9da879b74f1d5647c325cb4
SHA51204f2bd8c445f64fa460bfc6537f407d6499d53b0ebeaefef7fb8f25853b72ec7f4a486e21c9ab4a83eaec3a777313dbd420004958ccafd73f97c2c8f7ce297c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59584e8392b27ebb91d692aff5b8835a4
SHA111658ca29c850d3ade7aef4237109cc3d195c950
SHA256507c63b1c1add44b34d8a0ef0e3a39040eed9b006ef9420a46f055b6e25a8815
SHA5120f2cd2325a587f657a079166dd70b7b98e5131a32cc97f5f8e09965f8a4865e8afa0c3321048624cd51fd1aa6dc798672ce6822d02be4032e147b2e5275e2220
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ad752abce8d216b84bc5f3c4e017ab9
SHA13f671d135182c9992bcc6e7ad871b124bbc219b9
SHA256ae636b5c2072a9105117807953a93b8d7eadd378d7f8eee17c72b48d798fcee1
SHA512bcdf615a1995f4797ec3b6464994a8a7d3cb156c40297c2d87c45a41e1011ad83adb0b07301e2755240393b4180b52221bb0479429650b52285892444f025aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55baff4dba22ec32e00db2aba708e1d51
SHA179754c5425a12d097da04a8b8f45f2aeac34888e
SHA25606f4d9cd902ab1b62c3d8e9dc9b437d9f3148aca4b28247dbebab9f1543cdd37
SHA5126c9aa2ea91c91a966ed428d9a94c116ce3d5dd1fad391a9289216017d8f6f6a10fee89a5e97f102516f92d852916ad4303b2d9418737796daf7303ce2571fec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c52a147c53fb515768d56618842ee26
SHA1571a1a52e05d30688222bb8816d116bb96e385e4
SHA2568344698d783289d492e4f349095e477ad8112fb5402e74bbd026fc1dcd11f309
SHA512d7ac61f362db00e9bf903910f63af2b3e773788e8369936fc3e431369997b5827021d3043001e3fd148e215a1b0c4929d045315575eed2e0d5c21d9f260c5dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cca3bd61fd0e8ee3dc0b9293baffc37
SHA1e797eda7afcbaef1c304d2a4caeeed01e15b6b6c
SHA256798bd00ba02f3edaf6a35d11b7b98ff7e21892e2708c56799d7c28f522e6d2f3
SHA5127363fb872377ca9a531776a2d660afc52435f974f91dbf086e6ebec14b0a3e8a91a0fe7adc1855edfbd26754480080f7e43371175c9a3f117e5919ccd6d9d117
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579e6dd513ae7458ce2efa68077c79702
SHA1a76d3d97757cc867916a68b7281931e9f46687c8
SHA256f83aa8558ff9862acee698186ca57c4ba194a5c66b64ace1aab44b7f0a0fe172
SHA512a9df185b769eca305f2cedf49506825149e32fb8e6fce9d5881c12daf441f9a58d7a00a72189ffad2916fd27b647569ef847573c2c74a8d782910fd054977bb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575a3365d4cd9b5ad4f652e9dc335a0cf
SHA17e18e2d4f4fc3bf4a76733784244c73a4a09f0d2
SHA2568982a05853501210d6be2f3474bc8c86d8caa2d12528166b06de0ec7cd890d4c
SHA5129495101de5be920dee380ec54bc80e82c9906a67f256d5bbd6047fff5618a7040980e8d70c19303f4810988d27816355366cec1802f3dc9be758b49094d1b8ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a2f9c0b5f6461a4e978d63dbeef4f87
SHA1b7722f1e340d3733a4232aa6f33e7e0b6496fc8c
SHA256e8ac7f80d65b4f50272f478dfc9a3dd77d27fd9761288d8124d2cee15c298189
SHA512bde13192a9250d3bd54a3823459882a9ba4bbc673f02dcd3e0498a8b2e9d3e4e21392a693b71a9fbcb889b86752f870130ae2fb40457b2f4d4a914853ad794c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f874350073df04d6086c38b0bb0b9fd
SHA12e89352f1ec03be64d0c0e1f82ecdce7db642286
SHA25620ffc8761038cc46dd7d659cafc19982bcde2aa3f51974e1d764b4667ef917b6
SHA5121beb37a91c219ddb6e1e7d185bfb212bf7bc4b08edbcdff1bde018cb27a7f01e3e4cb14197d1e288099116769f02b7d8dd467097f29b9e6f2708bc240613ac60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb2ecd6493186ae07b330f487024a49d
SHA1d3923bee3cf11963426abb6face67f59c35db348
SHA256505ba350274dc860c02161185f14ef1d65655385e86c130dadbee8ff44fb499f
SHA512bc94cda294585806b3d2252e4a111848cc12acc1a4243c18fd7402da6f122bd9f268d8476e18617a43f2a6d65327d310790789d4e285d5e0b1a265a5bab9bd6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a689579a563f1908eafab48c6c7ccd8
SHA181037c608340e6ccdcaf205c375ace37bb907a6a
SHA256543cd7c36d77312b278e2f9f4f91516c8c8809ce1a4d644df23ee38686d3fb26
SHA512c38357bc93b2553af3469f45dd273216a7c66c11e88424be3b4322b562949d36c2981f007f5b08264dfec90f17d671e1511824053ed6b53941feef9c677f2fb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a37e930c4d7e33374c99d27a6991fa48
SHA1eb7e5cfacc5c22454b9144ea61479966d21ec29b
SHA2563ab6b9ec7af6cf9caee6abecd7d2393c151a37a0b4469cb821d0db060d24d318
SHA512e29e9c2a5b73070bd080134d699f6cfa65ae81657875f2e7480b7933209d4fb86480bbf3dfbe473101ded9c31d8ee0897753e2aac23a3ddd02de8923e929836b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598d2b87211ba67da308300450b44fa94
SHA13db0eb53cfa118126cf64c24714ad4262df16a9b
SHA2569e41bfe5e4a1199e5c052954d6c761dfe4f0700cb7804bbaf8d71f65b4e3e72b
SHA512263cc5edcc1565b0469a76cffd191a08fc9c757ecbb35f5e65af93b82ff5ff4c4b63794dc1fb89b0368ebb0773ea1982b8f41d24eebd2d643c360296a42063d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593d60fa6eae4ed53f40f2c126c845b1e
SHA1da45b5c87c1045b36f04dede418813c35b28284d
SHA256348965e399887f777a10254ee0b13940a97d4f208af3d57a0090ce591f81e52a
SHA5123b51b413428d7e619ed538e47b6e6014bbf938b2be58afe1696b034e920820cb04414ae539a93d3948b4fb5a56e61057430309acf91337c08a5372c2b6301e19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9f106b8d25129f625207cc2a9faf15c
SHA1c201bfd043022c61c52e394490cd6521fa4165d1
SHA256e02822bf6e346c2c396947afd2ac11b5bdb319cddd6be26b7089352be79d6b28
SHA5125427471b1ee6895e275e016afe74a2e41947cfa7bc3e88de07360dfc8174bd49b3d0cde3771cf914509be116ba7412362abab58c9215a28a6e00f174dffd309e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5054d39bc8ec12dd1aa0e087627c77c1f
SHA189c9388a3c99a889222bfa51ce728e18572c1d72
SHA2562acc6ad2f070fc4bc32f171bc58ee37c1e424746b824f56a92a86d0a1e5c568b
SHA512b21b66a3dbcde1cc59a983a138cd7bd63ea3c4e73172f65874be3a374794d001aa761c3c5003243ff54dbbfbfbc20edb511315bce035b2283277c6ea058289b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5700efa71080ca4dc79cbd1727ffd2ac3
SHA1a3723536446321be8a4b70fba4aa38fbdb44bc95
SHA25618c0010354f46ff2cf3fc07d615f02b365c829e87e92db2bc1eed982419de12a
SHA512d5d8d7f9f19f7819ddb987a9e6f618948775755aae06115e4eb711bde82908c0ee7e9c2d4126a02ab4bead67a9985059b7cfb1a89dd3b3dda5f0241b6bb54ff4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06