Analysis
-
max time kernel
120s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
c7b9da197598e00b681f0d76cc80e92f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c7b9da197598e00b681f0d76cc80e92f.html
Resource
win10v2004-20231215-en
General
-
Target
c7b9da197598e00b681f0d76cc80e92f.html
-
Size
1KB
-
MD5
c7b9da197598e00b681f0d76cc80e92f
-
SHA1
19c2222e902d772e9ee9535b574aa266aaa55bdc
-
SHA256
4fd5b554af28085c92d8840208d7f8b4b7740a40fecead6abf01db26abc597f4
-
SHA512
7a8359f0587dd19c62a3129870d4bbbfe623eb9fa24cc15ad34b80cefdbc1c6cfcce58811294aab6a6d4e8bb2c3e027c35f308e8b147f8beacbf97fcb50cf918
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C859951-A1F4-11EE-A508-CEEF1DCBEAFA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e6ec642210393cbd1aed242a6a814ffdbccbe689e72ae307050695be6712fac5000000000e80000000020000200000005e7fb562816aeffa759aaee2887db6fef331d712281cd2d9c17f741c3c37bf00200000001be63d357ee2db894cc762ba1d098b4fffd4c2c553e15bc379a7e9ef9855933c4000000086dc5aebb5d893c348330b0a3d3e3b835f3f9659325ceffe75be17b72b0cc0b9ea97b2751aa48d7ed6dd084ffaa5056c97f83900abb5eb3919942a3b08063b0d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409540097" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0dbf9620136da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000fc4d13a185e16ab7cb3c8166727e50791b7dc5625c978d87e2650c38b88bbd6000000000e800000000200002000000095657072d119bf76d0c6c76fbf2450983b118dcc4ea7ffc4c8c37fb2c6738db9900000008a5e95cd8698a9423207d43148eb8f51626413b39a71430ad811dab6fadd8a7b561be40ee91b1d2feb91f0d73800746380cefc0881b701fa73b1e3ffb9a03d9ff1c2350631f1766e8d28f199e0a7678f4b1a10b646924b57516a5449d1c645ac16ee7fe064e1c030187e8d6b96762aee7acf3c716c4c35b869bd28adde2e8e62af7a40d3eab2dfe3e5bd644cb35ff30b40000000ac3108e774aac9be657a1d498c9491e510fd9745900ec36fceb45b9fb2d482e21da49689ae5d80027759fa49c0ce57c319457ecfa6fcd635a9adf1be60e134f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1692 iexplore.exe 1692 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2928 1692 iexplore.exe 28 PID 1692 wrote to memory of 2928 1692 iexplore.exe 28 PID 1692 wrote to memory of 2928 1692 iexplore.exe 28 PID 1692 wrote to memory of 2928 1692 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7b9da197598e00b681f0d76cc80e92f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506f149c005b3378471654e6d9f35d0ea
SHA15de1b1346e2640a56f387b2d7008b60ce9c31935
SHA256953a154b73eee0ff117f35e73df673057f7ead4aafcce2c49f083318d449460a
SHA512f0cf139cacf98189720b3fb4eea8bd88f79b2168b009786e6dd16be7f144af150f04aff9e5fcaddaafa7fbadb9110a6c89e3e31810624e514ea3ae96a2dc9841
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5616b8c0e4d2850767abf0694cd1dc690
SHA1af6b80f62a12eace85917d21f70e28efca261511
SHA25635b105cae7cdac52cdedb993b8f2d87eddca24010d228bddc1afa9154e5f6c1c
SHA512f3d583b05db7c692d94489ca8b73612c37c67c0df97aec092bc95e1355ee2016c9a8902498e6f5bdb8982d5419fdb4f69b6d7af06716fe769f19869c2dd5f3f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7a23058c5f3f724432380a945b5375a
SHA156041d6f433a3625c508d3c20f7ef440e05bd152
SHA256d6f7546f2bf33e3b740468a94ec8fcd2dfc221d423c85e955035d45c70a31424
SHA5128fe7d39ccb4f360ba0931dde696d521e01930c7799f1eeeafac688d5c6120e67398c0f5cfcecf6d1384145b1f5404a5f467a7b3ed51d65e2023f719be0bc16a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fced8844db669f38291718f09cba8d2
SHA1b854cdb0dfd65989e3eee476cc6592984909c0f3
SHA25656ffe9399e6ef88b1ec71e2142a923fdbf97ed79867d8fe9d1332e05b1b944ba
SHA5129ff898279bff3e37d082bd00f421c5449d8cd7e81030b97786a7d79db5896fad8c4a2585e26fc8ad0f1c63d02a5c8909bfe050ef0766477d8889d9ce75dfd617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbaf5eeee8126498eda61d9497d07e89
SHA10a6af7e2adb0aa05ea4891c16739c88486531f7b
SHA2568833f4c240c9c5e89056990edb21c0c7f28cd6a05c91a08722d0ad628296de85
SHA512fef00e8f80cbeec6dfd30288656712704829e1a60e088d2507a25f0d565caa847586f5ba7ffec2e9643ef620ec56ef2d4fcae65d0791f6708ba374d6446c6550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599892a6d5169ea16e9a68d2f08528180
SHA1f04d568adb4d48364034d4f9ab8dfa45129680ed
SHA25684e0ef31ad2e617e09e34a5371581aeaefed9c9b0ac22abafdbed3c50d1f45f3
SHA512f0dce9a3b53a87326b8b1480c23c69742387576f4bcb870e5396eb2a65a60c5452b3a46e4dd2a593b14c3ebaf861fd6414b6c68d89a868edb9079f23d4248ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520371b5fbea6bc6c91b925a27781b683
SHA1c69969293b1301c9e058c5d53c61da491ad6b5bf
SHA2568b8d1008cfe62b66d9c93e8d77c38f46bb00d1c0475bf4efea67e00d8f7f3675
SHA51216b0a9660bfefe83a319df29f5c048c921c686dbabb130e41acdd33b055b3397080bda5947a6ff6592e47cb00fc18749d58c03bc7564ffa27d93cb5a50d8c5be
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06