Analysis
-
max time kernel
138s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
d9e4a9f6a8de1d9d3e36a6efb062d94a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d9e4a9f6a8de1d9d3e36a6efb062d94a.html
Resource
win10v2004-20231215-en
General
-
Target
d9e4a9f6a8de1d9d3e36a6efb062d94a.html
-
Size
979B
-
MD5
d9e4a9f6a8de1d9d3e36a6efb062d94a
-
SHA1
fd215d3c4fd23061ada9e7e0fe7401b566b89a63
-
SHA256
ebfaedf0bcdceaa18e9d0a2f6ea33db152c6d6b40f3fddc7d1640dbc29f0fceb
-
SHA512
1b2cba9c6b0d6983ce065887e924306d59e6c4aa2ba9d396c2d8ae2f092c9e3c638f17c874a0aef6a03655e38290a785493374c54759ffad3147b03342573e58
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004046e67d869a05f6a021ccb86fcc34f77d48dc216a0f20153a47f2877013e683000000000e8000000002000020000000653fa590e90846abbb7abb73376ab02ccf78ae95e5ffe09ab12abf6fd42ffe0e90000000e72efe2824eca90dcaa99d7e8ecd0bd493c2f7e67cdf4a9978ae584616ee95a0a8746851bda15f042e02402d977f46f8e04770a83f9a940de86b9e68b2d85ffe6de3cbdef9d3321ff0fb1417d2909301e899e44806ea8d62ec302318da14316a3ba8111f30477e034efdc86210f42b66cf593b838b5756bedf0575a0c68438c0edae8dc9fe9de6d3550c74d2d0c6fc6840000000e4ab3cbf8cd8d54e14132e08305545d36a14eeb725492d47a85c83f408476108fd5f76c9496ba1e7e8ba886a01c43ffc025719e8caa59a1ba180e7d7db285ad4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B41EA641-A105-11EE-B0A9-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000dd5febaef74e625437d23fbf57269641cbd71100dcd02bd95b2408e5ef61f232000000000e8000000002000020000000c73eb1f36852c4e27e7e03e924c23184a291899cffa35d899f8342ea555b1346200000005a58d8dcff02f3d4f9349c24d39bd3ce07da48cdedff637dcc84ed95a328e504400000007add8a53e61e5b574a2bf348f40a42ea48b169f81e06d2672827c2e8d6038a5847939b7da74a5594da67df17451ddf8b148acf771d82f3b65943c0678623d646 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0efa5931235da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409437508" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2736 3016 iexplore.exe 28 PID 3016 wrote to memory of 2736 3016 iexplore.exe 28 PID 3016 wrote to memory of 2736 3016 iexplore.exe 28 PID 3016 wrote to memory of 2736 3016 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d9e4a9f6a8de1d9d3e36a6efb062d94a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51518fbd0e1df2804d7909b369a5e33b4
SHA1bc457937d6262af7d60f2f0160b83539d521d357
SHA2569b7f600f5274469c5e59bcb0870cf9b4e8bfe1f30154a93978f4125754e2da94
SHA512c57606a77091c97fe4c481abc64285c47c97ecb64f08f2f3501dd0697fc5179572429482b05db498b76f53dbd6cb5be39ae222fc5fd276a93ab82933304c82e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5075b974ee969018273ae0d1dc1ca58ce
SHA1f42f272b10609f919dd4d52fbce00a17866643c4
SHA256d5cf8ec36c9ebc25ba84556c3ffa14b7b5865590581dbd6eb1e8cb4ec101edf0
SHA5120ff38f2e9e5ea810c02dfe957e4f3d7c42216a6760700b3c3157e4d8eb75d83331bf022f0683fc55596ba77a7bf43332e35079e08f234871fd4711aeb36fbbf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2470121526996752b313f92c5d4682d
SHA14b8aa76e6296ecb1ce1c4ebef19bb3eeb8553036
SHA2566085287d604fdd14e88ef08f86fd40a663e4dc3730730748eccf4ddf0f681695
SHA5123e79e24670d616a0d9c12ac194d8d3a42289f90f5cc6dd95045843ee8e792cbf55dc0a8d2253c4260b99a9c288abea4271f10c626740aa175f772524c5ebbc5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532015052e9e38165a801e2abfe3dffd4
SHA120716118121cb8d7a7a8294294b3e00cee8381c8
SHA256394cfbe4c937ef0d86d220f7b0e573e2f908e2d5cab9630fda073ea7c607d4c3
SHA5121e4e2ce000d1a6878ddac28f0deb8e21dc96524c4f25df4db7810d704e8deb24bb7e2c3d0680e3bf481764d1be4c15f6223a315903cef15aa00eac42c71ad65b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53df7bc10d814818bf38dd2a78b61043e
SHA1745c2cf36d72724bda4038f8f881200f0e451ff9
SHA25694e84621ecc9d8a80454fa8156eab13fead8de48098c114f4f2cda3e6aa7397c
SHA51212c638b1788d2c064b631f365e7de327bab453b3c47d676779eff62e2defb41119b38dc454d5071d6e54ccf6364cd72262c8401a01563bed0098dc1c36dc3e23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59050bd674715a9785c5c562aa064232a
SHA143ff0b8ea17953404b0afeb765f907f53dd6833b
SHA256d989c710c955bd870e4f6edb43b558e877a334e46e4e9b3883688b1e0a3e4167
SHA5120d7152d5b13f02dbdffaa1d8a6ac8edebdda4d09e5fe5cc6b8a0c884b74712abace08bf5766e879d8744b764b38e613a300d0dcf8c56d97986c5dbee70c7557b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d54735e4cc99c5aea187955586c4298
SHA16f9bf6f9efae035e60fc7d27c097a9da8f9e7300
SHA2562ff963a71f738173ce326f097ead25260c7f36f5ea98b98f4fe121d09699ddd3
SHA512a54a8c784b3cfc6c2a637c48f1037d918b07b46d8b4162329c5afc549053127a3339dde96336f099d24bcea06945460c68fc8a7d1c577c747779ec43ae1df082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a83861e68ef63b97c0542ec23fd24bad
SHA1bc3ef04a82bbee812a6ea4c4ee885c3dda47d08b
SHA256537c214c38c27f2c8bacca4986196db3abd2f1aaae09ee6a56d21fa5203a53f9
SHA512092ca34ad66f3517f15c2b66ae962e04850998402786b6f415b390af5a68fb1ddb5f2d3e53dd38ef8522f1bef93370d318b8dfb12c4d69b3dd4d31a774ee8767
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ae43b7761c52acace5bff9da1437a1a
SHA1d2b16ac01b118a073898fac4f4361e1a9d6ea76c
SHA25632a47243b4a8b5aea66168eec63ab2c45146b943296ee2f2a01c1bcf32313dba
SHA5122d35db21d9bb9d78d5de762f66c662ee0fce05e09ffcf7c1ff597e9c53948ba24f67b34a6251519a6535709aa0a706028eec4fa6b9a3851cd7b3a21a7b74f653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a95ea553bdeff734f55fa356c58f6345
SHA17ca44c8d2ce390ad011ee9b1fe1781ba1fdee6b5
SHA25613f2fe7783b3fdbd4905f711a490dbb68622c52ef16d6da7043b39ca76ef290d
SHA512c8f4a1ce01ab7e48de69e8ca5880806c52893767a3cf3cf5e13a8d16a251908705c14d6e5eaac5c6b20958e8dc575b97b983045b9fbac981fbd23cc171516423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57841bf6ebd8e1232c8ffde441f21121a
SHA1f340fdeb182943a4c1e707b24ca5e75a8ea906a9
SHA256e562b06c5f5b8407e1dbef92029492ea5058adee59c229c4e7c8c1f8c26338f4
SHA5127676e0cccb5ea763af3a5fe71a5df8e485cf18e18d00b0939cd9cda4f2acadb7af4a1e260927bb67cb627b8d1dc9ad4bb4cb740d4489d7fce443f271516fe72e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db1436bfe6de0be1df781747ebeb6fe9
SHA14d6823fb5aa740287e5f6e9dc511211e7eff2dc7
SHA2565846f38c9b5ea345419720160b2a65618214f00af78a061b8925ab8061965010
SHA512af22174438d21fad0f06243be9a3e4180cacd664cbfe5d15760ad4f7a4d591c055b06d1a6efa1c53323c116b5d6bde54563a349502dffd1cb1138eeb4b2ad673
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2d62ee2eba0bafe53611d6bfb9eba49
SHA1b886a16a2abf7de92be1b449d8e6762a652191cb
SHA256fb956c86c670fc8fcc54c7f23fa1ea7e69eb3cb95180153419fe3e81faafd804
SHA5120f3f3ac55699d32df2f75128c14fe3851b9491a9cfb47491c91fff2d7cbfcc4c8dbc180b0c736d33eb70281dabe70cc3c8ea27a7aee3ba32319dbcebda3e9c82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce7d866ea636500a45f3436f316edd1f
SHA1b71c3805162c73cc952f9e7554e9e797ce4f5f79
SHA256cabd50e3864b3a018647ef1756ec8f9be9f74f864935ab52c8c541922de0f01d
SHA5126fa0582c92ba54ea4e5a73febdee5619ba9a1ff193af925e3f0151b8ab199a9670d6982b7bcb3b0791bb44e2c33a77884e276a0395d1b96184dcfbd4300f4a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507a52b537cb35998cd8e22bb627f78b6
SHA16a32c02b0ef6f2c5bbee63f28d109403b25311bd
SHA256a5de99a032e810a3eaef4e152cf093765f45ca634aa9de714fcb22705a930e44
SHA512e7e07f645912893858b3c4c992295e92b2b2b77d517c627e9171918709e1ce8b61e4d6697a679eb7fdc281d0eca16f36a156c0f776fa68ebfd250cafb3033546
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06