Analysis
-
max time kernel
121s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
f1dd788748c1092b3fd2c683b931c3f1.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f1dd788748c1092b3fd2c683b931c3f1.html
Resource
win10v2004-20231215-en
General
-
Target
f1dd788748c1092b3fd2c683b931c3f1.html
-
Size
568B
-
MD5
f1dd788748c1092b3fd2c683b931c3f1
-
SHA1
4e11cd8f3a71c96f97b0678b9625a3a6f1baebae
-
SHA256
714031288814aae2da732b60ff367a5280782c4fe76938407485ba9a6b7a10d8
-
SHA512
62157134e3efc51bc7012d9366a925a37b813edec5630f2066279511639d8127076ffe20f1c969f7b6b5c25c2e2db263ab83a912a93193106359e2ed181630b6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2004a2e02435da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000568fe0f3da6ed81632caa5e72aa41aae62b483bc76dca889a7fff748ecb65597000000000e80000000020000200000000f4fdfd05035e79ca0e6d5a1fb5c6687bb82938f319e7d2f583d3b31c9469d52900000004c9eec88988808764fbf439a5f98627f8b96a481d844a51fa2f92dd0133b16e4f70e8be70281c11719231be9ee2f4e8223a1e1f93a0ce211b8eb3c5e787299e461c5c648e8d139a248eca16b36b09badd152276b792ddee93732918234610e84eff198814296156476698423a22e5340ec9dd17113080d530bbaa1ac1a40a0564d653d914a00fe4b946cfad55e2ba33240000000c8e6dac0e2f8663b31d0350bbdc65a9e7b8ee1b0dc7ee2f895a31d002241ae538e9e5009a3e227ad932d6e493ecbf152cf5025929f95d05cda54dd6fd0e58d74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{066484D1-A118-11EE-AF44-76D8C56D161B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409445397" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000083f97e5e596cf0cf2fa90b3a553bd19413d597bbaaec830b6db3d7d79df2e958000000000e8000000002000020000000f5eea2792608d035b0f08da24693a3fac41fd57d08d42deb07d9dd0a9cb8ba3e200000007a82b0a86729f5c410c1bd8997d9b6384dd1b64144e9f699362996ffce9b6af640000000b5865fc236cbf67a4b4740f1b2227a07a3a101cffa91bc515410fa2d735a15e74cd8e0d9ecb342754ed573a39155b7a60f2fa052e806cd295398185428ffb199 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3020 iexplore.exe 3020 iexplore.exe 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2844 3020 iexplore.exe 28 PID 3020 wrote to memory of 2844 3020 iexplore.exe 28 PID 3020 wrote to memory of 2844 3020 iexplore.exe 28 PID 3020 wrote to memory of 2844 3020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f1dd788748c1092b3fd2c683b931c3f1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f372204e315d191e845bc48baff453a2
SHA11d9d9d65d0946b1ce1356744990c2451737a8cbf
SHA25605aa156717c582374d293322e0fd81e693bbd76ec31ef4e53d99687289578c87
SHA512a1069973ea9f1be8596cc837477400a3a4510e78ad1d57df8d9259fc4dd8de5b9a2d440823a5683bab34cb16eae6408aee6e8812062dc02429060bd01429a4ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d357ca0ad4f5da772ef21a4b5a6f220a
SHA1a87fa2aa6ecaf9436a85a803d6c605cf2940eec7
SHA256a4c3f48208039b72b0367e3114b782e47f742d4c03dcb0861b202bc9d05516c0
SHA5126203e92124e7565233fe71cff39cead62ba87955fa639d4b9ed66737e3d0f96886fef77fac80c254e4ee7a0a1d7d41bdd34e82a4c4c69bd61eacdd4fc9e4d830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc80fa4d6500ad4f7357dad44bdbca73
SHA19ee5a0eec04f4b1040c7eaabe3388a5a04652825
SHA25664aeb0f18cce85316ad009aa35e5675e0e9cce8423640f809982dd7e78458da3
SHA51272044d0df624ac0ae0b2aa0565638706ed32e43407cf2b265ba75d4dd60f1d4ac95c298965a05a2fb4f6c9bfebee640860f3eb8c727c499824aa8b93b3f9ca91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b7a1388e37ce96fdee74d4e7d46ce89
SHA1164098c7dd927a51bcb4f6b22f523b4b9c6f9166
SHA25658aebc5bf3f8858a164ae401a294b6223cfa0cb402617602365ca1313fb6af0f
SHA5127cc87228e61c73858f4560e8028c0eedaa82364e2bc22ee91800b4546a90d45959abae1de3891d1a35b0844f87e9584ff1809596be5d9460284970bde4b659e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d2a4e10ce93bdb7222ff558f4e1e397
SHA1adf2ed87ef792505f49d9db9685974f2b91df094
SHA256a4548819c9b34797a431b54f20d17bf334f4b19f183f9e1afa5955ae1a7dee08
SHA512802167b7e9bb6062e9f3bbedc5e9d5bcd90aa2839d658306d8553e010518ca4ffb937029b277d537fa39fd3dfe47432aa1d5c7aea4883f09d337e9b86df33282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564d41095b02f07b6c9e2b9fb1c5e5941
SHA13835134e7fc68182890ee67a9a878d2b27ce55c1
SHA2563888d9c60ad1d0a8c023d7ac31deadb906b93a2c20f641f98146865aff8055e0
SHA512fe3bca1e6be5105b630b17b0265143dc0715887b6cf5d445ee50ff63e5ab0359f1d78b529da721786b5eb72bc442e44e81f2d49be8ba84038faa2b73a37ca8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c67938774db7894fbb9b0a1d458b7557
SHA16cc7ef04801317ef6d86c5a1ad666cd091ea737f
SHA256b5ff3135592739bcf5babf3a7b3c5b62601185d893c6cfc57b596da8d8fdfe69
SHA512233b08e5c2804d0de755c60389b166a92ace7e27c25adb59ae75377e4b764d2f04295b09f9a52442b73acbf3415aa19cfcedefc758cbd6d7e4f8eb6fca8e81fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c686a19388ac1602fb4d015ee682249
SHA178bc785d1cb80a05c0773a8e696990122d0cbc99
SHA256b04df92c29564063674ac328ddb4b623f1c305d77a9764bbadad5db24689580e
SHA512b0277b05df2f4f5d741d5514c684a99e35279ea0e6921deaa1998c0b37daceead91ed80c760758ed1e901957ed1a970e6a4d53edf604e25bd7e7674be59701cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dc6424001ecb6c8f1a703f57367fdf5
SHA1dec12bbaa32adc5082cddca95c25c22cf16565ae
SHA25614cfee14cf64ca1bd68650fb3c655569797103135326ee563a8568d6ce017ca5
SHA51263655dd73649d0877dcf0873d99cb2301fdedd28c9fdc7ccb32143fad67f893ac6ef537fd3370487d39f087ab0bea59b459c397a7843097c201293e8fbcc20b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a69912b249959732f1f45a78550f671
SHA1639c43be70b1aad5be27ada58046b90ebd53ac88
SHA256774e5a059c433e89fc912203e8ac130c10cc3918d626c9e21f833031dbc401b4
SHA512b457e64b7869059450cf0bea2aaa168837b0ea59ac07bf343737d6dcd853e8bc2b94e5b833a037a032dc41feb4fb9f40e43771137f97815071ff062eb56fdc83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a768a9b5f3edf64cbb2e24c8ecf79844
SHA1e93e6edafbf4c43d5863984f9923ba9347d800d2
SHA25670f85d7545262763905fdd52a5ce8164fe91d8d799cbfe690590048737892683
SHA5126772b748d77747c2d4955182fa191e96004359ea346e63295acb02b46d6dc0ca565f5b5378db314419ad643c11b857f9d017865948b7bb116514356917fdde7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c88999a5d0ed07b540aef492eb3b56d6
SHA1115a42c6e60eb749a20e3fb5564e54d2992df0f8
SHA2562e6db8eefff095b03cb6af3e16bbe75011ce12424183536135cf924ac04cb448
SHA512efc6ff08228d59f0f141e77f1f103831bd20581718466ddc588837d74627fbc80a9b56bf76f016fcacf4ca5b8625b6d59ccfe789a46f7aa576cc36e977185cb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ad8fd541a9153ee1777b3bfb13c6725
SHA1e6d39b21eb02c6f66126454647cde7511dd306bd
SHA2560827ffc04187f9e878ba07aec8384e96cd5593730b29d095f3494ecb01f714ae
SHA5121abf88127d67ca00ec501a42ea380969bf9b31ea19ae33c1c454cba83e24070f73edc45cf79de49737dd463b012c30634fad7e1e3789fa7841d0f5c3e908057e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5390dd7678a71b7c075b52780c3c4ff9d
SHA1600155cd586c87cd2116db889a42b61c20deedbb
SHA2561aff0639c277985745ffa3791f5c19cb2997231ee2a278941c4ca06e35a95a7c
SHA5121f82712a7183779aaba735ca0413d2ad08e56f714b2fb1e90c7b14f4833bc62fdca23e1d77306d42b677811b665fd8f137725224b56857bda0af19a02b49eb8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5219cbdb2d14ef3fb89562e8046109a90
SHA15881423810ff628a791220f934ad7615b47cbcc3
SHA2560cd56a23d069bc8e000665f66da1eefacb201a357f744c15783a654dabb0068b
SHA51298b2092e5e5ce1ab438909a25497b0fbde288724273b3f5daf176b8213039700a1b4d57174d8d95324965235e19f54b92ad63ba4411af93ffb035e74d0731f7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c8d3959a36037d38782409c24a1e361
SHA18713eae6d6b74825a17ee86929df2d24884dea03
SHA256a70d5da220cc5fbbd7182c74fe15827ee47559cd4758dda4d192e53c195e1eea
SHA51245faf4143e5812f2809e6f1bfc5a2aa43e645282be63b5015e700c7f74224cfe41b9958dc1ff96d1ae3fc6ccde23b7e1350a36a65cf33705c39cd860a6ef2aac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50538d57601bd0993573a97d295f89b62
SHA110364347fd5447c8f495a11bdeccc6040a6f2f1f
SHA2567745263d3b00b24a3f05dc3adfefa492e1760634f28435444a2c56a507375cf6
SHA512838133690ec82ead403f7c803304d0384c8139ba584fdaf97ece29b5744b506bd3f18b4f3538a436c7f84de1110028badc1e1a7db2ada5a6cf782d1d4a23ee58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56362ed7c85fe9f226c7bb1495fc39d38
SHA191b54bc834934e304c9fc3c363e2df11cb0d94b0
SHA256791e1a0fa3f92a980a6db7ed8787fa0bb9c8d593e420eb74a54a5d7b541c2901
SHA512aa7ca0ed1ce4d86a6bf942f88c7d3891b16ca3e379499644b078d327d851c8e29616bab2d5697ad5e3923a0a5993002aa667e95a5c23e56893fbfdf4bdfaa5a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a497c374fdd7c4bbb1d7ce49752180c
SHA1b5bd7d6584426bf0084e265066ae15b8192fcfc4
SHA25690e819bac062830c5417439fb7c5a9fa62354f2c5551f7a0ca0fa686cdec0c49
SHA5120ae59cef8bb38bcb418dbd480e980f7b4b8bfbf63afc658c8268a92a3d3f834466e0656c3c1e6607403649e8868cb57af6768d1e0049f30e9ccf7da079d9a314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548c9bca9d04b670ded0f23dbd23db152
SHA1d073e7d2f296d68c1e68c48a3252b37b946c1c9d
SHA2566bdd6e9e72994690de79145b3846c9acb5db2f9694b0945afe5ec22c745a3fba
SHA51288277454c29016d39e9dcbe165d4a187bd36aa9149e7fba11ce3854e94187222e904fa7e918d33d913043cfeea4155577b65d9c88af12415bfa83ee2c544321b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06