Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
fb9b938af11cf7e73033af4c117d699a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fb9b938af11cf7e73033af4c117d699a.html
Resource
win10v2004-20231215-en
General
-
Target
fb9b938af11cf7e73033af4c117d699a.html
-
Size
2KB
-
MD5
fb9b938af11cf7e73033af4c117d699a
-
SHA1
a029da2867aeef980a11c40d1e94fc48cfa539e5
-
SHA256
5816135676eb23e7fae7b211d00a4653612f7e12c26c8d86f8e98c8fbea2b461
-
SHA512
8d18cf16b9c7f7c7b62c4220d3d84509ed322b5769d11566960f37d8492f8607c11c13f3349c39eaba4de2de2d01a92f7838320154e8659a1e9aa76e4cd948d4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f9a9a12f116f3e986903abe30f26e153be5706e9bcc47c3eaf26ed598a6615b6000000000e80000000020000200000000864150d3e519d9ec6490b569df6e75886cc3f808fc3fe779067fd99c939bec22000000061de2b5a9379e7b07b048056f48e75390ccc554cf757fb74c7291659a29e8ac64000000045bad86bf61c036d2b174f621d58248ed0b8abef39adc6beed4c0a22b2a336b6f1137cc6a2d1206bd072cc2171526875d1b4480267d37efb68bf83885735b5f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009d392182040a57d05370d49b97bc005781fc77efe404f4e5d1fee5ad4833e763000000000e8000000002000020000000aeeebd89a3877d49e52dec2ddce8f03748f4c22e504553b35c3dd536b01b02cb90000000b4675df70a001c7f8fdb8444006fd08966720d8ebf7a4bd3f71a57047b1bbca164250bc3674ea658712857bfd5ab7823fad3514bd6309e29a53d2c65e6f51411a22deae57e1b7578072324fa2f2e9d427091f0a1f9a46fe13b53b8fe5ec54af22dbab0d4bfefe13757aedb67ce3886898a24e0fcbc96831f9e8b8fbe8c68ead0b87bfe421d5fc9d1d2ee412546b63f7140000000951c47dc1580c8b7222779d64bd0b52eb216124d5823fc71a08cb78973a59e4d3295bbc5caa6ef9655bb5811ac927cc015a447c12311c53094ed339c6a399b9f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A8FF8A1-A11F-11EE-91A3-4AE60EE50717} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02f7a0f2c35da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409448468" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2080 1704 iexplore.exe 15 PID 1704 wrote to memory of 2080 1704 iexplore.exe 15 PID 1704 wrote to memory of 2080 1704 iexplore.exe 15 PID 1704 wrote to memory of 2080 1704 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb9b938af11cf7e73033af4c117d699a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554d0b9495f5b0c37d5bcc4e2bb965d5b
SHA1f57e6171fac172778b704c57b1de15722a4b8c64
SHA2566d89d148a21de11c8cc994503bee9b68b3a3246f69e80845c5254b829feff80c
SHA512337cd624ff6dc5cdba88db2c94d8951052d5b9432152565450f4338c028bc03f9868b3d8323d4e2308763ece1724cbce13a1380857ccc50f7547c4e200b2d2d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e68f7003431acff865124c792e2d40b
SHA17a240edaccb8b0a66082ef7e7c64790fb3ae8288
SHA25652e29ac989e0e884e79d7906c9c9ac023a96adaf37fc51a20d8ee7bb1f17c8c4
SHA51276cbabcc56d6c2eef3b3762da07630af45766314fe3c5096e24b786cc863d1ccd98c4d751e779a8f861963678b2b602b53804a9911c1714978e2b6c78774baa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abf65f244a719e296706f0384eefe1d6
SHA193c334191a207aad42dcd3d23b5025c8d04d1d83
SHA256ab10d6d19c3dcd5e85540a1e81c9b0cf4cd869d71dc1404f139ef98e718fe550
SHA5120806d172fef990bb0e594be517f7477713567961423edcf1c5012632d93585125127c532c978edae9ae70b88bde602676ae836f459612694af00741c10663487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f603119a442e91521a026d79e481ab9
SHA19c639335023628dcb64469e1c68f7b1d1c17f00f
SHA256d8c00e2bb05c77f0b2d54c5560571c5b508fd583ac45ccb975a990225d1d7b2d
SHA512ee07475f2806852f6a707f45c6442f4a234567eb9952ce115cafbc079e2dc968429b4dd9ed4d6d740e661c4428cc27a67db9354a98cd65414afe66f3736f89d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b321fe8e84aa94549a1062dfa62df6
SHA11e9e3c8455e0602aee7a7275422ea4d892774775
SHA256a525e5f3bcc01385c460415cd1574d81cb618fba4ffa69c31e251a5969b9a38e
SHA512a7aadf87fdba7be6ce1fd33812c54195e50e15dc4cb13bb5d31d48ab760630ee736eeefea81fb693845b50005947465f8436446aa60f268bb098d2f26f4a0cf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e9c342e5518fbe799bbdf62a83103cf
SHA16b7846e7ce23d20db3e719781ed54ee068e38ac5
SHA256d8bca1d96f0047881dae51d49adbc58106fb4114a8904444e356ad899ff387a9
SHA512b3a0e4d26dd5ad04231f04834c6c3c55d8ef976d3504e7c79ded4b582db2cad672e340b77502a846a0b4ca2c9a23a5848a2db421d1ba7cb1c50be9a5a6466c6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d06fa21d08323a7919537971dbe82298
SHA164880335227819d4004fb79bc130242cac7514dd
SHA256219aa5b1744ad115f30c052377f8fc8cf89215c2544156e71c8b7196bf4556c3
SHA51290b5de1a4153bbc3997b2533668155a7b963b076fddddcb0eefd5e3e492bee20f0b532f988e1f74bacefad0a5574609e76b939cd9723d023b3fdf3369facd09c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a07d3cab93588a34e04cf71b605535d8
SHA151687bef283df5afaf457fc1c788caae28c84e3d
SHA256219dc920871e732a0e121cad6542406a8d94a06ec30d330d28388a4627db8574
SHA5122d5f6ecdb3cbad34726ee047072d00f516c8a5fdcfff7481f279d85cdeebc975edf5cbf5f2d7617e696e2ab2a85be68d6785a21453592253cbac28b30ae1d684
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d6e79921dd742aa1dae32cb59c4ed4f
SHA134aeab1e3497553f7a3d17a587c58b776878f9c7
SHA256444b3b08cc2134deb625b09ec33162d2370497ad5612b8f35ac2155d1c2c4816
SHA512c809c883ab69647f9fab0ec122284fc3784c1dd9badbd9581b55b593a216b8defce0c768a270984342d247347355e1ce955ad8b7b4159ef4cbdf22fe6c046717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5739a9e520376f09ae847906e7f2af2be
SHA1b458d717d464cbeee528ed6f6055e62bc7457775
SHA256c3eff0084fc699c96222887c0f73e1a773ca15ee2e3125ad72a5203df86d9e8c
SHA5120370f7ecd705e69e84c03e5a69acf3192cb634efea0b6f586e089917314d7eb7016ad7b7708026599f49d4cd92de27dc37277b4afdded85540eae8ba3ce49a98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5196e9382cc243faca29ea7b28ad116f0
SHA127aaa0e2848167004fe1f714258928a134428578
SHA2567f03d5a8c196f5adc88b057c7a168049d2d7ea927769513bce5aa78deb40bfac
SHA512ca430629a4662143b93466cca6b3af687931b4ff81ee14918fb68db928d009dbf459ab96c5f545d5fbb3f7ff86d133c640acae33ad324ed1d7aceacfd31a9fe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5015652f6dc29dd03d65f588920c86455
SHA16d4b07d2642cda77680ef369958b15f126128efd
SHA256b9649a0d4c90ddacfe7358f0570ffd464d3cc3d35a4b7d1d9d99517f749f3ad5
SHA512530e98ecaacd7fd7a1bd5f0e3073e3a0835a5feeeca7bfaff77fd3d11cc253c28c59143fcbd3b869bb7a8a19759e93e6e91339b7bdbaa76faf79b76682ce35a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ef8a3949125d5080f77768b4082608b
SHA1374fbdd79ba166a130ddc4bc5a8a70a5d4cf3158
SHA25699bb4c0605f9a94d419b697578f2dcc4c6934e23d309c2003d92f974e037a8de
SHA5124370f261794134c3dfe505a010ff736457260b6c62a1622153c5760fcf5f59770ff00808c0a49930a854d0b8b1d0b6d7ce07d0cd02361d5ec335fc21b411b73e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cf66b9d0e50c8e2217ea1c258b17e58
SHA128a3db4b6bb92c9c45409246b8ce2f8f5bd043a5
SHA256e4f3615fb106a7581c4183ac1a38b8a2716e78cfaa200af79f0261015d63cd13
SHA51226d880db69f1f5ea804110d99008438fd6ca283a6fef63ef1be7d1000fdd3abff4eb4653a265bf6ae6f65f585eeacd9504ed29f0cf4594c809dd7fc4173c9afa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f4332471df86c4e21f6b695c215cb4b
SHA1896536b76f22ddb282f9f1aa11835043c7211ae7
SHA256bb5ff5fa10a3e5ddf86f05b969c845a40604d55e7ac55c6c45c89e9097fb3e99
SHA51255c9031536ea126e5e404403d068e5cf720eac99ffa0bf56b80e04c39d8c485ac92c8dabd7f4b154d456f949690175c24af6d6c31fd73178ffdfd68e92d99c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f14f5510f2dfcd8b444f50569d4e55d
SHA1339e6a9a968b49af99653f072668360856f0d2bf
SHA256fdd77f572e2b444a88e898469fd50cbd03128eefe8dc61638e4270919e66d589
SHA5127087d5d70db66459ede84e1046c80f1f49e07480ca33c292370de3dbf396f8d326b9dd7ef84f0424eb290396970f4e2fc78855c0efd33eb3f2c6c4529641726c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06