Analysis
-
max time kernel
119s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 17:19
Static task
static1
Behavioral task
behavioral1
Sample
fe78078e1cc2c8f8088b100497d6c7ef.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fe78078e1cc2c8f8088b100497d6c7ef.html
Resource
win10v2004-20231215-en
General
-
Target
fe78078e1cc2c8f8088b100497d6c7ef.html
-
Size
601B
-
MD5
fe78078e1cc2c8f8088b100497d6c7ef
-
SHA1
69fc6af1cd636a3423a517c14d28ec7e906d5204
-
SHA256
e350e59c4306e13c3f915d96de08c126c8d2be686ff5a578eb6dd72f5024ed2d
-
SHA512
0d93b669317e4fc94b8a74d0399eb0d7c918ac0886c70ceca4dc154ef5684daf47b6161c75a04dd58a208bdfb75c9d1c394debdf8dcb84a8f92612e8ea13cd94
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71906041-A121-11EE-A1FE-F6BE0C79E4FA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000003d1c94788e1b244141acd68a9df0993f59f22830a77d244356e00089c09fe34000000000e800000000200002000000079aa1f6ff2915b9015c91c4dbfcfe28950bc97e60af02394e65420b7c6273d589000000034edfb45155268b4abe2a7755f2ef9ab9ec598c3ad5a6e355c13d6419229c1bf72260496f8e9eba5f66c14c39947e949271795755e6b82ad07793b3f1c0c2f97a9d9dff2129342f45dff0f1952307a85d707fe3d52f7d3fa93c77fce89cbd6f9c371641ecd8c856e8cbf8dedfc1bf2a81c4bc6be0256343896515519b54d8aae629b8e8b7e0c1b99aeb15477d18b729840000000521781987616ea49f1aec6149d2b286f9f2b47e28a1c9e14bc6a0211c91c212cf4a1d16f47a2cb7f0b464021da41cef9253cf80d502f88d42cd787c264d7f701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409449423" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000002ee2e8a2d6f4d0ece7da7a82a53135f542098d65ee5643a3cc13aefbe8588b45000000000e80000000020000200000008c3e67272db4b0f45d7750672c15dd4609f90bd3336f828af7a0db2d9800d52d20000000c8a3ce51725ea1e5fe2d64f8d7c75211819ca1acb3b2ffe500adb71ba963822c400000009340e8ebe15f71afe3ffdc40e07e8f417eec407c578d5f54064e9943eef3f2d51061ed97cbb9072aeaf521a669316f8f463ba580d1cfbb6e0422394abe767ea5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e037c0382e35da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 iexplore.exe 1708 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2368 1708 iexplore.exe 21 PID 1708 wrote to memory of 2368 1708 iexplore.exe 21 PID 1708 wrote to memory of 2368 1708 iexplore.exe 21 PID 1708 wrote to memory of 2368 1708 iexplore.exe 21
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe78078e1cc2c8f8088b100497d6c7ef.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1d959e34a925820b08f6df672eae79f
SHA18dc7579c45675d53ac6846d55bca4b773309e218
SHA256c8b58e3aef1a5b6faabdf667007a9fbe1473e7e46abe665c5f98aaace44b2dc8
SHA51230b405444e74ab883f74148cbf1642774826191fe7395600e6eb2075bd26012ccb0f9bb320811040b9b14afd149f309aa08379f7c5c695c18aecbf25c6855b5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5952cbd882caf6d01d062a98cb8c2d0c5
SHA1e9f1b0e104e090af78bfc78b73e3cff397565296
SHA2568aad762640140e65ff8583559fb498e66666726e7f7d2e052b4827cf6e7e279d
SHA512ec7ebb646c7d1610355057d9e2e6fc787073b4d2e0ddf6ae1f96e8300aa3474eea21cbd3ca2d4a36f17728da9bdb11eb9d0fe0a680a7afec1403db86aaf18f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d74360a60d1f3def417bc7193671c3
SHA11c8579c69ff8199ec8c88415c0f0693a5e223f8d
SHA2568cc83b892d7b8d315c7b1d713f6ecf72ba413936839aed3f3cc3e60e491daae5
SHA512cd6cd11a2d17715343b425bd7401b2350594ca6ccde82340f3c8480508667f4f2a7922bd0c34c421691e7fa6f46ea99de087c51ea1010a4f653a91c88c57a394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fb5c910d849f5fd64cff785a1a2a956
SHA1a95b0bb08fc7c1c698fdb57c3a56dc61c3c9aaea
SHA256ecf7777daf6df7bea26a4446219ea39fbc9b1d8b9a8fa9ae7f12580af0858a95
SHA51256fcf8f9906cb98dc5c82d843853cdb4fd1cd3054268f3585f25e1e29631d73283288d1dec13174d12817066e17f514f79267113a1e46ba9a5e6c958d536ed4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bec9c752d2df9d2b7e54bf78a30034c
SHA12e89798373cff5edbc3b397d64f97d5f3b8a15cd
SHA2562dccaac88013c26aba59df623ab504b2c6dcacc4e67a53c11e5a32bad5a7b1f5
SHA512619b4c32c2e3d64db31e1280487e2bfaad8a3a1c259c755b9f49bf51dbfe59237d84f216b5d95925646728402a611ffc9d79d19aeb15dfda12d590695304cd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550c46b6da8b036e1b9c6359e03c9f8ad
SHA1f12fa055d0928737ae56aa3c55bbcbc87d918aa1
SHA256d4e77674774a08658b85a1f8ce35e5abc88e521afde3d3454e60a4c054af3cfb
SHA512886cacb19301dc42da858d03605f9183164f993afb8b068767d4aede6e514523bb0eef5638198c0881430968b6ee919aa9d8c2cfdd18098470a4c3d0d0b893d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53625b2006b86a42dff1c91528eb004f1
SHA1ebbfb5276e50fc481992bea1c6f710a72bce362d
SHA256f5f2f63ff37416cdc29102d519dfed0633a437a68fd3220a0aa1ff3d8b9aebb3
SHA512829c44e78dca8a4364a92c58572fec4b6857989e64571c85640b168cf7c0f99ca458789056f6fd7d24df929dea62e565ecdec274b2ed2ad0cd32477dba693eca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef725b7fe72c91e11091648a93a4ee6f
SHA1bdc301232504ff2a06583a698c80aa5a9a790bb8
SHA256df5a7de221d42ca9e104134f8100d2cc3cd6c7e722fca5227a24ab0195da98e7
SHA512451ee3e7d9820e8fc3020972611a9af9a41e4afd638569de334f94002908c004b2f3b8517554cb74d720e997ddffd93f782266808c3337373f5d12df2de07a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e254c668fd17938399d2f2e33b1d2cab
SHA198b1b751c916b7318a200a5735f848d985e6a1bc
SHA256d76216d058070c72bc5d0bbb9d9cc6db544f415a3040d6d4c7aee6fca9fba63f
SHA51228a1b208f9a486dbeef967eeaa9a4432ff41b7be058525d4b4aec4de0085a936cfa585127c041cee835d2f1da4994aaf38fb86d5a949aa62ebd2d14f0dc059d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593dbd8e76a99a25e2fd84c6f4ffe4db4
SHA1b95c96e3ac36896c1c3bb03c8aee050c34cc5996
SHA256734cad1dc107d061c8bffbbfe1b30612a5a5ed82b5ccf8dfce69342b03756806
SHA5123dfc94b24cd289cc8486b36bd89ac8f1c5ddc95887e58c45a2136a810e372f730e2e63c72d5cbc29e353ccb2bc090c22a851912f8866032bf0f0da7ae87b7f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9ef125354306853d01af8c5bf36bb4e
SHA16c0251a1479e9b6934240945a55df5c21cfeb5d0
SHA256fff4fc3e7bfcc21e52877a0fd6522304a6fa8c3cfb358083718244efccf51160
SHA5122760adb1d4b04efa9f84c224265484d20212bc1221234224780f6c0a53186906e9e1ad2cf7f5c7a5a19149663d52ba6b6f7e631df3574cded4669db3de988587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e025e9a3bfec1780df936b76bf418f91
SHA1f7d31c5ddfc733300120eaecc920dbdb0dad976a
SHA256361a39be7e6e228601f0b4711db7bbc12088a8f851dd3ee96746219c6a984b68
SHA512c028a5c4989ed0969ecf640ea83496debea117faae041e5f2d26adb9807582497a0a7f19139fb35febcc10856171544f6f60bd8afe7ff9220dba31fe653db813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52129d772b674bf9261f659d02a35e69c
SHA1cbcf09034fededcdb979324abbe7fc5adb119ddc
SHA256dda9036b44d153db7a29c66ce741daf132df6e01c41439bfff86a4f2d4f579b4
SHA512a5d8d63a2537f1ba1a08fe1c7b172b1af5736fb145d997bd267ca690a3a92fe033e0396efd68ccb793f9168e2f732228e323f12325840c35ee4834a94d8fbecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c61efea45b1903930276c487ed58fd7f
SHA14af83983afa94f1286326ca78fa41ae8e3732075
SHA2563a3ee2369d67b607f958eab0aec885e0592225cfcf69f55fd7baa0bccddefb90
SHA512a5d0c981cc40d489a0857c7931c387878c0df044c6206c6e59ce1863e58341aa29ca306506758eb671d0c20c12040c00c1e0932a7df10fd19a080547ce7de5a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bbdc069a8a61fd787445733e5a8e5d7
SHA1195e6e85265076ece037b40cd93555d336ea40ab
SHA256dde5afdad38277e9bb0b2acbffc6ac9db2c632b48a677fb6ba0e5e74edc28ec8
SHA51291b5d4ffd964ccdd4813764b48ab2a32ccf9604a96670d565ed044bfb2597b26126652f52090010c01118d66bcd6ba18d28cf5998d4d9dc4ea52690bae90dad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c214e7bfc62ea2181b96f074f0c955c5
SHA12e4ecf69c3779363dca7ef823ed5b3d732838b53
SHA256d0771194a3adbdc432c40ce30717af0352126468db43af2ff50ad80842c30eb8
SHA512dc2df0a42a1c9f43a1584a68d4f87672526c7eb1b99693f59ccbe100236d69f5525d7657bf7ff1a39fa8a814a68d7e528803226a8c55b24cc0fd47a1568ed1b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3b62bb06fcf4757d91f8a62f359de32
SHA1e4a0ac0e6963502197d1f5f69c69723597836029
SHA256e5857b8638ff8858f9eb3a848139fee6cd19822bededa5f1850921548fa9b692
SHA5127cb25f800683c6f39c899d4a34863df16485bad6a40383071e554e9fa3dd46a4bf83368cea983758f2c0e60b450c891ad45630e57458779c320a97b4d58b9022
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a08bdaa2466d2aa25740c4d79b98f845
SHA199b28927f1dc2762d7ed8e2e974f4a08ba9f6ee2
SHA2568de3cbdbad4e6222353a98d91ccdcf9ed67a2a629d91e021668b0d1e6ce648cc
SHA5124380450bbfed2bb09bdc7ed2d3f530e04829fac5233853672372de44f45ec271e5fbf8e942d56d85032b71efd5765b67f10580e6edf2fc8b672f2d1667348c41
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD525637d58191896548a30f80c0034b0ec
SHA12ec91c1ee4a7fb6c93bc151b66bafcdc50e4d989
SHA256dfaf181a0dbfa93c2e7cb18f7e014e7a95013c6140549e70f8fcdf9b88f82fc5
SHA5129401da17799062d10ee0f248930f141b09ea33a040f9cca0bbb426c8e8020e144b9d75c6df93df7b10461ebfb8f09399be520fab7cb71d09dc652dd13fa5e51f