Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 21:40
Static task
static1
Behavioral task
behavioral1
Sample
1360b437845b52f03341b33a047387f1.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1360b437845b52f03341b33a047387f1.html
Resource
win10v2004-20231215-en
General
-
Target
1360b437845b52f03341b33a047387f1.html
-
Size
128KB
-
MD5
1360b437845b52f03341b33a047387f1
-
SHA1
2036e4d553a745737abca9f674d5bcd91da64d63
-
SHA256
411cdea5393c5108a52b36528335e0e1dc631301a96e70419c8b1e4848ccee03
-
SHA512
7fe20f74c6ebcfece256bed58dbc19b9d25abcc20f0357e8d930f63c1c8ebdc3d0df6a45e834a800f8555cf85a4ba915e12ea5e71c4e781abcfc0b64cc38d9f9
-
SSDEEP
1536:SGHUt/tjk7dh+hox58SNxb33mLL5vj9dpu8NvEjhLfYxOKytfLZ8lKINOgWoejXO:SG0rMR4vBeqYgyTbRAL
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007ac704126a2fac98533c1a9e4a3ea87db1be86ab09d9b93451a45f2d58ee72aa000000000e80000000020000200000003be5d4c649fc0b1f287dc1109fd21cd909926bad76cb61771577d0360613b8fb200000007a7732fb95f3aafb970cb25df15e3b2ca4738fa60c4c5a9ea1f2112ce4b7743940000000caa5859981339541c2aa83bea74f891ff54254a522520a72afc98eb4ca716716a7e2fab207fc184f4ac671796567aa7785b75650a269985020b1027d0edef536 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e2e6c4ad4b62207755fb17cf9a9a8b207071f145046ef9798b791a4adfce6b3a000000000e8000000002000020000000b0c1dec805ba517c627e070857c87a07829595cfc18fd2c591a2a4c7f19d3184900000001e93b2128031d4b3fbde9b0a7a9f4dc122f456290923cbef916df21c119e25d898f3ccedf40613f7966c8fdb9840329f97758835b989133431666f4c61a297abbcf26e2eb80ba90301c852bed351fbf2cc3caebb8f217d17c9d35e2f79b1abe35013775daa7a0a728f59a40821b49e52ba82fb7c5ce96298fd0454e086a5c72063715ace6e7d0da5a2bf40cc88624c7f4000000002318aee2bbd2ef1aa0a5e7819d9b1a6335defd5c73123c98ab046ceddad63be88aa2df2c4d7ea0583b12d48036a5a31c7412fac719d06a406f680c16319590a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409635292" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05f1d13df36da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{322DF2C1-A2D2-11EE-A581-D2016227024C} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2328 1936 iexplore.exe 28 PID 1936 wrote to memory of 2328 1936 iexplore.exe 28 PID 1936 wrote to memory of 2328 1936 iexplore.exe 28 PID 1936 wrote to memory of 2328 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1360b437845b52f03341b33a047387f1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7cdd2f8f1675d3d31478247eff2eb4c
SHA1811f26d70c5de2360e448dafcaef4ab684c102cd
SHA256233c4972c911b30702dc103443c5c20a6f3de84c14e9e37287fc263244f5895a
SHA5121fb5d67c5575ecac0e01190f6afd2cfeffb9961980332279a35a49918e85464e45872118218bf5a5adf80499d33175d3e87e20c8e8ca0737a7b99d65e5da8edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5374f07425cc626ebe29ec2a59e07e0e3
SHA18fb6cf886765eed7f3ebd739c0d973b901f88cc6
SHA256c38e7d335a2e8480723a03cc1ac3c30d4220c8b252017d76b685da89f7c23db5
SHA51208f5073d5dd591b58e3834223f8e4f6e72f8e82129af2975fcc86a297c16a76669a3ae432a4cf468935b4c72332fba44a9e14d1c3f4ad492e5a1ea6cf3c5c41c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b227be2c1f69ab4c06a40218d9842ae6
SHA19aaebe90d492b72a603d1a144b2014c09c47df43
SHA25600029549324b4b75313409c6b2def617f3dc92fd2e1a232eaab68d90ea00a57c
SHA5129bff5342b0d1b9d692385e0f20ff7197a5a1cb7eb65ae8619d7a2536d5d970d402352c7dd260b26e74772d5cdba4b91b79b9682447126d0ee1a090f0db908788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5615e95027b347c8be087204e41c8278e
SHA13986ad1dc74fc07b789ceaf521e6bcaec90eac55
SHA256a4d8c54d3f4fffdfd4639aa90b24786b33bb91d0d24a2025f9e863b7baaef20c
SHA512a38c33315a979ced73567b353235615539c8032716f91f680c9109bc875d1acdc3adcfe509b1060ae30c022bbaf3e0dab3a5d96c70b3880e0fdb03844abe3e27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597cee3d6fdb244906dc2d20342a3fc00
SHA18446249020e56bfb20da42b88bf65edb02112864
SHA2565690b20d00f66ec532287d822474632ae4bd83004c71afb1dc9c58268b2a0359
SHA512f62964c270ecad4b04f2d234675cd4a33ee2d329ed30340e37c7b926a05917cc1285ad3d5e9599d5d0da45840cbe573a6eb59cb4c1aed3c43701063d2c3134d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5a3d2dee2bbd2cbaa0c484ddb38d6fa
SHA150fcf79bb3d046a327b412aca2aa178490812889
SHA256b9934d3dd459b82006cba93c44353f70a508d0b74d09c4a2596d2165df90f150
SHA51233ec81105fb53c0a555b53ec86933a844ee0c1bdcc54387fd48f330e8b5004bdaabcd7bb18358643aea59845779d65c9b31a36c1856d8cda6bec5a379af73622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3368bd6013cce3d380cca7f217fd461
SHA1eca9d7ba3c040b258d97907505f4a6ca21e57f91
SHA256eb9d03a9a3f5ce03741688920c84735169b0cee58d4cf80df140df7c0239e667
SHA512979ba8c48335d8bf14f9eb9b587d7c972e625084f4057551940620ad4bd8219e18a2093f5272c161c8c7516a6802c868d204999af3da9847630b479b1b53a647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7a14c3f23c9ba4d744baaaefe608691
SHA14042e54f1ca30f676f5bd8ac924e020da1c23bd1
SHA2567aef343d04f472d0da27d55fd140c89a860fd43772e089aa7b0979c037603681
SHA5127174f9501e5769710821550898fdb82bed914d40e69f1399dce830ce56171ab1e49bc36f2a09df8a362728afa2d4dba9f4858c9ce4724121bb71527ca498b084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0ac557e435cec92bf7048a45bec2f69
SHA1fb24ecfcf47bd2ba1674a284740d080e47c70a0b
SHA256b9db9d49ebd25b5c83eb2c7248a60726ba190aebeb946fb3a9fd62f7e55bf0f5
SHA512cd9e99effd7798980b410668609bc28517a96f0bce4ca8f3cc1ecf177d92d9f1258b5fc60ad759a646a5216d84264615dc1abe106e9911f7583df8538b38021b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eb66df71d7041d75045b0b0d39c35fc
SHA143937d75ac7f8722d6538efd73d26db87b4d116d
SHA2564896c6cbbec0070ba3c781ee01d9faf9f2fd99db4751ddc40a4af1349995aaa4
SHA51270bb564d5fa267c8271e59091a22661dea78cc6f9ab0edda4d24115d480172f1b8d5c7c3ae516c9f76fec0a3a9653cb39d2dcd4f0cb5201e9998eb83a850f925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d7ab948e9c160c6b3b5005dd81fa8da
SHA146b5fbc55e6500f4b15e78e19e0ccbbde2528927
SHA2565e63815fa5f6d657ea9c51afe1c7fb15a0cd317f8f2bf0f896ac16f3ba0f2eed
SHA51296327c1b1c7c6272462aa645946d3f81ff7f6c1acf1b373e8d2e3b8c7088de336eed18a5f176bd6a0731e691499081ae18a015ffaaf54d525e35019247b76b51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebd2ae70688b8f9d465fa96717e69092
SHA18acd5631f2361651598c6e33f42c1e458e8d7a4f
SHA2564b851f4f77518d079796119eb8d7c817a6dfefe7c0452dc2e971844990de5b5b
SHA512b54cf41291f585ac36780f426bdaec294813f1c47cd70eecf91468b18d233f37ec0e659b098b325ce7dafc719a20217cbd6b2c3118a9b88eeb9d5f9517d5a2bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0ed6e9952672a13b3f1d6f29e3020a7
SHA14416aa65c3e9d3f1a326e29f4e884d08f138d068
SHA25650a63b76297b9d020b5bebaf0f879c69cd923f5f17087ceea24f3c9435e565a6
SHA5128241ac9b4b62360f1d7f6d697c94d20f5899fdfbef213ae036d9a613c4334fbb5ca170ef1c426f227a97ebcde9eccde7fa89240f8fcd154ad2d3408d9a8c1575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af59a8521ee9230b4e79a9278da65cda
SHA10b131f8f2a7765f1c84a2923a954a364fce24be1
SHA256cc57201d057ae05fd60ef4eb4b6ee83caf371bc1b46a4af7fb2db180a1447d03
SHA512bfa1a486ecca464f3aa40af33f07cee7b147cc81ce8212e9ee75d9bcd8de5f7aa39e131e9a0e0ed56bf5491830e0891bb8d513288565b3509e401aa38d62f135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55629e2908f2f5775d0ef2202fc437a2c
SHA1a45ebeff2c97436917a8d337d6671c9295bc8c13
SHA25646217b9033a485c4b3c483bbabdb03aeee0184f0acd823e5e1173b0434b50511
SHA512e6aa1f4001d0180f6c37152cb88d5ade64d3f4359e4220a605856ed65bedea57511ae1d351afe55cf887560310f1661b09b05ac1152d45dd871a200aa25936cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5890fb0c180571e88cd4245d8f8ed01c4
SHA1ac160ecace84979f35f3d187f3d23b06ca36d846
SHA256a6cb10dfad6bc2ec73c1fb8dfc116f90cc0443d165807509fabffd1b568192cb
SHA51275df954e64457cb847daf54a0f0ade114463dd928090d99c172f1e44529050e21c96ff3583664e85f4a78e48cef5e3c4a31d60e64788d2a19508689d63b6c298
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTTGCPI6\ebook[2].htm
Filesize42KB
MD5c75568c14f73226552e2e74522b526ea
SHA15e90aff8d614bb79512ed648987656ad7505c7c8
SHA25633c6f046ad74975c4ed2bdc1962e7bd05bdad1918564b8caa8cde6cdd59d0e76
SHA51204f2f0c05c12d8703e6eadc63916411f9aab2e7c477a2bfcbd140397698900604cf02eefb38efbb765afa91bd6af88fa5c22b05f8cab88adab1b2a959453eaa1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06