Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
0506e640ec7ea2ff0bf0c9cc3a0b0190.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0506e640ec7ea2ff0bf0c9cc3a0b0190.html
Resource
win10v2004-20231215-en
General
-
Target
0506e640ec7ea2ff0bf0c9cc3a0b0190.html
-
Size
36KB
-
MD5
0506e640ec7ea2ff0bf0c9cc3a0b0190
-
SHA1
0210af5e52256be6b41c5901081ed1b64a6b64bf
-
SHA256
676c869b2ea40bb970b3d7a8ae5bb03f7448c3d2e5726de47ff6e233501c65ab
-
SHA512
f134c3aee020ca08c202489b3821300650d1c83d6ae190df47299ed8ac8238c367698be307c26f60effba2f9430267155b58d2e78850a33a8f25e79530dade14
-
SSDEEP
768:Sg/MIQIzpRcYoFlBgsEiXDscVpl09aCFzY+:Sg/MIQIzpRcYoFlBgsEizVp8zH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409602544" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F349C441-A285-11EE-8427-464D43A133DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f73e556c6a0c86dba2817312af0f61cfda767798b3ad9c1f6e3e45a85751142a000000000e80000000020000200000000d516d889ef0e295d661a0e93f61558bcd048ed4d8c9156625f4f32cc67d0f0620000000ccf2a298d83e6940d8ef861841d55a55aab3f5aad09ee8516abcc04396d3b12540000000d4cc0a654eb43a5fc9fa7c8f94adf7c2f1a7909451b42bb0e95918b8e463624100060e73fbc871efe7c38d4bf68b8349b663cb37cb95b2e5bfdb97cf058fed51 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901747cb9236da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e300f35f8eeeef0f8391cfe3d0cd35273406f37f53a870a968f906cc290d23a5000000000e800000000200002000000020a459a4658c29db416cac43e031b864f23e9089de454395ee917768835064919000000022e6dc6ea38dd59dd187bdc6373cf1fd6d92497315ec3fd806f30a5a80e0b3f24ed509b8b66de1418a8f97927eb48564b7b056993bb032866d348d300adfa344f48b02901ebf8219fc452ac6c1f6c2f636bb3b78e7f979eb176deff30030bba4c6468d3686413dd165a176288febe7420b1e3d000fe417434a378f65315ab5af1332bac57801a5193d97d86d152219f34000000082778ad9e81a9b33ed958a4c2928e3e8dc1025f8cc24194b392c547d1bd3c1db2ace2d9cf37b9d359711a669036a534b90cb0ddf47042b65df3da0330651aef0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1976 1984 iexplore.exe 28 PID 1984 wrote to memory of 1976 1984 iexplore.exe 28 PID 1984 wrote to memory of 1976 1984 iexplore.exe 28 PID 1984 wrote to memory of 1976 1984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0506e640ec7ea2ff0bf0c9cc3a0b0190.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da2fc739ab4c7182b673e10dbedb07ab
SHA1588f77f24bf77fae5d8ba6c4c644319f78180054
SHA256ce454c86809d564ecbcb417958297b7984404db8f1fcc9d4b86f006a41c24802
SHA5125241ab876bc77d65e0693ebe2831de695711b9a3151c7fa1a0565900ce75a664a95ebb20bfe1b262e85570a669d24232826f3aa62f3038ca846c9b2b8ff198b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501dd887f59eb947162148775239ef0f6
SHA1494cd4b5f950549c2b348fa8d154c2f3776570c6
SHA256caa2cfbe6dc03bd37ca9c7cccb779d7f793c9f122e7b8c6566efb50bbc9158a4
SHA512541343975fcd00bab0e21e424cf78c48d93a3ddce0f4f57b09b2221891531f47e1cacc7679fd058261339f391ce599036927cbebc700e5e9056f4af0478c1932
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6ce24ff60341a163d327cdbb0904685
SHA1aa6c18ef73a173e314b535a2c622ed7b6f4e9669
SHA256524e8fb133ee33eea30ccb5418a30507fbeeaf3529b5a5120905920f8adcade3
SHA512ae5a4134990ffc280896f9e3aba67aff7b3a40951ea0ad6619d4bb28c8c303c77fa5311b14504cc460b4a41162fd189a513c0c5458db955a2f8e90b3ff850c5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c387d004569e98e1aa9392088aa051f9
SHA1cf23430b2140ffc4a03da153b9180480711f7479
SHA2569f97ef277014eb5f8476002371f109d91f8dbf97e2b51f5732d7200ea66d5389
SHA512cfdf14a35ac13a0bda535d9c61e1f9556eed9dcc13b61c6a04348de178722429e8c36d2e1915d59ddeade4b42a565b4f43f8e273e035a1306f1f20eb07b196e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51295b9a78dd36cbc957a42b869906bd4
SHA1ad880614742fdfa91699643fc6a3882b9bfc104b
SHA2569a7c6a1b3083c76601b8837ddfcf62059354dc9d6d0470d26a0bde7f20d5c895
SHA512b4ebe6c5e56e32e77d0392f82e4c76a0b5a7eb739af61ec7b7e4ba2555f825e6c05da15f28bca15f9f5802a058c43a03ea2f37b4b8c98b2715ef285f4b69e06a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a8270417825e13823d1a5cf7aaa0ff8
SHA16fff6a3ff678be7060ecbb4ebff7192429ad3c63
SHA2562a914988a579b5fc61583e871ba8288559c56ae0f91f71c33ac286a9f836041f
SHA512aef4a42e1298c4a8a55c74924e524e5bfea08abb908b33958d28ec4e876155a76595a492803ea034f6316f9e42c25979837f0e819b71d2731195b36e7b684968
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a321c5a9008c68281a407d088715cb8
SHA18bfdcf481cacf622890a360273a1d1dedb6b7601
SHA25639e3eede8cbe31407b361a15ee94e46ab5878e5b743b18b5c52d199979f287e9
SHA5123a312d94681003f721a62ba87213455b8e86ebff966522bd8a9fd4b29562017a7f722cb9b094abf6b2dbba39caa353433d05b1974560481e7919605c53d0d4e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5056db462d8b428d8de0df9eaeb26e294
SHA1cce9dfaeca5ff9cbd102abee6e189fb18fabbbb8
SHA256cb880eb7ffe52de5e7b92bdb9ad199f547302f20fb01d7620b8d132dd03e9ba5
SHA512c8af5b9092e76e3fafbe7982aa218edd158905772fa901c6dc6496851c317966623cbd2ece9328ca3be567a9d0c087ad68573eee83d2eb6aa335c5852226b5cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56197a21bfb4cf2744ed2b916f32eec91
SHA162124ee704cc5c77fbfe33ed00100b88d2e52a55
SHA256307879c6251622f68980e1b38378e1d4ae603ad81de11b0f469cff2acae44523
SHA5129d0ef8dc0c56f07328f55c1d3c37e6b177023e75da6c4c1b49df748548e9082eb929bd1db5f9300da8faf1c1f8fe4cb555001c1f847581b80a4c5989c83f6fd0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\f[1].txt
Filesize34KB
MD5d854bbb2246d993bd1f8687e79493f60
SHA128fbae93bc5e4e99a6c905fdda488be72057c307
SHA256707248d75606cc53aad966797dc2cc86997d1ea1a74b1c99b9191716600c74e3
SHA512ba4e7ef0a590c84310fb36ea64202cf821058eb7bd52ada1cc9fefff544b7500bf54a8ee43ce80b6cf8989071b0deaf2bf9a50c8063c192f24063f318585c3f2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06