Analysis
-
max time kernel
142s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
055d526d9a7298e5271d082801110ce0.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
055d526d9a7298e5271d082801110ce0.html
Resource
win10v2004-20231215-en
General
-
Target
055d526d9a7298e5271d082801110ce0.html
-
Size
2KB
-
MD5
055d526d9a7298e5271d082801110ce0
-
SHA1
d8ea33265f319c01150d6e97aded7fb7f1a41315
-
SHA256
ec1d6360e4bf2028b0242ec616625d7ed8d5fa845f15c21d02d9f33e71bb193b
-
SHA512
5a8f202161c5b3403a9c394668da5ba3006c4345c5c1b7184c9cd7b236a3a69deeca1f4f15d12ce6db17040286f6a39ccd914fc8d83f093f835b6fcc37b3ec38
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{440A0F51-A288-11EE-B665-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000009fcec26bab5ec7989bae0e19df8eaa1ac9a5469632e7615967788c8c4c58668d000000000e80000000020000200000002c098040dc583587f3bcfe858841451aa264c2de9711b03f5de2d8377a5bdb3a20000000b999fbbbd2d63281df473cf25036781ce3258877ec02ef51d5bc7eb64311109a400000001a3955eb6c4d589f0739c1be7d398312645941a075bbea681372b6ccd279335e4ac1d9aadee12deb6b44ea44c2446b0286477a5e16ebe3327b67d851d40fc550 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409603537" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1023e9189536da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006765ecdca87c4c53274af06948b9261204bcf904e27d57b7433cd2ef92be3709000000000e8000000002000020000000945e78cb58609dcc166578fc180045f92b880865a20ca56aeb1e9d843b3c1d1b900000006e469dabcaee26ca44022e3a3b0915c4351054b071550e55ec57f20ee1fc96548c893977dfd832fdc7da77e94a3fde0784ffdfdc8c7357a21777b688f7a69b848d612091791881486583f6d2e5e3296436def421c4be3035f6370b473cb37f4a50c2597509064f5ec819ea2e6062d59a7e9ae0b2f9e0b0d7b1ea5d51283ef539de95e6cd9b3cb07dee9b213d232fd08f40000000f89d5201cac15ff3e0b9124c03dbd0327b3c87ffcf6f869edcf74cdceec2393eab0cd2778499c546fea7bf71fc063cc57458c480b12f07d40c6c6146fceedf36 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1664 iexplore.exe 1664 iexplore.exe 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2120 1664 iexplore.exe 28 PID 1664 wrote to memory of 2120 1664 iexplore.exe 28 PID 1664 wrote to memory of 2120 1664 iexplore.exe 28 PID 1664 wrote to memory of 2120 1664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\055d526d9a7298e5271d082801110ce0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bdb3796016b52e57ddef0f606ae6803
SHA15d6cbe2a797585b91f367d57e609f6058ace66ec
SHA256133e76ee8ef0d4f822441484372b894336c3c682dadffc3639992ad589d00bfc
SHA5120a11843923a7e53ed4798dcd265822117ba01dee4975ee30b99751018656174f78f279696f7da08b294f2682d1cd6d7da9b52698640ba6a92d787b9156996ebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c11ee0054001d85f52bdbcdaef27905
SHA10d80ac9e32a0f1e0a036d9b2c948e302b7882656
SHA2565f36e49bf7222821ada17f752a5549d74a37c20a1d5831486dd042f8c447e416
SHA512a8f7523b31dbcf1adeac2f9b7b9c596332ffc6fe2d4682c64d44494768441776c7361d498dfb967e4f2d46f0496ee19b50ab6f9a6325d9057a21b0a5b2eb1444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b0712dcd9321d09679ae6c9208ac6f2
SHA16705e70a3ed1ffd173ccd25312f247be5757213e
SHA256c1ff623418f6270eac5512c88d4e915af87a822662cb923c426b8bf30c455936
SHA512c957d76eaf2b2ac4e29e0305eec774c47fc67703b10872336581252359580c9d84c562ad15fe71e761fcbe9d06f9223f4346e82560922041070146ce077b3c84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549bb5f6d5c486ee71615e4950dc48ba6
SHA11935bc067c721881da87dc980a7b857d1cc653eb
SHA25666e624ceaaa6c9bced50642ff8623df9acb6836d6daca25643ec1b541063de93
SHA512502219ec644af426175e2db967000783cea5a47f10edf6691953652318be7813f29f7555afbe8774c5e5b68202b0b3b8d593adfe6c2c34eacffb2784dfbdb5d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55250667f2355eb620557c6a79079ff47
SHA12bcba76ecde6eec9826cbfa4e7d0ede9649b5c79
SHA25655089b062bdeaffc9ac317b642b00aa1024bc844b7ad6144a940070c9da05676
SHA512d64016492e00b702aadb330614dd7b9b4cac18bbec070dc0ce18b23614e47196fcd674ab13faec5213c2d3d6d8fde41860528de34d86722336b18ab85cfd588a
-
Filesize
1KB
MD51f1a3b101012e27df35286ed1cf74aa6
SHA146f36d1c9715589e45558bd53b721e8f7f52a888
SHA2567f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c
SHA512d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3
-
Filesize
30KB
MD5622775d756f43008787c80f07a1b2ee9
SHA12245d8ffc942443d715055bc799c1879bfefd1a1
SHA256c66fd76a5c221080a5397d05ac862e295cddda1b7565972990d0567a6dbbe60b
SHA51286742e8d35a9689a46bfc9eafeda3ecedc1431994959ec037f1a68c452fb7f26d1a721ca45b3061f25ddb6105544f28ce5c13276a4ee6e1a4d43161bb5f6e33a