Analysis
-
max time kernel
152s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
08f6db992fac0c6394cab216d8a57f59.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
08f6db992fac0c6394cab216d8a57f59.html
Resource
win10v2004-20231215-en
General
-
Target
08f6db992fac0c6394cab216d8a57f59.html
-
Size
53KB
-
MD5
08f6db992fac0c6394cab216d8a57f59
-
SHA1
29f53811f25e7407cc15a2af147b7be027efda3e
-
SHA256
e57a3305017ce83fb467e233a617b0958aee8cb09d2dc71f134be0ae5b54b027
-
SHA512
671c8301bc4ce12fd8d9a4c11441b4dedd8dc2f945e7dc79478bdf22c738496af592e275456b8c8e12ca2bcc9df661708048321514aa916fed5a5e6e8c870c3e
-
SSDEEP
1536:CkgUiIakTqGivi+PyUarunlY863Nj+q5VyvR0w2AzTICbbGo5/t9M/dNwIUTDmDV:CkgUiIakTqGivi+PyUarunlY863Nj+qT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC051D11-A29A-11EE-A0A1-56B3956C75C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409611521" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000060c3bd8e7433fc7c2e43dd9f1d87c998ad5aafbcf933abf0caa7329b0fcb78ad000000000e800000000200002000000058a5b8f2b4d651ac1aba9e11b2f689f200129d51e6fcdc17d005345f2063283e200000004daa82a1a2e59672102e81f418598968983ca75010eb5d8ee224c8fc2b2305dc40000000d27990f164c967b114dd2b62aa1f0f7ab2c67c1bac471617f8f5f42a618edf432eff5ce5ea0fba884c6fdc62cab249d7e1b82c14f7bea7fdf364e176cb968024 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704af2dea736da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006a90a5099711df47d8919c7d6f6cf744696ca3e3baff986fdd22d8b5b2ad479e000000000e80000000020000200000003fdb266c657f22bd7e3b8187e93da16dd98100ec2bc842ff5d17785a0a946f2790000000274ccdc07f53bfa435fa89abac520bdfcfdf4a51d1a0e5aa7819de7d65250888125d5c2190211e4c7400131b5135797824773fb110550188315cb0b1a26780f07ee81ce40b80b9d671dab20d0bd76f8cfb4b9f4b882eb85b20acd0d938da5e0ad09041a939e1272464ea468c73cfb67976ee62e38be782f4e3f1291e4b856fad7b245eac3c136451c356aea5faff272d40000000a1807e9c45986d97614081499b8158ca13e03afd634ea1ed77da998914470eea846820a26268e01453a385aecf8fc7fbd15cceec49e8de5d7c47982487a36288 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2804 iexplore.exe 2804 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2696 2804 iexplore.exe 30 PID 2804 wrote to memory of 2696 2804 iexplore.exe 30 PID 2804 wrote to memory of 2696 2804 iexplore.exe 30 PID 2804 wrote to memory of 2696 2804 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08f6db992fac0c6394cab216d8a57f59.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c2a377d06360d4ada7c5ed6c46273c5
SHA1114e667e797649d5dc7a6e091e6a53218215d527
SHA256a58e3fb6a2ae57cde501227d8a8b02ae3d893ef7c0e1096023da5fd49d0ba81c
SHA512193c19f540511b2499612813779b93c885c5f204bc3e475c152ac499e683e869777d08caba128cb94f304d44d111f9341cc428c855aa0895b03d324b5cc872ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50812f33df31792f8dee7cbc1d6a22eae
SHA188a9de136dc5a3588dd337564b1f9428c04ba4de
SHA256c483688a508719bc5b9c361bf4f6fcfc084dd330c36b2a7892d3847700083c59
SHA51237e8022337d9d2bd0ab5e63502a05080d540ddad8f29872ff20e85156659a860c9defcbd44dd8fa0077881658fbfd6a4e4502c10a24033307400fce935037fd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58467ca6889ca6b272f6a5cdb7a53b578
SHA17d0a51f38b7f8a66481bc2e80e7b17b14a92b23d
SHA2562c05fb91fb0ae47cb83b3a6ba0055cabee74d9f2c6609d56788aeeb31dc71641
SHA512d33bf240bf5d1cd42c9648a85e85887277dabf5613c484700b0da38fddf75bd188047b81b5f8451dc0662f5d910abb944659370c4fc019d591b9f4b80c3e22cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be43943f2b5ad372441891619b9857c0
SHA167707281a0ca6d7ad7f28772740ee0a533b5802a
SHA2564ae2bc476cbdf5fdaf3558474d3cba3899bf0a62008f83b7402ee7a0c16a9603
SHA512c7c7bb8c03804385f2216f2ec934a404a095cdea500bf64ac69865bc045e8d6f96c197aaae557bbf431a6cd47ea4dd4574f06391906ed5701e9ed2b23effe628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56147acd7b9ea5e59bb362511b4b21a5f
SHA141a96a7fcc61d8222843ddf87e60dbec435531d4
SHA25658c673927a1a0b0923ccf2e847891205dab70a1cecd2acfb4236befb5b22bbdd
SHA512dc9735bc3fa12c10384900f5c5debfc2c5ce01487ef7c1a168cbee489bb87f22ee6caa93f5ca3f34dcdfdb554bd2144d50dfa9c61108ca06ec242c77ab9f8982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e84f64cec2db7937af6ee63ffd668b72
SHA1cbfc7ca0851142fa70ea4460971864cda9411ec9
SHA25683323777054d6cfa626073685c153e06abc4d61b5d9525bf8001415298d7f2d4
SHA512be11aa3cb511aadf3f1753d7aa45205bb81566aa80b99fffcfe722e1aab5bd7096f97fed179f208ae487abc52215837b59511ff0b6be3b6e4f7bb0c20da16c7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c3b1d14776b84b0b3cd48453b1d051e
SHA1127b001d6ec7acc80bcc304abb62d2940b67afe3
SHA2560f89708b103d04781d5c46659241b9cc399cbaef6c4512f937a8c30ac21f5c7a
SHA512d28c646f712f652241e1e9bfb5cd9892fe40488ab6f0ac36a8eecf33256416ca867898cc53b0782f48dd57d07a4bced4e7708775ef90c6f5f63625f5ad20715a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4746abcd57be37778f2a5819e21e3f7
SHA1c549df78f40f1ff34a8274da172644e832deec37
SHA2562b054c29be84ecec11cf1d41cf69e1a59a84f308b18d07197819dd03c7478b32
SHA512feb3e4b998f31286f53c641e4f70b9933cfde0b53c8168a3c723d06ae9217a1364c4ff318463337b0d6e970f27a10869a896c3be1e43cc2179ec5f25ff63692d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef29beb5c76c76503e8a92426e6672e4
SHA1cd529d032d870ab78783a8a35d13265f75f6ec86
SHA256ed62bc45963fdfedda3667b8c9c2ea231debf5d538739eb69454b3011eb730f3
SHA5125d43da23898212e84f89230c95335d0296a27cd0b0dad0ed456572ffd83e75748fdf583e0ce7780349c1c9e8d7298eb6226df489885394f8f8c9dc0f9a450388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d71e9c3702de49f88a75f3c2039d8a6
SHA1edc1478a4112e72f06b361f561bb7036fb0379e6
SHA25669b47429924f0c8f9bb2148414be9a46887b6a9b2ac112a170de4b78baa02b8d
SHA51283383c2a6d42bf7acd1b0d334be4327887e8d8b6dde344be74124150e806a8b060fcd4068a703bb162753db3a799efbe56c2600092c105ee38921419f9d8f0dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54af47f2e943d22fc8e9ef7590a2c428d
SHA18258a05e913c860c8307f47de66e1c54fe500ec2
SHA256d4795d347e9932a1de3f84fcafce7c0d1981c3227b8ab2aafa56dcc9ca7f9413
SHA51237c86520e2a0aa51e6b07a2757a3d205b9efbd4e395da12134c5cb2f6577387cf6e0e9d51456db849ecb0bede600bb89e789d8763cf096d1f54152355aaa0dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5327b48a9672d26add025c388e59a38a0
SHA15a6cd33e5f31aa56cba07484aaa0643a44b9133f
SHA2560fa424bf250ff732db139ef50dd004036fe58fe3957fc36089fb66a3cc30a380
SHA51227eabe1b72c7751530e695f7215b4aa14edcbe3f8b90d17387e0f0e79a0ad23a89e5f84d9000f706932d25c8614715de0dd48660ef50c31c66c94d0fed026708
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c54d0cccf4b9f6d91f585f007dec5138
SHA1e77364a26da82bac5c71ee49f34ba7ed4f13c38d
SHA256d275f676e472b31b48e7f9d3343dd1a8fbad3e96dbd1dc1c81f7e82e8e041b44
SHA512fcaf3cffa72ea1f5f4b39ebf333a9f2339196905cdb17a386dd873ca1a9f403165c58df0b66b308854a0350028ffeba3c2bde83faf30ef0a7360a9b78261a1f1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\topic_starter[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06