Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
072d60271390698bc5b8254f6c26edbd.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
072d60271390698bc5b8254f6c26edbd.html
Resource
win10v2004-20231222-en
General
-
Target
072d60271390698bc5b8254f6c26edbd.html
-
Size
18KB
-
MD5
072d60271390698bc5b8254f6c26edbd
-
SHA1
cfb6888e1262edfc43f7cbf87f593886e47a6c60
-
SHA256
dd65b6927681ffbf22b7f3c5ac11633cbc984bbc823ba15673a103203a16e3ea
-
SHA512
3f5dec2d56382f7e3ee9c3dd46848738e38148b0253fe7c1ca6716fa392b29b55534e962e21354f6cd024d37bad521bb95d903eaf535a008d130d99b7ea8130b
-
SSDEEP
384:fgxf8CJhfzYWYzd7kVvad1rnrZv7dzK1LpyMUJ:fI85I1yb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009efba3d7d147808f6fb0140d767f6c5b12f093990b95daf7deb52f762eb0c512000000000e800000000200002000000033b6b7eedbf5598b8550bd8883a76eee89d477020fe44e9c28c6ab6b75d4356a20000000d59605b05e1061c4e0541d290a01178fd93634abfc6cfcc4ee797dc355c247e440000000220e00731d21b66a48419bec68891c030ffd41b1262514ef009164fe62f4a9ea99e59b172b1bfafbb95aaf1bb6fc71e59432fbbdc34ffe84781b4b7f22b51b98 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4A80821-A292-11EE-86D4-76D8C56D161B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70397aa29f36da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000192798651ebd9af2c4a14d7a263c7452b321acaacce4ff8202fa357cdd529178000000000e8000000002000020000000c1f2797fb915f3c04e0752e3b087a548b85c98f2731a357d3188f65cc07b0558900000006914c6ef8f4da65aefd72eff32fd1b911d9abb5c3b7a293cd33431776c60a0607a9a90d304dc12878d19bfb5c17a8dcb84bb95a5f0dd0c22e7c092d37e4e1751d576d7fb078c58a6a210765303be52d6b782e5c7429fc2348821a306f19988d38a539901bd755aacf8eb68508858d00fefeaa05ec4ccef2703328fcc58d665c181d9b974f27bc08f06c351587a749a9a40000000c50579e5ecb33d5beacb2a6d26b9cb86011b77f4775d87f5da1689eab16b665f1c1a9b0d7c725a92d4265e167da2b063736b0ae2ef25e1b54df8806bc83fd310 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409608041" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2444 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2444 iexplore.exe 2444 iexplore.exe 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1896 2444 iexplore.exe 28 PID 2444 wrote to memory of 1896 2444 iexplore.exe 28 PID 2444 wrote to memory of 1896 2444 iexplore.exe 28 PID 2444 wrote to memory of 1896 2444 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\072d60271390698bc5b8254f6c26edbd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544d92d361ac4f99d1aa97c6bd6088280
SHA159e4c0d7b8a154da1914019d8bc87cc84f779e6d
SHA2560fefce1f4fcef89ce351604098973fc63cc70361f5ab206b6b58303dc6806b8e
SHA5128210b9cba9f5f8d1882b7cf209049f166a9ee28b6acf3c3955fa925c0fa06ddc1b2d33160f95e62eac329adb1c3cae4175f496b704da8fc46a6b616b5396531c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0f0d520f2a3fb53ecf5c43f2171b55f
SHA1df321116afcddfbc834830977f767713bc8b3dee
SHA256cad552ed645d8d1e03d79ecf373920a52a8002705cf34b6cd2c056490faff7cc
SHA5127f6c8805cd187ba171b6f4759011f0ecb789847963292578f19d522a654c2b6dd4771051d91a5111112c0f11f49eb4cf50bec906630aac4e56453c47ae1b7010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596c8b70bb4b976be6fdbe4ab30e6cd2b
SHA10daa70b9c047773aff7dbb8fe14ca77bfeab0f2b
SHA256d751afe195f822ae49460e43727bcdf12faac3c8de84205cc919acf1e8035812
SHA51232234c508d0e1d5db90772d6aa90d06bffacb6050471050a52b104638ad36497c2bb72374fb810554dd97ed389d9c53e7dc54b791fd2cab01c726d7310b6f4ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c8b56d5d7a959a55212a94593b8e5ec
SHA1fabcd24c381fddd6f31cee72f16d566fc3ecd736
SHA256c87a4567849c7c4d49b09cfc298c73b021cc30cabae1e289a0fb9aacfa872441
SHA5126c157c6afefba600f4e3771dbb6e0fcb49adb3b82de833a70a6196e6e7eda672f4d623cb659725eedaeaff102e965e5ce5beaa523cac814c7dbc573f64793870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55472e21f91d5fdc82f71580ca710e735
SHA180c42795875dc52bc60eff70f77d82c31386535b
SHA256c240a3be3e2ff4ff719d6e79221e6b02d0a85b7908e75af11c4d1fe4b6c67a43
SHA5121d157dfe2d3a6f940c8e6d17d6b8e8033bdeba171a1de711d165a5c04a263b59484e1d344eb4fa8170b9724cbd1ca01af1066c61f5036129f169802050ca730d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dac7072a9c2d0c989ff01fc0cf73c521
SHA1263b0b4a49f4f98b6df3731e961d1c2cb393c48b
SHA25698961e9b3cc1f420e19072a4087779fec2fe8369349b7b38b59633922019a098
SHA512cf430d1d0d1a75ba2193ce81f04bb3162fe653d285ccb6049b8772430b824a24d1f716224bafb593fc2e66d0cb69c81d9709e16c70b05a36dcfd3d5ffc8c99d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d4df28584b13e8068424ccba5198de4
SHA14e51d384db4cd87c8e0485c30a980cd593d7b2c1
SHA25614fe909d41590d026f57a05441150e526c71095bb6483877c2ee75abb6d82250
SHA512feffefe6c5df4f42b2ed341a1fa281317b1c90680c2349ed3f9b6426836bc34a38ae0421a6fb48aab8e0ac7699d229900a73760e4a34dbb8ffa6238c7eecb3ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6184bd00999b44d78ccd70242bd55f7
SHA166e21384de0519891bcdf32d1ee628fa25fd4471
SHA256bfe288d9c9782c3e057a859223e4c2c0266292c20fdadd349b028c58204ef1c6
SHA512b7fd16bc8ecf91cec9b3d6e53e29d499d390e8e87ee37f6448d107f42f3283a1168ad963798d2207572ce4fef4048f2c9180545c6221363271b472bcb6ecfa58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593f4d7c887af53680cbf952c8c3f5a7f
SHA10a8bae92e39a24588821af29d9192e287f82940f
SHA2562c9f1a9a47d066d36112ea2d1e39205210f1e7b577b2bb956565aad37cf2cd73
SHA5120e8d9af7d7bfdb4a5d76d67c47d01e5e8e6545cacf8dffd09bcdc1aeb5e1e53a4f3f97ed02fe850286afa7d43bbc095938b5b11230ce3b6e933c6437018ede8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e24e67bb1e7327c70fe2683b3524784f
SHA17085a7affd3f38357e7071ce8c837df7bceb0cf0
SHA25685d51417e356a315d31969447414e2423ed93bc4e05a3c7296767622a35a6c54
SHA512537f834853deb038ca7f807e88125fa305cbee26e3569892b963d24a438ed42f494432c50cbd2bb159d7f095e2809bf8907c47f5c4cc1172d666b459c346160d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5831704115579d04525b19874d9b7e97b
SHA1e931563573238db164bcdd708fc7168f8ce7d939
SHA256330c2e4a9f78a3d44a4bd836dfc5bdc5e1e99c08b2447d990df6d9b711354388
SHA512acd3e2e8466aad7d4018ab524d0f68b9fecdd1409a01a17a59e790b893726b6a759311d12e3434c9a930107442033e2c2c20ffe48ef5b0fe767703bf6e924958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c40b54ab589a68320f93929f7d39da0b
SHA1f8ecafcfad4e0bc19b7c95ceb8510615e9bbebfb
SHA256dfe610dea2704b4ddaeb78bed332e7cbe16435adfd0c1236c740128eb1ab71b1
SHA51282f36d9eea3c533fa0654b16ac27c41f09822344d82051e550b22c6597025b7fa423224afbd1ff87e2e2acd2eabf8f1f7c3fdb231058b310c10afcbc2e6ec3fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b159e77ff4d7d10e767c27e331af2ca
SHA1cb28a66d0401097c876c3ad8367915e2a1ff6167
SHA256b7ccad5d2b819d3ada10dc72d8d03a350f9e21f03f16f1ad8e8f90e3e0be2b38
SHA51228c3ee5f4034f382a62b420401ada73ec97fe6a72533ee663406f64ccf669eec6e3770f5cc8d4044d29d1e96b9a5323f2fcbd89fb38c88520e34dbdb9d815812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519b163fa4bb4ecd683ebb380789d8820
SHA15ed1c48e84511ac9ce1189c69e776a831ce24495
SHA256d48bd9eb68a7f6681c2a129152e3e33f37032c45120155af984ffd1f86e630d6
SHA512c4f913752628b7870b9df42e48efd6e4a3958a1324c9e347287f0ee5a8f5ea4dc376d0ee4025456de1edd35e57e0125742460b5787eb06882122f78d31e71ab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5081ecc270c1495660b8c8d6207f2deea
SHA132ecae8d3b6948ffe532b538f7cd08b7447c4553
SHA2569b14f4a0e194b86928e948be34d72da7286f6510f4c38c142ba9c14f999ce0bc
SHA512fea955b95b0f6c5f66f76f2799556d2e6e209dee53b00f94db58f98ddaeea4c39e30c360b3bb8680adc4ec5b4fb36631bf938978b21af3299e2fdb2a97476c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b31d0132431b553b7b518e6e1717281
SHA17d06d210891e5163c26b3f613d250c7836167d7a
SHA2562115a1b7a9e43b646bee29c0911029751f9dd67dd6ee839e25990db0f4066616
SHA5128f024d49748aa461bee8265eb36e549db925b644777f4564402a766d48fb53e832ec42123e73e0b93c45d86bf8e9e912e6eadbb395d1a2e7ff95e195a939d66a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5838f876bfc3e94da1cad294e9e8b0695
SHA1680950348ca36457294e4fcfd1f16fa5c7e71106
SHA2566c0ff2e71622c7ea8eb1612ceb94a038b050fff842ae2beb7ac5ac909f24daf4
SHA5122c67393e4564c5d13faa3e4fe5aa026950a380bceaf8ddf3c6c297bb2bd8f3d7885f04b7081d7a682ac0ecbc884404a307029fa79ead2cfbee547988a4b541eb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06