Analysis
-
max time kernel
122s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 02:31
Static task
static1
Behavioral task
behavioral1
Sample
00148c3a3068c82d0ce56903ea1270b3.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
00148c3a3068c82d0ce56903ea1270b3.html
Resource
win10v2004-20231215-en
General
-
Target
00148c3a3068c82d0ce56903ea1270b3.html
-
Size
53KB
-
MD5
00148c3a3068c82d0ce56903ea1270b3
-
SHA1
2ce59e8dd8819b9cdc337ea5c154a36e5c6fd060
-
SHA256
e0f20ac3c2be860725116824c5fd131924c075ee7a6944e3b2add5a4abf28b3a
-
SHA512
8d207718351feca7b0bdd5105c2ea3091d129034633ec96255ea05f2d5c462ec1c4a277a7fac2309368b5ab0748f26d6ce7dfa9324ede48c5f0617d3fd6031d6
-
SSDEEP
1536:CkgUiIakTqGivi+PyUprunlYZ63Nj+q5VyvR0w2AzTICbbBom/t9M/dNwIUTDmDi:CkgUiIakTqGivi+PyUprunlYZ63Nj+q8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000381b1b2055f68915806902dea00ff3dd19d73b38747c354a88b6f7102738f923000000000e80000000020000200000009422fba964a69dcaf98ba9554a6ec71d08f7c4b10a06ed2661041df075a3cebd90000000f042fb5fb55c349cf7f708a2ec41effb40e9db9b69261c192a154ed5cabac5f607857fa2400e7830ee64d8131197ce003b0fc575f494a5ba300a6c739c012966b96a84e604e272687132b3cd5ced6016ff44761977b3271a4adffe951314b3522d91f4bc9553fe757ca1bb63898158483c36d65cccbe63ef8100e0c67cc9236906b93cce9e3bc69a99b7f71b8b83fb95400000008583152c88c2f1145beff3a05ffc7562a663ad77a737c47f9c1de8525cac3222c2a923cd1c95b0550cbea70b5a4ef900667e53532e9e2689faded7c4bb49ecaf iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB27B8C1-A311-11EE-A581-D2016227024C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409662684" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000008618928514e73f60a4eb1a0e311c56e4b7c22dbf67bc60ab46cddc54043d3051000000000e8000000002000020000000c3078518bc800b3c96dce7f086a7f01ad061d2c2fed66f0a386e01cf378463ad2000000018fe353194301769456e9b9789e583f3f6c19ba5ea0aa4439834a7da8e11c81940000000aa06df1549a2b8d9590096344eb99bf2c78ab9cd75f6cda30d2ce563c9536cc5fe14c5c47c9d2e96e2fa3c6b7c53e922566ea1b9f304e3b573bf6e6f977b73b5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a7aaea1e37da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2860 2352 iexplore.exe 18 PID 2352 wrote to memory of 2860 2352 iexplore.exe 18 PID 2352 wrote to memory of 2860 2352 iexplore.exe 18 PID 2352 wrote to memory of 2860 2352 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00148c3a3068c82d0ce56903ea1270b3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50af771f650ae799991618d33d81bed7b
SHA1c87a476a8298581d7114e5f98412f4917794e5b2
SHA2561f88486a2e41cd5fea764177e6b4c05012b82e0f0aa8282b5508bf6a7f8df0d3
SHA51287712d2bfc9cdb89feecdf013e643a889af20cf9cd05218efa88798f596f5ed1e5ae2934edb06dc663758292acc3b7c38a00e3cce778c58cb19e5cf2b68d9567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a42e7a48f66f7b1dc40533a611cd55ca
SHA1cfe508903f1f5492069abe72b238d81d3b1ff12d
SHA2562c20f98ed72fefe25bdaefa8b652bcc1bc701186692397408ad921970285adbf
SHA5121b22aa6065092f18d4c6d5fd964826faf79fab81032fb7f7d47e29a88503fb567f6b4a2d826314a9019d445fa504a938338e2e15d2e2f5f61452d448964f9f15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7ee1c83b27b0dc7718f026dd50f4058
SHA1b154875137d2f790f0dd79e537a38e3871a59c40
SHA2568f4983179366e12d29f1752ed399ff0ff03fbd36026e6401b2ab6088db2f2284
SHA51233cc98cd5ba70ce1174b1f7597d6958826b17c599ad746b66fc40251cc287b85ca3c15ea8071eab57d2038af1203f984347b39f087335a65bcf329f3f95f2d5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518fcc4fee11c52095ee2cfc6e29cfb5d
SHA1a3ea334a5326205f10dc23d9fc2928afd96af302
SHA2562ef84d5e8c88139fb76456c0d38a4dc799fc0f1426fe56157e5a02933492343f
SHA512bd9d46d3655f27bdaec9eaa042b95c261000ef66dcf474df65152073239db90be091a2d28928586e206618d0f11465b780dfe308f0ff91176c196fce973e999b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed6091d5f0162535eb9628cce38ca66a
SHA1191068d307611627fc10bb5dc6a14812dacc2372
SHA256a95595ac20cf40a98f6f127c7b79d035f43b52cb11ac701e39c589df917075b8
SHA51211656b7540253d7b2635edd334edc9911e3b2930a83c863c1ce760bf516e9f5bdb1170bbbd78011a763f376689fbdce05918c58a06954995c7c98b5a1020d8fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593147c77edb633db3841b512a3eb036d
SHA1471f917716d1ce35cba97037caf972e52e35cbcb
SHA256b3f3e80b8ac7fbfee4a53bbb404f73aee939d9f30343914a27c67cae678602a5
SHA51295693b9a6964116e92fb77b580c33d6c37e3f69fcabc1019a758fad0dfdd1ad8d0f0462bc536a999ce8df050da6f06e2a1c24de8ef8855b9668027959a2f3395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5872e1a1007f3e7fe9dbb4d7842e221f3
SHA122c057e67cd91e52fb0cb7ef84994e4aee984696
SHA256af1fb37e6ac67976d13102b3ac4455e4f70f9f120f7b62def9b68f7ead193911
SHA512ff8176fdd1227367cb9817b7481477070b32117ec8af6a5ab613c7b5d2e55fd409b73480fa1960d919e7c6a86d1857e8324040f121184996dec38568f8e3e24f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51515e059953df3880937541daa2bdd30
SHA1f33490db6310525de553999cce19f6bb457db057
SHA256070f2dac0ad30414b1362aaef03e6eb095c31cdee2fa92c40eaf9385ecee31a1
SHA512801dd121e58824cc225316f6a125e6b98e8de0e32c1818ac57a2131f89ad7dd581bf2318f868eb38e3a2ffd85ee3b72bb15205192188bbad43fa8282f078a9fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ffe7114315e34bd0006defd0956f293
SHA1aab65ade045ccc936df77af07e0a32652e840382
SHA256a7ae59b512dcd3c00487fd2eedb65c04a2c51ee890339814173aef1074fd0e74
SHA5121cd4554cbd512f81d8878c30d7cd3a8211deef8e4d3903090421462faab64c5d2c071b9857498bd96e50adc1bbd0c77d81ba72242edc32c5c5fd00700a42e154
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac6d22f0435986d82f7dba5f94722700
SHA1be9b0404faf271556be3a20f6816028cf7d57dba
SHA256840dddfc3b5c5a8c6e5f0c6f4a9db4fd3de46824f06a5bb3a9d0472e10bdcfc1
SHA5121339929e30858d7011d73575f9ec190b759176f31e5527e0defc56f5699cd39b6cd4eff77adde9088930e8e52339732b568245ed1fec7bcbb2740e4db9c5d276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa6b05b28dcfcc82b6cb342a5732136c
SHA19a7a49b5345e762f9a86d4983e65ad379ffe3cd0
SHA25698471f9400d367b428e73ee40a205d7e4e7706eee1b8395730a3b16594f808c9
SHA5121f54c8f145855aa70fa4c39b2ef745a704fb7fc345fd5030da547d189c2e074ec2aba63fe138536e7c0a8d3644ed935b35ed23364da2187f8a645db77d52ef2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aed440734c0794e354616637d748af9
SHA17f29d32b9fb3faaf6dca10f4cdd732a7110dd953
SHA256e3ab60d80ec398fb6b3b0094aa9416c6cdccf13133b23c7a112d5b5ad9d03ee8
SHA51251d831a3a528d5a54ed3f10643ce27e1a3233ebef88133f7e61e280f588ec1014b86ca4818c694f64ec369e156924bea7121b8f7fed38447e08b0dd63f33031f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a52701a7426d823793d649a3e831932
SHA17d0aba7874a75105ab258bcc10e2d05bde5378ec
SHA256444119c9c352071723b942be2cd27ca24635fbd6edb268c8ba6d2bc1817e4e9c
SHA512567b12c84ed4e6fafbfad910d9c2c0d05ad1b6a959ef5566f7e1ff2836b04c08e81ac663f2b7fadb07ba15b82c5039289eef92b1ea16c1a92732d41683ac1c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e2113c7d45d4bd1f323bd8a7500a856
SHA18b23e9c3b492284aadce05dac93ab6792815ff33
SHA25652fbc110ae718ae07a5961f7a1f813a78d4596476f38467863749f8c8a4c6ef6
SHA51299abc2bceba6b5434794ddda995b26434b3843ee7e6a57694a1b355b1ba71a478103d49f8171f281da651d5f81b5d85c55af73084178a962300c5eee342e4694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c7f949ef0618ac61891964d91fccb3d
SHA13032985cd843822cb366f2ff4ead04dd6c1dc6ad
SHA256ff3f7e0e81448bcd1ca570421704e91ed3e75ae9d712ab3339262e1cedee3970
SHA51264841fd377846f3a4dee362c702c1c34fe7052683e6c1f1d916b9b4d71d3f56a50b63fafe96369c940382c494f50171721e65cbf77b8b9a2f020cd2c516e6725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5797475127c38d8eb3d669c61958f3c72
SHA131f1efba14185a47bccefda2b3c68a03af5705c1
SHA256a383056485cbce0587a8717acc6b930eb6757bf3abbd3e2d92e90551174a1b2a
SHA51237db5a48e24c8048a0ecae94134d4c4ef9a6f1e5625fa7f26b5a03821f5a6d0ad6d5b5ecb565a7f952c38c48ebe623b57d044f980e439787cb73840efe4bf287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0ba5a8100cd165f68b45c803fe50142
SHA1f3bd725390bf8e192c945ca772a4d4540097a60d
SHA256bedd3fd19d2be9f08c3c0c507c0e36ce5eb2dd89bc1285b869d2bd88b2238a5e
SHA512471e3d4f6792f78c6a7d114cac7369eba78a6a245f71b60ef3b053757fdf76e558bbb42463457c7a091378d57f478e8dd8ee6791005d68cd0afec84b188f62ba
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
8KB
MD5afe07facad722556ab8bf891fce74ea1
SHA11f52ba5d4c0008628936aa1abfee8bec8effa8b0
SHA2569db6e7192b4b9b9fbf1ce7003939046d369c3fe64cdcd1ab6bc04606a69d8f9a
SHA5127d156f45e78699c5c5eaff7ce97fc363464ff54ef957ad77f8de38471a1f17afc379bba735a3b7c1e2806710a32779a172a112e3bdc02ac06562910b30cea635
-
Filesize
1KB
MD5fa527dcd6b5eb05e72fc51570a2a6608
SHA13380c5ef74408265fba2f67e790636d0ad0a51cc
SHA2564dc7a4a6cb3be2c334a27a49df89f18f8f91749fe6aa1cf28d548e0e0c75ce3d
SHA51205c0e217c433949cab210102a26ca7f6a765515b228b217e25c7409408fc167b5a59a8494e1181284e9ec72849c90288f3a066faa284e29d871097ec76291a5a