Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 04:56
Static task
static1
Behavioral task
behavioral1
Sample
06698f2959dde48d2f1446a50948ede4.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
06698f2959dde48d2f1446a50948ede4.html
Resource
win10v2004-20231215-en
General
-
Target
06698f2959dde48d2f1446a50948ede4.html
-
Size
10KB
-
MD5
06698f2959dde48d2f1446a50948ede4
-
SHA1
e250fefe86686946ee557b6d44875d3fa0d4cf14
-
SHA256
dd7a077ceee2c3093e8df0710934180ae360550696af5d6d535c38bcf8c59e2a
-
SHA512
ba3126a4af2d047a7f81ba887ce047b85d2dcc9f489eb62d5345f2d0b27a45e8a0611e3bf275aded1a93406b62c7a5d617b660e56a679b5c12855a20609b4f1f
-
SSDEEP
96:uzVs+ux7+oLLY1k9o84d12ef7CSTU9GT/kzrCppaDK8CH6ddNlVHcEZ7ru7f:csz7+oAYS/UzmLaDzCuPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000062202b1199aef4caac51d56584698c6f2e775db6463111abbf5817cb2ef139dd000000000e8000000002000020000000eb3324db9b68a2f3c84954fb91a895e2727c9ebfc5cbf626bca4247fca0fa472200000005efe222cb09795cf1ce85fccb3f2a19b5c4be901a3af8590c39a023b12d555d44000000095b4548bdc2e7d19822049656f4eee05f5db26c2658f5c992d917c5e9b3ee24ebf1619ed45fc81dd87e34b9f2f94bfdadec64460be233bb81df795af4a9f552a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c044125d6d38da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000091664477f49b225d2f35373b1538df3807fd628837ccaa0d602965d84acc2525000000000e800000000200002000000079fabd1bfae6892100ef0abc66997d9f2ffbd03a2c5bcf1d3397c23e1989f1069000000048f3f9c5f793183ce9fb7786bb2fc02411671d48a506ab55165d619d270397e25482a38fa80295ab526c5ba2509502453c7fc833d097c70e587447f57d91cc8e70b7f7b5546317ffe6532c28f49c03eb11018371c2502b0eeb22a17b67a649180091a7106c3b7888291c96319856cdd9ccbc089729b8966fbc3eab721c9bb4f794cbd94e52af8f7f060847c104ab76f1400000000eba2ca7681547cb21f9d354fd51ca7e735fb245f7dbad459e0322dabf287939263edd8cc09242cabaa5a507430bb85342c034fce91cb505fb9a8409855fc3f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{878CE6B1-A460-11EE-A586-F2B23B8A8DD7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409806378" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2264 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 iexplore.exe 2264 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2304 2264 iexplore.exe 28 PID 2264 wrote to memory of 2304 2264 iexplore.exe 28 PID 2264 wrote to memory of 2304 2264 iexplore.exe 28 PID 2264 wrote to memory of 2304 2264 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06698f2959dde48d2f1446a50948ede4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fdfc064fbc4f469fe7b39b331f2f433
SHA17639773df7dcd74afaa8d5efef7c675d75430724
SHA256142b1f553c43d9c1450f6e2f70462426ecca40622a1bc0a90ab791d9a67e0031
SHA51273c45ec325373e7feb6138f086d0d92f1fac24406581ba18d22448e20dc7acd0bb1992ff6ce67428e2817c036bd0cddee074cb2ef1fd590c9846eedd7ddc706f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f254703add612026260da3d310bc704
SHA129d7f9d48e09796af64962a9dea44f97c0259b0e
SHA25659ba6c5bf6ab6761086ba4555104c4b6ca42120198c9105e45ed041189d0f3c9
SHA512d290dd213cba73aa9f23418512e6e64ce043a5093946652871c9ad234d03fbd21bcbc0ab61952ccd481cbe6c311c28901fd54c97ea35486ddf92fd10d283b236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f3d027b7fb2425a01aedd74136527f5
SHA110c21119173624af439ae9a8a1d8750409e8f2a2
SHA256889eec0170da3553cdff26a77d74825265cf222fe21a8fd0d364b58a59c6ab5e
SHA512f22405bbc22355be2136fd60b2a18ce66eeab841b9782006d50a97b362c76592ab25a992a94ecddbcf4a58afaef22868a2ddd97de0ec13bbff5c4b4d32170e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5996a1dda1a621c99999837b65e6aba44
SHA1b9cb6733d7815afff15c1e8ea60b0afe75c02e7e
SHA256202e6855d6bbf9cb0a5f0f7506dff5e4af58882b75c0bdfe615e6522769bb117
SHA51217411da70d603710cbcaf9297f4cd2450b0dfa034f62e7ef8ca7bc8a981fb0edf121abcda8089679c13912da57203168e268192ff4e20e2d964ec4737c32c839
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06