Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 05:12
Static task
static1
Behavioral task
behavioral1
Sample
070e67f25e3ec344c9f47db2e2bad145.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
070e67f25e3ec344c9f47db2e2bad145.html
Resource
win10v2004-20231215-en
General
-
Target
070e67f25e3ec344c9f47db2e2bad145.html
-
Size
43KB
-
MD5
070e67f25e3ec344c9f47db2e2bad145
-
SHA1
468e94008be58c780a179ce34c3a7c9cf3524eef
-
SHA256
e02ed727e8accd43f63551eeadaefc22541dd796ef619df10b431484390dd24e
-
SHA512
5267613e59c2589dacdb7a4347c1d15e399fa630cf1ad79e717170454bce729dc07ed9c8aca4f7b403d86a999ad8b4f997f34438307fcfde0abb20fa2035805b
-
SSDEEP
768:Zcd9QZBC7mOdMkXpC5I9nC4klJyr8bWwBwowfZwsPd:gQZBCCOdb0IxCVlJyeWwBwowxwsPd
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8CA8501-A468-11EE-9B21-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002593638e5141133fcccf7d38f4b2b91a77e03b31dd2e22488be9db2392ac9d6c000000000e8000000002000020000000a999db931b67be9d64be9d2b6999c952d2fa22bf05d6a9650684617dc9fb69ec20000000eeaa8c7e5b0b4c9281434938f0277a67c345bd3a331ee61b88d694b536fafdd5400000004cf6c69de11e9461567c04facafdaeb071a96b5fb5d39b3ce1ed2cde5ed6eb0e9c481ae569640e491fbc615de006235e41d9a7b1ba575f977050aed66a6116e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000098d7c3a6913f450ccf8da1afbd93acda1338e38f911dfa10d287994ed9030ca5000000000e8000000002000020000000b6efdccc528c216bf5b3272f418520c6ffe450057851b3d64d8899dd05b4efca9000000090961f9200925d8b86969f25166f6982b1e94952575aa1f0abdd554a34555726e122544b4093dc61cc1cca211a3fb40b19ff76f0541ed94591c095f262f5e9efb4ed9d9c658add224298e7f14e3fbd7bf5ed93ba36080e55b060f0e7b265015c7a1d51b09cacab9bc1cd1d0b7643cd48f04c6b43f6482c85722b71a6ad0a8c89abe9a849cb1914c5213ddce986e1be5c400000005d5c0eb98f78b2109fc995d4f033b734ab8d7997504384f8c53be980e03fff25116b191ee7619bd497d66243a60c171bc3f658ba131bf4dd8dbaa7c2018bf9c1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409809999" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ed10f47538da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2276 iexplore.exe 2276 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2372 2276 iexplore.exe 28 PID 2276 wrote to memory of 2372 2276 iexplore.exe 28 PID 2276 wrote to memory of 2372 2276 iexplore.exe 28 PID 2276 wrote to memory of 2372 2276 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\070e67f25e3ec344c9f47db2e2bad145.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fef027bb2bdd5e9706e28987bec0895c
SHA1591a999f9403f4a73f19b0b3b2526fe27d2451a5
SHA256f6586fdc8339e135ef31b4072e683275062a1a629ac628c421c78077ad44fa21
SHA512b49eae5e7ac0c66d3ca98ea706108397c60d8bb34b037bbaf386648656b4b1fd0f83368c40e2e8bb16a65b077f78c8508aa24880a5f540f10e1b5119ccdc0436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5568afdb9cbf996670611628d86a072e0
SHA1b9358c116a9d56f94753028080f6f6fdf0bded72
SHA256ab48beb4bb5ec6f5505f0ecf11ab92877a2cb72950110fa9b74400f9911a461a
SHA51298fdc1c6a4808e1f3b3b083ec01eb1fa8c7e274f94e4aac982b52380c6bad23c0e12cc1cac6d21fb846dde5bc4444d84170bed1dd92b86e0c1d3606ac0f2cec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d460c50d520e2b43e252de9894fa5046
SHA11d8320e1dce0d651352c5f3e048b1497f6290582
SHA256d6d218da09910e4294463f5074cb46f492f0e761c06131084dbfd18b44ac5ece
SHA5126740d95c2a4fe0f107f194f38894d9ecfb9b945fe0ad5a0ba7cf2f94760451a5f982b53ddeffc4b10896462b45c7c709bb334bd5cc7d1e56754359d3316489f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0a9e8d1755de805c47b266fdc6929df
SHA1f100379e1acc989382412c632f99a7e318cfd2c6
SHA2563e5af3c016d7011680048ab3a646b2bd9e0d9a77c06363babf7483b91d34629d
SHA512fd493070cd0681de01117e5a0f666e1fc3dd9ca8a8ebbe820f54431dbbe151c01f87a8b351fd6532f36f673af881d2f5af604f55e066ad7c3843e26478e72a92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f010f7e5b12a07d330da24370f6fc0df
SHA1e6c165d710f06246559b568b7c2f0cc061dc7326
SHA25650e71fe9b486e3b455c1440975235a6ecd818e959e4213a541e6b11454e7ef94
SHA512db80bc305701caa5ef66908ca6cfb99efcb930d20d2508e86b7d31fa3d3809b6699b61f405aa5379c0e19b0ed088554d364e1f14129c5e63d0a0604e50628db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bdf8caec56daad65869c74edf0097c8
SHA10289cdbc1f5228c50c77c924dd2c1813c3e2b607
SHA2568fb98e238df46b6d1453a096dcd74f7c95a9c9ad71978edfa71dae9d84358ce2
SHA512f138860b5d5ef51e71ed79a8a721b424b15482da9ce7e0bd329ed2d8126df14def1295745c722f3745336047c72edb36c7eebde7d5eb7832bfb36d60fda7785e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50698f6c0ca4d1cf7a4ec23e94eb31a70
SHA166a5d4fe105e07b8e36c89a654624fea7e5fe5d0
SHA256b1408ec5c0d39420592c9cb254059aaafa601195cc1c132238fab2d51282315d
SHA512212da7de47c8bbc1d0141b6b8d4a03013836f8f8a51d5d916938062ad597aadc2d8c192586381d4480e35d129ba7175f7f50c144f5ee3c296d92582f5e0f88d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539b1e9b9de3ddbdf6fd4e692bf924f7c
SHA185c60c6fa5b9b938c517fccae09efbbd6059d6c1
SHA2567c89e0eedac45c4dd015625e8cfaff482a50e2957c5a3f81747391443b82dec6
SHA5129538fd9cadd3b9fe62993595266c8838c7136a9f82ef944add146f4590aff30224a303229bc9654a23d4ac12373196f911e5afa8729978f8a5cc39287b7c35e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584349eb492b2b3e62dd45f30b817c51a
SHA184d089d763a49a382e6f6a04258bfce0a5f4fc2b
SHA25689809d2c39d6292d475c62197445a19720362d24e9ea4ce11cee334dc9afab6a
SHA5122305091a225921b9e154288799629cf9e11937c289b283e8f04de540d9c785fb0aec7a6999d0a45f003455720772b39abf427a78344372a9b6671b3ffde40fa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558fca08c69f9b4ecfb4142889316ba11
SHA19dac388a4441b26e337d38e637ebb1be0bbed140
SHA25692c04cd720597d6337e15369130746c7ca79f3a300c6b1ceef3551306e846cef
SHA512b12af76c84840e4609bf2d474514653977d42b0e87a6756816d00a546ef0e2045dfd64dde8a621ac3bc3aa1e0a0b8632a3c779cd7d40f6c216811a93815a9600
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52317e8a363c45c1c1fa622f1e1416b3c
SHA158ae9e31b0056445407ee693f54bf62e53b436a1
SHA256575417b5d122c8d08471577bf9eee21c80068067f56e90ad064935e212f76ab5
SHA512df00012dc1cfb652f1937e2a69744897b719c565cdfda0c74e200f6d3d7412db0470bd68a91f8745c2ef75f0bee823c66e86df958dd420f335603fdd3d9f967f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae94b36ad944a8f3a3ee38454ae59b9d
SHA1dc5966443978627a538dbd3a165d03429a5cec7b
SHA2561b96f526ffe35590b8279c9ce183f659286b40627101ff21967cb846883adb50
SHA512f66a21741107583245092fd3d3f9c0adc0b1d26e141cec169fc5d813aed06f4ad30c7dec266306184f46286c1534f3afa6e09ab3ab2149910a4e5cd7df183a3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59992a413f24b0708a7e56d4d331e96e3
SHA1270d0f8a88f596b6867d27577bf492892f5232fd
SHA256bed3dd94cefad8a9929860caefd16dead5b74e9a3b7bebc9861b24d77a8602d7
SHA512ad30c812fc5dc213fe38d5d3c710d48b89b77d3ca225169aee7aadec29a273eff6a989c76ef48afb2634a16f932977a4e782d5aa5c490a15f2992adfe1cef91f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a93b34e040e749feaf38fbc816cd668a
SHA1b1844df925488732ae056858549e835dbfeccca6
SHA25651b58317ad775648af44f06f5b89540126ea21d390ac098f057d5abd5ffb6a63
SHA5126e7a8090c0f93594f6ce4de2e2e7927c7c9116148d43b1587215acd0f0b85f5b48e760943a6a36200f8a2445e9bb7ebfb92a9a9c51b21544b66dfb9ddb1c10e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e015a4d0c224942a83e17495a703a41b
SHA1dc189c7f5dd84903ee36d04fe9797178f227b277
SHA256e24d816310b5c7d68dd4fe7fb727036f22ae5ab2943096fa5e332d2c05339004
SHA5124328096d144540030a619f65f4baff88261dc444131dbe91e2036b6852d1333ffcffb9144c068729f87ee345bcd220f960c451cb2764f82ee662c9abce501595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b919bf77951aecaa5318e5a26e1cd6f1
SHA14b0d55fb38696f8ed5af562528c7812d45a41f4e
SHA2568746c0a736315d1835caef1282cbfee9bd558160ce5f819ed4d57edba8ac9c66
SHA51209147d894adcd0a8a04f3f4341b6b4c4c932f7bd460361653126b0d4dcb42622d2a3b87b153c9577b1e597563a34e44dc224c4a3280d2456db7bddfbe7368a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51718ecad906db1748087d35e2caf4359
SHA12de4243fecc44f9bcacb9c2902db828d4d21c612
SHA25661f354f8fe7f6b438d7dd97d1efe8bf800888a7e6908d77cb2917aa0fd5c87e3
SHA51225e6ba89c2f07c0067955dc167605d2416e27ff56009c2a1b390846a1c271983c3f801ec57919cfa3c142080af4ae93bc8c8ccd582065e242aa8d99ca354ebc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539be6073ea034bf6972c5639a409973c
SHA17ecbbd4e8809ad8dc1e7c273dcdd01a9036aeebd
SHA256752861e356c91cf007aac29ddabb9bfa4c795d73018410fff76b383323ec4368
SHA512c54d7d8acd1b498a87a8437f65cff535a94e44f0aaed5427860ab34590c12cb6deae130fba30566c373f459b83b9a70645384c5cf608bc1efc3362b8e7d97701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c8f912eb99816e318183ce8ac6c83e8
SHA1e95d8206e843c4944d726579877dbc31fb1322a8
SHA256ab587d420d310c502257e1f8a8171d81388b703dc190cce61b446de0dc516fe7
SHA5126aae2fda7e785b934392d8a71bb89bab00a8046f9044bfec16a7a64e7c7cde54e1bed7b36da42d6a2a86be7b86c856b3000e72a288fe1508e247711c962f6723
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06