Analysis
-
max time kernel
142s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
18032c9a8a6ce25dee43fd5aa1909a1d.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
18032c9a8a6ce25dee43fd5aa1909a1d.html
Resource
win10v2004-20231222-en
General
-
Target
18032c9a8a6ce25dee43fd5aa1909a1d.html
-
Size
53KB
-
MD5
18032c9a8a6ce25dee43fd5aa1909a1d
-
SHA1
aa5be96d668baf5a21982f296a854b0028d74712
-
SHA256
e3f7a7cd588b2709ffe990c77c0d8c976a3e937c9b00bb220df7017c2324416a
-
SHA512
de74d027f02ee6b4b7b898b70469f3d733a3a82c4d8b6de158feef1f97e4a6f3ee64b9704c101a10b07808ab31a78adff43b594c4fd187e86275c2e8cfac5fe3
-
SSDEEP
1536:CkgUiIakTqGivi+PyU8runlY163Nj+q5VyvR0w2AzTICbbAom/t9M/dNwIUTDmDW:CkgUiIakTqGivi+PyU8runlY163Nj+qX
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000023157da6084d353f7a068b047c747619cff6519340f0b6babc37c9497b0b0b35000000000e80000000020000200000002e924d4a2f93d3fb7a0a03c06caf7c3a817fa5c33423862f2ba14a071097007a90000000df2d675ffadcc664047cfbd970f5252f0089726612f7ceda6b9b576d6c77dfbce9d00a1ae08975b3a08070c7518fbe939ba2b9f65be431a60b18ee473469343cd6d17516b0c7a96af80fafc853bddc1d6db93793c83810240b7a4748aa64fbb6eb80b8f986a7bb64cdbf77fdb2e159081186ccc3d2715fc60995964e9878bca3b78f599d1152aa6be2991cd01456c64040000000c95b79497ae870027efcc038e4cd906213f7ff5a227ff29b54b6cd445e2d4d984ff054a014d35b0085f583ebbf5b06e3831bff7ae048f3afc1878dae516732c5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{794E8D31-A517-11EE-8EEA-EE2F313809B4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000008c3c1aeb650b10c8e753b7cb3b8ce569336b00d15d44537e5c023cfc9e24eff2000000000e8000000002000020000000691a3938ffa87cabd442622c1829469e8825c85448136d973b4a8d2ad019cac3200000002848c710a391ecc117c90559952af54432eafa1fe3d41339dd7c68eee2f5072c40000000ccd5ccd2227d37e5eadf8b5fadcc1d434590c9724dbd198fe8beb736c45f62e05e3f03aaeb9520a2177632db8fbb59e46adac96ecfce0bbb4d7d0aec752e0117 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405cdb622439da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409884949" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2712 2208 iexplore.exe 28 PID 2208 wrote to memory of 2712 2208 iexplore.exe 28 PID 2208 wrote to memory of 2712 2208 iexplore.exe 28 PID 2208 wrote to memory of 2712 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\18032c9a8a6ce25dee43fd5aa1909a1d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD54a82a5d082ef5c537ea88b6a60988280
SHA1580bfd4dc4bc80edcda11dbd3c6b30ac369d3695
SHA256557ee2df5dd3c873a2d4f21f5ce34903f8ecf8e0056cf782ef5865381a2d8e4e
SHA512ae8e4fe9bce20d60fb30741f9557c57136a28f6883346651f028b7c4e7a06d43f08aa160c68d978101c6b6523ae9bbb826b54ab5e8fd33aab45e235171aa7a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52add98c00505a3a12574fbf8275b4b27
SHA1b12dde4e06837bc520d48862a557a70bb553ab3a
SHA256f57f7e1219d9d058f1a2fb46b47cb30e3126ed8f15a3b54cf8f4fd7953823df3
SHA5125662e0f8d3da39906a31b4721cf15e79b13b0a5ea85962dd393ecb85da3fd8cacfc75d3adc7e4b3e4545969592a21ff04c26a44e3e6e04b21e83547e509bd25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a07849e81403725525d847709da40580
SHA137103a2ef94303b00ee073dbc3eed3da1d69a50e
SHA256cf212e5476f66acd567e21282286dcce31328a2e629fef43604262bb661bd384
SHA512584d352c40ead8b6d4120ae4e3e17424bbed1a604386bb2253d2fab5e531d2cc132fba5759df072ffe77b23a6c3978ba55337a62e4c6beca506eeca67367714e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da9cc0b5713448ea22ab2ee1cc3b78e1
SHA1f564503235255cbf9a04ba20c17e1c0e052e70a4
SHA2568bcbd1e5c202103341f5d776b5ffb6b111f3c508e09827c8778d52749e1dd0e6
SHA512263aa6890bde92968d88359d2d32c9be11125d9181ce4b6e110024d9c55bd8bcb739606ca830e9cf502ebcc73d8bfaaa2ec18fe9d222df59b05cd14279167384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527196a2a1c4e06854d4f1b6ded91ba83
SHA1d18d9a5bc31baf7ee3f1be5aa61b189bf00c5cce
SHA2562ac018e4ffa4335dc5f204c8ffb7a4b20b09ac6e2813427fcf1acc38495d4684
SHA512b126e9eb5d69abf32f5b5c8d0a6ac7dae158c2b598dbf3ce97447ec6bebbd4c5a77ef40ef0ff9951f211a580fbd9226edb30f36a7a56c0ada91893f52363c313
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d0295a47df5741347bf9c1b037652fd
SHA1af6254f32b5b8fb53c353b3d66f15a6079355267
SHA25614e57c7b286b3e7720d82446c0795956ab2d242c15186527dfecea594ffa9b47
SHA5129799a807023f408201138435b8bc2ae693f9e27fc39aff18ca2ba87849d481c2ceafef9e1185a9bfe809a5be16b079fa06b2de1d53b3bc8672a247b2209579e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52792fc26b1a9ae5779399e8806d6a0cf
SHA14df4df26bb754a3a8d6ac439418750e4d1e7a36b
SHA2566009160479cf1347a70914bed560373864c287cfe8f559b197253ced47ac1ed9
SHA512d138cbd1e5da6851182c8a022d0f01a40fa7e339cf20d234728a36ba1709ec2cff7e916ed451aae4e0ec25f924ae7c2800eb1b69dab5a4b4192ffee863bbfb8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a8deb8895b5bebbd79c96c222464fe0
SHA102365d014912a9b2ac49f5bbef651fbf0753b520
SHA256199391fc10f1c012b6f7c543eab64d028d0ebf4e696f7709017adda3e3538394
SHA512cbcd352032e4a18e47bccf77bcee1741eaefd9c5301f57748a24ecb8536617dca55e9e83d4ecae6046a0da95e1502f4fe2f79bc90ea4d2465e86069b8602c2ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3bf0a79ae6fe5a705cac1d0c7413dc3
SHA149e5f7263ce18ce845e7051e5183acafcef8782c
SHA256778020d15d294c90c5372abe4f2692156f06469db745bb800c54ff138a940867
SHA512297be35d2625f7c2e000f79c27a77dac8550cfd0e92789d63f36f3a9f4fa3b8239cee719c7c0400b40c525a44e7d2b1b9c5331160c6e2a83321c776754e19e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575ef210ef74dc2e1d8831710bf5b3520
SHA1e84c307628709639f4195cd72715c855dd3a2324
SHA2562d0b6e3cc9019004be6bc9c33dc421ef721b412bff61f6c0856942c63d6b401e
SHA5122b5dd44bfa8e7b1fd1fe9a0f8a2470baf433ada8961b787ffd5894cb471ca25f801032b198f1b540e4139818c6da5d6ec112581806f818f583af67cb1135ac61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5710221e28d26c860fb0afefa557e3eab
SHA147c8a7fef1b55e14da9274bbf7f4f9f758b2d9f3
SHA256fb7da4ae28e66a07610ed8e3995053df64b0e8c7441a225ece09aa4b5574e3d5
SHA512a03f376b8817a7190aa1d23a62390e8143b923eff2447275e63a014a658408b8c7c5304a80cf477718a92fd3bbcb1b2b2dfdab99a2c9930f4c7a6169e532a90c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d97715841a4041ae87e522492d401c5
SHA13ee7f3240c5c4753a5b2904a1a5e5a5dad2376af
SHA256589c90a1356ea02fe20d72b49c265de139369bb757ac6e50c3d42bed0dd56dd8
SHA51297ea8e52b16f4962d717374e5e99366e12036adc2569416c212862f9d36be83d227c74035e3d7e6b9a9f6ffaa860e513bed6469c044eddc6e1820dede4a34af4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53738eca60f05dcc35681ba890ca13ee3
SHA16108d4e7c1c38dda4f81be439cfc5483cc71dc17
SHA256c769059920a6f429748fa4052fcf77a8d7e00aeaccb399c4cee73fc157348f34
SHA5124b15b77570c6e94232b370c798a3185934a348b54ff574da1344f536f5792fc71f5f3caebc8ad2d8c56d22709fc510e6381f3eee768e4a2a7ac18cc9575464f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5518b7731c385bbb8bfc6157ce044dd68
SHA1cdd686b568795ca7fdf2cd293d8962d96213e0ea
SHA2561899f08a4922eb60bb56319eddcb234915e01875306e72f13629cd9916c3807c
SHA5123218e43be3c5287d7334e8e69ab0e6e29291ae826fbbc8d0dc7624f62efd91e22b4fd1b29c185665733c1a7ee4db99f82ad1e7360dbb2823e5ad96cb01980921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QPYYQ561\glossar-js[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06