Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 12:17
Static task
static1
Behavioral task
behavioral1
Sample
1da4e41a2ca6dfbb8ef957efd56e2ea4.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1da4e41a2ca6dfbb8ef957efd56e2ea4.html
Resource
win10v2004-20231215-en
General
-
Target
1da4e41a2ca6dfbb8ef957efd56e2ea4.html
-
Size
2.2MB
-
MD5
1da4e41a2ca6dfbb8ef957efd56e2ea4
-
SHA1
fc72b24d524869addf4c3b9ad382e69160c55a4a
-
SHA256
7f982c6646c9cf565f0978428c62939ce7d75327b7035ce690e117c761540717
-
SHA512
d67ca489cca75fcdf9c88ec7f04fb10594d919aaa1e5d39f02f527624bd7d8a80c5cac59b8447841cb4f4c649e5338ffb7ce04ec30e8bc1364ca43c603e6de40
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nqn:jvpjte4tT64n
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409725128" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000009318077de1b011449e81ee84d753d00522569677c23779b51dc22b4e2b40238e000000000e8000000002000020000000390e0c6e64caaef436df466314dc524cb0ba2274a76f4cc33bd0f4ba5d11e85090000000032969c39247f27cc946b60dd1e95bfdd886b3a5b83791aef27fde85b59e797df0a5fce8fc7a56899215057f1c4e478c8f40f9de83fe0a2c09e540870f46421890da44eb5a23e3bf0336cd3b7d3b2b7f88f049aa8c166c45203495060d00d72060a6a8addecbe38ec3d60d9afffe346ce743b45eda702adb3ffd56844092554809e3ee065122e64dbc17a58ebeaabfeb40000000e31304dd22ac4517362b3d154a378fe966e4a89b4d44b7dd7c959776df86478b4fade839bcef1a3f77742903a076ef43cf4beb53da4edd6b709b22dd1fb8e362 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60C05431-A3A3-11EE-A497-46361BFF2467} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a8c543b037da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000046f289b1d2f68736a656e8d8236795aa9f855a5f9ac7f3f4f23ebee642b5db59000000000e8000000002000020000000edc8bdcf9b39d9fda274cece958831cf8f913b512c87ac4b905fee34682c8f3f200000003bffa203259e8ecad35b2333c7d6cf918a22e64ae8ed6366805f69e704f023cb400000002db149c371de629ad861e0204cf0f8008c71549d48bac9c306b3438003a10a1af3b8de1e90f997b1381b53655ec89a9bb54444e50cc2110dba93972a2d206dcd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 3044 2548 iexplore.exe 17 PID 2548 wrote to memory of 3044 2548 iexplore.exe 17 PID 2548 wrote to memory of 3044 2548 iexplore.exe 17 PID 2548 wrote to memory of 3044 2548 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1da4e41a2ca6dfbb8ef957efd56e2ea4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5d941658c4126e40c34479ab730bbd1d3
SHA166fbfb63b889d498aa2e08b9a5354503428674c0
SHA256332b8e4a054c05c1a333825022b6eecf55373e58c3fc59c5773b04cbf0af32ef
SHA51218e5a10aabd4ad317b606c8dbafd5b2aa2e67e0074e4e862a1fa674a4f57bbc329cc456e26ca2dd2482d79b810ab55d6bd79b06c9340bee7aff07c99d3659ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a4dd6930b153a30266dd95dfa9d4c9b
SHA14a260c6ca03861f92cd1ed548267b58ac165bac3
SHA256a0036ab24d553fb059735c1a853f67fa9701b9b9f51ef895288391a8baf41436
SHA512ec07d3f48e494fe5a2af35622db9ed08c2d411f9a30df0c024352fe25c36a988b5a2d168598e5f60d03d1e1f7ed4b0c58579676dd99c16e490685ded4ea8ab4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500fede85aa0de2efee66b1ab18c9a28e
SHA14c5e0a0e74149f5a4a38695021f803a3fe0435c0
SHA2563d157cf0e312c0041334ec046187d37d84b10322def4f9a112629d5d4633efc7
SHA5123d34a2b58e98929f9a1a9d25b76dd201752620e2079e63cfc46d9e7b5e8fd3e34c5b12d54e8a9d2c5f9aa910354c36687285aeed1cd76ed203f799e107e62d78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5322026e3514f75649d5c926b6e08f8f4
SHA13ecd7e4b010671c363d10c86f77e4a5da7dc19a1
SHA256e41c0a2be971cd496f6cd146dfe8413f69cf01d3c9ca3d553da979925780aabd
SHA512008e0254ab4fbb839425ecac870871386142eb86d8ea5fcd8902c541cecb5cfc96f5ef60af04ca3b2af085894000eed5b70ec8dc2677fb9f4de26eb74e24c731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5ad8aa195080e48dd3129c4eb3f21dd
SHA1c177403d7dfc82800b938e4f3583f77fa6c4e3e3
SHA25647aabae9b9966e60a0b86317ec57bd377e32cf8016e4060a1d307b35381a9b8b
SHA512ef3480649d825aa904318a15390ba1e92889ffc8d3d19cd1948f8eff9e46188af57a1a01fd03b242d74cd398db395d5220e1f080f0fdf93107e9f0cef4a9da2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569ffddaf90a6ea84837c3b852e9bcea3
SHA133bdf68d92376ad5fa12487d36174a29077aada1
SHA256493e0cae71f7d2b21e132c24f0ad2713c0258712ee0ce7049537f5285c73b598
SHA5123d4b1322d0c44567a79e1536343fe99e264f52f09534190a4852e68771a2d091120c491abe1b0be364c1d26d2e545aacf833e0040ff1728f773d544b2f368937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7593e0187297c63b61f90eada513b44
SHA16ec33b7399c3ea87df5b2e34c098f0aff69e1dcc
SHA2560fbdb620f29f0472eec4b59a9d28c4029c2cee8fa89c1da1b0838a1027d236ed
SHA51267d2a87df3a5ddcde030d803519df65f82e1bdcaf27feefab491cab175a13f11dadd0e9811d9595391904f42092dbf2793e801c696b79dec28b53d5111fd2179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a960ac2144e2fe22decfb374a92081e
SHA1e6f0af5b3dcc7a52de498eb379e4ee640c2da124
SHA2563c611548fee63b69185e7ce43071e9c44db15ba5bdf762e4282c621a4bfb9a44
SHA51225c0b0282fa31d0b054ad4a595d2dd207bea712bf93065271b3ae141ae0837e79e29627e77e7e94591fc0c633f8a479a0cb0ce16c67e6e244552692ee58f61e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595aeef8c9ee3df4fdd934fbd8b164e26
SHA1408b34c08f4b183f4a16ab9fca1d2955665d4108
SHA256fa66152130501562ee58c30f82dfeb8c855120c95643e0a7223bbf7950615224
SHA512e2fdbd10f0d5764ac63d2eb8e1257cc2dcba2c096eeab4dbb797046d4c5421d8a00296a341110419ae77973e584660152b9ef3d1d15bf73b5afaeab2219823a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2ef2475efd0ef728d240626f78c4372
SHA1132d13e8aa06a24276c201fa483a3aa837c9e691
SHA2560507a1234b525c1ee8cef49d1101b9590da754519fd024f1330f3fc7a70b6eb7
SHA512b6dc3b3cf1e7e7c0386df76f8701666379c300e63f759ee61fc4ac3f62614cd1117e631662e82736f476ef7de9522bbf0d12b3c8788930fed04303682e796cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a30e96f3f3bddf02a0ae360e93ed65d1
SHA1ffadf546d4867dffe90537364e6e1e950e436b42
SHA2565b3ed22ec53a43c08872019eaf8383e9e4a9959aec39ff494b5fa465c2ccc7e2
SHA51258d57d3a291020d63788f00dd4091d0341a35f54a504ebd9972550a766880e0c604c470fefc6de6819455eb28ac7533092237dcda118fab9cfcc3d09d2a66517
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a148f59035376b6b5312fc66f4bc2e3
SHA195c11adbd9266fa8d74084f0889f91b9a9de759d
SHA256842b3e678d400d96729d4980096e63c25f0daf7e5de20ec0a6ebafb80344a6ed
SHA512845e1b9ce4433596cf2ba6044a22129ea4b5915d8f97d3e8534cefc6e599983dad5b75ce848fe550f365bbf969404aad210275cd91e4e95de9eeb30dd54515f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef98b15382b7f51201bf2d2442f9af18
SHA153801ecd130ce8c76ce5485dcd465bc098e48a61
SHA256e986536f2ab9234096f0a4a22c6ce278749b974186ff6360e16809ab5431b014
SHA512e0474c73c923a42608e0fb03e452879884691ed64dd2ad062399ac9c4a21c7f6f6332bc6f5766325e8ac3bbd9526e16b6cada720c115929488e93e93b7d7762b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d3741bd24b50f53946132a9fdeceb2ed
SHA1ddc84ace3ee05923aae2eba947da4a073e00599a
SHA256a8987da23a1d5b61001b6ef262f7d18983da32cbaa77f810433197e3abf2680a
SHA512af6a1891db7606c5e4a570a34e1a73103cb864d3d35ecf0f4218501e1765f5f8a8ed81ce3bf41f67e7bc7f16c0aba63be032aac6565bc8287ba79e2caf0a1159
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N2MSO27C\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NSK61J43\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06