Analysis
-
max time kernel
142s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
1d9bc17ea48fb8e1248f3886fcf3d82e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d9bc17ea48fb8e1248f3886fcf3d82e.html
Resource
win10v2004-20231215-en
General
-
Target
1d9bc17ea48fb8e1248f3886fcf3d82e.html
-
Size
3.5MB
-
MD5
1d9bc17ea48fb8e1248f3886fcf3d82e
-
SHA1
cc739b3239cdb8ae44ffc71422d7a86a8c7675f1
-
SHA256
93e32d16bdfbc86a1a9d6f8e5f22d94d6720d0fb8f1e871cdb210b0a3c99bb97
-
SHA512
2c324b889d78b17b045b084afaded285c37ab11d58921e706e66c1ddf5548b70557e97a427b9e2540aa283afd9e650e13eb8e7a50775b1ad7b3d43aad553417c
-
SSDEEP
12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfa:ovpjte4tT6Na
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60589818b037da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3565D171-A3A3-11EE-971F-6E556AB52A45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e991710a9c1039003fdcb65d3b6788b5a56d1131ffbaefd1ae35f4225961a1a8000000000e8000000002000020000000085838bf9939ec645ee68fc35a31211c322d82f5c91077a6ed3fd908f5c7755320000000a165cdc87b30586f80b490ebc839198b5bc88a130cfad36cd1409f158d363f9140000000cb0b2ebbc75b058f7410553bb873bc9f219626df7a8ebae7ab94b3b58e953fb7b04ff85278f3b0272a3b6bec98bce05a04bc6ced81331696811c9c2474b11362 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409725062" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005493ce31f8a0020a7d9049887b7caf4ee20c8df5756728f1926b4152b31f772c000000000e80000000020000200000001ddb6384a79ccf50181a6308c17e7d44a17cfab6cf26cb0600e1d9dbad757c089000000006e5ad8a34b9b8c6d7d4971958fdd0c5d91fb04104f9b41d0d6d28b82786882c1ced8104a9c83831ad6a63142aff268cb557f497fc0b6ea6e16a99db1ee74b86427a21dfb22a8ce2fd6dcaa0cb3846c3e3cb84c998b7eb19106dd3f5b96d9619c1a6b85c201fe9769a2911c2ce56d22117b6f06f15878caf1f898349f056ab590a1f2808bbce350d7a70d5d1a0329a0a4000000079fa4fd25180cfa7149d58ec9f6846fb44b0f685cce509d1ddf36cd1acc495af8b4a9540223f1905fa366b79fc0433aac7c2372d48af68a519943eae2b0fe856 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1900 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1900 iexplore.exe 1900 iexplore.exe 1068 IEXPLORE.EXE 1068 IEXPLORE.EXE 1068 IEXPLORE.EXE 1068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1900 wrote to memory of 1068 1900 iexplore.exe 28 PID 1900 wrote to memory of 1068 1900 iexplore.exe 28 PID 1900 wrote to memory of 1068 1900 iexplore.exe 28 PID 1900 wrote to memory of 1068 1900 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d9bc17ea48fb8e1248f3886fcf3d82e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d948758aac91dfe9c747d6ff900b00f2
SHA118ebee575fa96d4b76ffe3e37d7f8223ae91814e
SHA256d088eece3d835dfbd09e54fb9f45f963c40f6212b179b6f2340b69f9640de7ae
SHA512521164d6c69ac2be2b2b4fac8a2db199f563ea5fde28726acc0bab429f5cc53de27e28cf7acfe9b4f07eb63c9884619e0aaa65e776c5b20a39dde4c8e8a6ca91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e8dee55b84494d6cda0e554431dec4f
SHA13d564d109408839e60c75082a640374dad8579ce
SHA256fd11a38ca18822c284b8219e2ecf5b6bd597b8e7e1798fb09a984feb3ccdfb68
SHA5121902e536c1d5bbfb16616f8edb5678c12775e436457c557475e53ea6dff50464459b84cb67ad2ee246552fb8514fdca3aec9c3b7eb80534f46dec40cc2fabf14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529f40263fee56340668e917675bb7602
SHA175bda4d6081114972d5dbe833c48af538f5ec528
SHA2566f7accefd7b0d4e5cba258b358902725c853b13114a5a91c9b65db337d1c77fd
SHA51271355bdac31fecda7091f53513d2d517731cdd595a515a78f9a373488f49ab42f313d3db67bce55c8a9ba6034738241b04b3894c28e3a443637868e9fb0460b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fee289bd42a461b4b97f697eb3d2009a
SHA1b8cb394a03781214db558adcb7d22ea69eba5ba0
SHA25600475e05782ffcde7d43b3fcfa4d5e3df0cdb8781eeb9758876ed5a90c64ffe7
SHA5129081eed76f2328e8f5659991c7ec5f255c84e40db8cde05c7e70a7edb8c87759bd63f2e9b1e3eff7dba3cc3e7f02c4f1e737f724b130b9bac28a9bf730c59294
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7f130c7bdd3b39991d0793afda51eb7
SHA16c1ae3947906dea46b171ba4daef096f97d04b1a
SHA256fc52af291ce9494680d31e9b437cb9cb12754fb0ca12eea9513a2db0f210b52c
SHA5127a5a24d0d601554efe809ece7a46bd20c8301b1c645e2aab3a35fca331118787000a351708cc2e0a315ce974afc15dd1f99f7f7bc131a8ca34f91cf4272c568a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533120e086ee798b41a9c7454476a5bbe
SHA11818f21fcc65a19fb052feb14dd6a90b2894c115
SHA256521372fe06841781c5cba796132187134c2118791c7c63dacf1f667a5d547a66
SHA512362e2c6ac79100a13bfd11e139e048a19fe80b62784b78bc430add0eca9c975e75f32e5fe6cf4faacbdd2ba09c86169330536572f8b70e0c0aaaa62da0ac006a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5454221a36a2b8da6c2e6080b6cba3c51
SHA16fde2329ce001b060f5840f9e73417eb7049a188
SHA2566d840dd0ffce2fcd5831b259128b7c717bc2062091f74a90c5618876adfbedf3
SHA512fe6ded00144452b1b4976d5dfcf6cc447812ec944bb175455950478ef2fd9d278f3331d9be03f54b4d36e98978e1db0a1a029c96c35144b2749ab4df6dab4058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc2e9060285dcd7296b9d8c4f9545ded
SHA13dd73547819ac9ddfe2ab0288224403eb2e25fac
SHA256cb80269ed7b75f41381a73c7a8a947f088ca0b74669721722bfc9ad737b11fa9
SHA512622ff73fc81f92da9834117d15123a022a52edde55a819f1424f81eabc6f5951029d70af2db4e4af0c673df47cca5b8373b05837dc84d0258a803a0b9d716e1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598ea9cb4db9816c03a403825a3f143a7
SHA158187372c0b9f76caa4d88db8621b4079dea15b3
SHA2568f6fa45e771b9a37b2328bf9b91ed7fe352670ecea1adbfb34d7a96fe95b649e
SHA5126a5fd97d1195722a058953d4fc020b0d50d25c70e1eb70eca34ab1aa05d010ea9ea96c8b66263a028089a22cf4df6dbf2368f082359bdd81edfda7734d4cb5ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5850323e451fa4f93c5a1e8d8817bbc59
SHA1d0418228d576190a6907da5228ac2b4cf521d9db
SHA25652078bb5c2b1088a0135e941af55e82f11c9544677dddc5e4d541683bafb0d6a
SHA5123671032b807647852245ad2809c5ea86315bf6f14e66270ed9a0c11b9d086ebaff113b519d0a5520a2fbcd5c1266aa5f22af54bf5c78ef2368dfca12ff915e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0f78f7ae6c9a84d4cf1ad7a2bade994
SHA1c945cf65f612e7b7053fc44ce4580e03d15768c2
SHA2569b60dd14a5de4dba74dbc79249030b124c3120b21b8e5e512dcaeaa27a9cd4cc
SHA5127c1658fe0d73a039837b9c93d2708890db8959a4130cf54131b38e5939d44f5af07982c300121c4cbadf699ca2ee999471b7875371b8cfe5bd18f95c840984b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6c18c78d58c293f0b34d26b5fb83aa1
SHA115b730905b94f007e8c1ec25d95d0490d94bd061
SHA256012e3f90d212ed908880a5989d66effc1cf477af54567ee12436dc1679e08350
SHA51272f44f7647d824137a830682d6da4a4bb7c4477209ef58309ca7e9796599e8473ad2a660ff358d02a59e2bbc7e2e2a8eca6882ac9b97f896f9e3030618ba7726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c29f474f2a634cf1a6fd2185b6559fb2
SHA1a45545d2d02bd513d08fc587a61facf4abcb1b0e
SHA2567716266ff15a89790787040747ccbda906d3bce724d3b942d588002f7ea976bd
SHA51231d4226c8fb3aba2bcd38dfe52d1ea377d23a1c17b8e2699231a5ab4fa2e25508357ca39d1c27b25e678c148dda8fb37670191ba9ffd67f014aebd7abd77c951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560d1be7014031b279fd95b6cecddef54
SHA118ea1672be1c658562f47648cb79072eec2c4da1
SHA2563ed28abffad3cdf8af7fb18b3d088314eff36364edade5facfeaaa74e14b36a4
SHA51266d650f07e7af83cbf91d0527ae2964c280faaae2bd2cc3582643d6d58deef660883b8d6697dcb63e39b5f085bf0b242d23fa5cec16e3df4c63ea8b623caf1bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50627f1730e79cd0115066afcd98ad54c
SHA103932d6dbc9eb608b5380def1df78abe6b379e8d
SHA2562fb399050042c0acdac9e35ee9db29a4402437f445ace957746818f55508206a
SHA51221593626a5ca1fd5393d080bfb16c0886c162d7e049277b1278ceffe18c934d48cbbef4208b5df31b068b0f18bc4bbb8f9282ac47b27191799c46177b2134d8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06