Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 15:10
Static task
static1
Behavioral task
behavioral1
Sample
2832d8c95c9d5ac3d5ade0187ca33784.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2832d8c95c9d5ac3d5ade0187ca33784.html
Resource
win10v2004-20231215-en
General
-
Target
2832d8c95c9d5ac3d5ade0187ca33784.html
-
Size
47KB
-
MD5
2832d8c95c9d5ac3d5ade0187ca33784
-
SHA1
5062e02d2bb0916ac321ab313760abcbe871ca63
-
SHA256
e46d3d8a5ffbae020403b222f4959cf1d7bd62a425f5beab06855e117ebf87d8
-
SHA512
89a8900b2edb373f47d3487a014d46a6ef23d7fb30ae9bb7a236b4307f7c57d4f772a0e0334b278fc9c19928aa96ee776feb523269683328bd4ce245888e6865
-
SSDEEP
768:mSHSSS7goEbTsBp0MLOPzFastWvWkHbPn2zBHxpU:mSHSSS7goEbTsBp0MLOPzFastWx7Pn2C
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF3B7EC1-A5A9-11EE-91A3-4AE60EE50717} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50dd87abb639da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ea0cccc0cdf8f601f6ded4421ce323971526f29da42f8c9c0d8690dfb6cc1eb1000000000e8000000002000020000000d12c6e02b5829458f15e0f4609e663f76073722c7c9e30ca8edc803f7311dc9e20000000ba7f868616975941af5c18a6ae61862f8d5345e8c9240b9acf618244327f312440000000d295411d196f4995cc9550045fe7126939ac2cd815ae5bb4fa5ed1ef85bb1205a9b5d5be99d030f2969bc5a07fcd3cd8002d1b4c2db5474e3ef87ac553cbd000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409947749" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000cffd198f89f9142af20a9fdabc4bf24ab38eaf4b90b18f15db0b855a8b2101fe000000000e8000000002000020000000534d284aede66d3037b48eea553b52c80052598a9f8ed5140777114e622f3b9290000000d80df345b1692e6bfebb046baf50bc9aaff56cd1884fe241bf48b8e19912a80ae06f993df0b74c961d1c690abe5ddf28abff501d99a083f46054126e925dd992c03fbd4af93f7d9c3ac83bdefc53dd8faae8c4927df6c5b99b2ff44f3a868ea8c335ffade2f4c8d5758538cee0c4736d326d65f85d02c9521cf10b581a146bb008ac6fba4e4691c620479f7c41e9402f40000000956f77130c7a2610d0497cd405e0bfbd1001225833ee91d3b73ec4ecfe375c3c5c692b71077f3009a60ee16d37a4ad4165aa1a2fd3d5cf64e816936e6697b504 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2448 2180 iexplore.exe 28 PID 2180 wrote to memory of 2448 2180 iexplore.exe 28 PID 2180 wrote to memory of 2448 2180 iexplore.exe 28 PID 2180 wrote to memory of 2448 2180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2832d8c95c9d5ac3d5ade0187ca33784.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d38957a98ce65402f50c3447dab64722
SHA10fb4378254f757791d9e737514ecb957e365ef5f
SHA256edcc6b3c8b006c41d0bae8b7a0bde75aa40e91298096348def01067b4a209be4
SHA512c2c2278588fa7d3de3703449e9371f11073d2a67f88443d102385d31e9a8f8b2e12533a561e85ce819c8a56e795c3b49bf6f437a20302f74412d7a91fae8ac5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592dd2dce7ebbb6a02ffc3755e0f424d2
SHA1cd8e0811379812fa262cb846e56198a4687c9522
SHA256f4ccdda0bad133a98fcd34be8095a763cfab098afd835733a96c12d93f4b75dd
SHA51270929e2d33811af7437aa2dd4ec44f836ae3d9bb505fc9bc1b1233c3fad17409a0578319acf32d44f4ee8cfe7068147c1146e073d225c854539dcc56aa7a46ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e632c539ade74ab71f448996092a806
SHA1c0d3572082beccf291da7c3db5fe741d7edfc6a7
SHA2560a926936604ea1ccc1e932d0407ae4fa21fa454dd1d243f82f8724a36484e8ad
SHA5127986c533c0bae0eff79ba7183b5993ce8b1bf98a7cb177ea09cdc8bc92174877e44c5b1204e53d9bdd358e5e93072c96d2a75f5f2b71aab2c8a9d7b9dfe3a533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53829e566cbfe052e9486e662650f4717
SHA19a0f3413db9594f66b61e3bc47d2265d0d1b4875
SHA256ba17f70cf4b6a51c1b11efe89e1bf447573fbaa5b6a6ea1d450bc1aa95640d7d
SHA5122acda55c0e93088866e62b7b309bbd657256b647bbe1f7f5a6702a0f338dbc893cb62ade880da620cb8cb60122695f4f0878332febb64f48f616c50ac0745cba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5742c46aabb835c7c86b583a19be4e048
SHA122b534d7bd7412982aa08560479e2d8b7c30cbee
SHA2569642da958a72a0ec8dcbda8a94483c7f317b92d3637c198848d56a49041adfc5
SHA5127159e11aaa70271bc33b6e6c532711ea96014853e1eebb724bcf4259c5b6bc668318577b317b09edfafa5fa72cbdbb083a6780589c59af816c2d9ec7ff84daef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd489e6e332e936496813f39982b6876
SHA1f2c4b18ad2b105fbf73a62f34574b309629fc0a4
SHA256429c5caa67c1da3fbd36ca5241cba219e88d98dec2395f32d7d8b875ab28606b
SHA5128561cc6fd86c87ed13e4337d042dacfe35ac8c5ac39864b4a97a8e5622a8be84a507112d73ddf0b8b0e9773f417d8e29795228a1a2673cd8ebc922343392a9a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55914dfa0561dc0310e19d27df626ac84
SHA1896db3e77d71baaf9330c55da101d221dbcfaacf
SHA256afe254674a4b3ac663674306b3c12d07a2a3ac7cbe31849a84b7e36b4ecc9368
SHA5121fece57a0e89c5d6f7e2da5f9e07ae2abe6db95858e211c7ca5ffdb5a212c3c09914d4359761a1ddfacde1279400a7af7865ec80bbade30449bdd66d9716a8c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbca388e36f2e378776ba4f192714ab4
SHA17bf2b9ad36ef1bbdb0f537ba5634c88a97de0998
SHA256b03f76fc972fd3c5bf860b2746a9338bc9cdfe653cc5f427c496ecaa1957cb07
SHA51245dba1f5ffe0c51d86a6e1d09a31d7922ba41d26695a5fc35f7db56dc65b494590af7cc6c7c3b1a7a96aeec599c60a3fcd49e2fbb7aebb4733ec29443bf92776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce9fe2cb7d19f01df3c66f0d5f784643
SHA1efd4ec8040faa7282a3cab8a2a156d0cbc6622f4
SHA256f09da5f9edc0e4dcd9ac0bec131ac80f169db15439851a47ad36fda78e42164c
SHA51238fbf0413d65d3f69a86c414aa9f5bd545b39f68404b8ac2e3a05b5b423c78e3d0a6d03db66de8de45ca08c8f12c3433db75a4567d909d603068e09be050403a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51951ef29b6915c30e59b9699998d60c9
SHA1c7fbe20f1e83246c6ed62ea9fd2221b28bb1e837
SHA2569f5cbdcf4bc9395c307ce3d3ccedd146d0ff1b1d734bb92b71eb5e9c6ed01770
SHA5128fe557379f2d3ba98418aeeae0ed147dc5d4ef63094c3adfe1460677fb6893f0c4bedd796bf01f8788b402fd6889ffe8bad598e558d94cbadf5c44845b6d33af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57568771ea51742b08db87eb0bbf35754
SHA1d34c9fae732b525d15aa2a64a1949a6ef7f3879c
SHA25673471d504affff1f8edf33d1631aa77cb997561d31a8e10ed805f1c55151ed54
SHA5128960e2f380f229aa64597e41c1154a40a20a1797d7dea92187b2c5520566387c201fc533d48d5f1735fb8b644510013a62d1ca60d7ae058165000f616fa52135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506aeb0f1957117f5355ed4118ea8300c
SHA165b918e9543fcaae7a18db293618e37a488d52ba
SHA256476ee72bcc54b4e7ac56a2cbdc52699822a08e1771773e40dfe97a464b08bb13
SHA512d15780b77677fc99bd149500579c88753c6b91855db0ba6a2b09aa9e579fefa680439bdeeb3caabcecd0cc117ee7879886c6bc38968ab3a0c91424b733f1e9ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597c9dd4177016c0ba63ba337e9cb7d12
SHA1327372fb0ac77f34faa31be705d7728a68384183
SHA256d086ec53c60bdf164c6b41014eb38e9456ae4bc0f2c270f0a63fc95ff9ecb285
SHA5120ae2b5d77f1f65603dd2d45fc393b25ff8fdcf30fe268eba56544090ba1d239739c5c9ae055c1121236804cb0e9497fcefabd2f09a78c7fc96913e7aa16b9c11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0e3410f2ec6d88c5c02eeef292c8a39
SHA1583b412da1f84fdcba287e622a1c9756da0a66a9
SHA256e859d18a47beb204e67040fa7ae013669244fdce0162154a9a2be61ff4f8bf31
SHA512df930e8d7560505a56fdce5517bda90a096b97e7d1755bc553b9b7c60de04041eb4f2b01a667bcea454072e16292ecc53db33f9ee08dadb2cdd1abc5cf825bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573f260e1255b67c2eefe95b4c21c152e
SHA1038dc30e88a8820742e4285601135d1e666478b2
SHA256911b84998929b7e60c1126429909a0d5b25d53813017d069e99211b9d8e5d568
SHA512d8f587e0e678138ebcab499f206bc5db49f0d9fe76e03084d1aa809935fc9be40a9f40f519888e0dbc154a4011030883be1a0e557698e53ff7ee430f4ca2f9ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5052453d7786b6a7bee5b738a4abc89bc
SHA1f6da2edbc1223194af1821d6d54113cde7f07168
SHA256dfc3d4dc64a69f4ddd5ffe7d3d4e7d5f12ac0e039c75222f0d87e60404bf1fff
SHA512b593f17a8cc9f53c7e8c3a55c533b1effa68199b00f1edb4a108bf4d3cbdb15b9fed139f168971d9ccd626515e4d5dcb302c34a7710203ec93c7277a1aa5dea5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\getonline[1].htm
Filesize36B
MD564b61f312cf8dce4fb28eb751b01ca03
SHA1a2c70e8bc138120ea35886135afc3b458bc9f38a
SHA2567efe917132dd8733c47958b585f640115b23ece525dd4acb041de089cd6ecdf9
SHA5127dcd4544c7d88afc8e369e30d05d882fb829671679bb0ca9f5bfd19d1a3293ec8897c64e2d73fbfbe723294945dc6b1b27b352ec932fddd35cfc91f845ea2402
-
Filesize
64KB
MD5d71dff97ca86ca16c3db8bdb5285fb35
SHA1271c01246897497d069b81ed37af296cf6c1e498
SHA2564a19255504acfbd49c4e1aed722c7e62b50b5742b860eedabc5f46160f8aefac
SHA5121fed2a183296b563e35d803927e539d28169895f6ca5b522a1c714f222a2d3e578b1e167b19568b5ad4800b898f7ac041c7bd8f6bb02d1361b32cbdcfb0f682a
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06