Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
2caeefb482f43a7adb2d7e2602232ec6.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2caeefb482f43a7adb2d7e2602232ec6.html
Resource
win10v2004-20231215-en
General
-
Target
2caeefb482f43a7adb2d7e2602232ec6.html
-
Size
33KB
-
MD5
2caeefb482f43a7adb2d7e2602232ec6
-
SHA1
4b17bbbdd7092605a41bf66d8c3d1a881d578d08
-
SHA256
3c6842afca36283ddd8ddb061ca323500427fd87e0a39911eb9a81cebdb88d23
-
SHA512
5a4fba2d8d8ceb41454981684692f160608a2d269813221ed854916fa4628e4f1db5884200171ad865542833f1214b9c9193b0b11588524e69ebb6e2bdc991f6
-
SSDEEP
384:rMzsONE+DH9XvlXolUzNv98d88iZ/OmOCqRB3HWdSHI9hyB:rnUFvlYlUzNFn8iZ/OmOtI9hyB
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208f6b99f137da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409753176" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000003d4fd66eefa2559ac27bd239ea61b9755ebf6b3c9e0a27e218103d9ec3c4ce65000000000e80000000020000200000007c98a47bf86d22f038e5eb4a7bcb8207b17a60f35b631d41d0f650119528ac522000000063fafdcf2ab774308390361f7554758ee4bb546861b20c693e96babb1f21cef74000000097d209958b0798b225cbf9fc2c313526b08216edface5f0ab7ac93cc4d50a5f7d1884b903386b5420795e0b3229b0bbbdd640bb14a09ac148114f978f6e1fce0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE925281-A3E4-11EE-B578-EAAD54D9E991} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000017e65e5848356b2be276819b8711167e92df7bf25cf1ae91d6d5526ad5d2954d000000000e8000000002000020000000fbe9b15c3c333f4c9e6d524bfde22c88ca25ac264d76c7700cd1d0d884f197ff90000000c5a68753faa0a0196fb972761d7e9919fee250944e0918a3b31ec0ee93a9a1113b5c5c3b2e64e17bf7cbbc9901e2d6b377c4232105bf7e4d7e907bc101bc5cc2e92180371c271f839f50e901381096447819537d2a3c38abd3abc9b4587e3374583719a84eaf47494e122bc9393c9857f7447a61b155392b492063fad3a74103fe4246b60ebca63eeab8acf66fe0916e4000000050a10aa9ebd92c1b0492a0330f708cb518ae594b991f18b033f3844b19a67a385f4c91a0e7ac98c4849adc2bf4ac00ad79768437768fcfd224a2b1dc41d7e439 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2312 iexplore.exe 2312 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2448 2312 iexplore.exe 28 PID 2312 wrote to memory of 2448 2312 iexplore.exe 28 PID 2312 wrote to memory of 2448 2312 iexplore.exe 28 PID 2312 wrote to memory of 2448 2312 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2caeefb482f43a7adb2d7e2602232ec6.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed61109bd08e146e8d8ec1e85f6e4c61
SHA1b7c0182f8a0bc78e3589a47f03069afca96ca90d
SHA256ac6cf182bf5dc3b4ca716b603b96ae5432c8f2e2e4d0fccdc1351b3ca0455d3a
SHA51245fa2c88a3ef3a75034ecf8ac1c8cc536a191ff0a1f7f727a9a869f2637c23a828e33f883a97a690b0a56a96adcce1cae0c76b77cf0f4e3aeb4337b836df9d78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ef4554208ba50f6c41b9171486e1a5
SHA17cec07c84b7416470e917aa46bd5d9cbf511bb43
SHA2564eaff154dec14ea723efa6c6248d1cc105e218300b6168f3ff744ec9ea3bf92c
SHA512d0736998f787434bdcab0263c98e7607756ddb1feb37eb877e9efce19e04652df91d44abfd9c46790ee15f1d0b7cf25499c49b09cdfa605f8a28beb184f69bb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e425ac93b2b481e0fe3ff53a6e5999ba
SHA1eb3a3d85a4505702efc85395be1c631688e7ece4
SHA256629582fdb229ac20f22cf9758c5e431cb81fa06324e7b059e978dd8d461f79ec
SHA512bb3beb675787e1cc79f0e4cdf3a2c6b54316345fabda0cfd80bcd1d9b2c11ccbd94e3672f20f09e35dce786e4691b8f9221ddc0005cd8a5aa6303612ea7b467a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fef910c9846d0c7f4ec99a1e2c1377a5
SHA1cf68771738d58a90677a31e1d977a3608c61bdc9
SHA256ca53f827d74138a21d4e5c8b12fd29ed19ca201ae09db6c8df08ab348adef888
SHA512dc49749d363c99831f8578d9e88f404303c5834e11e938f24ae203a0c78f561dc09630dc7d369c422dabe4c730026957c0043e4080adce4913ce163c4b7321e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523d80ce30b250a36aaba8e66c8966213
SHA155a73f2906ffe41c7311b4daa5d3c4b5b0cbfe38
SHA256bfcdb393364a1d2872df00f12c12df445aead44668ee7aa15b853a4e4960e6d7
SHA512e5a8d7d1886d95dbc972109076f26766bdf825e46cec4ab7fa355c5cf2337f8a1c25eb2276e267f651a7254d0ecb48f1ee3571b97d664395f62b1d4346343591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5933d08d60c93a718370a42af3f623447
SHA17ccbe6d099f663a077d1a320f001ae9654005d66
SHA25679aa1f67b1685c5baa9455ac19807b06b26c6ec3b3bff22e52cc8246387fbd86
SHA5126865685b04bc315be595253a74f9aaf477b6b4ca1e90c3cdaf5b75bf08cabe3f18ae6171dc5fd5e7587c86e49d2ec12b153c88e4544f05f5d6fa4a0629598ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51460460d165475fdbc098863cb9f5458
SHA1adb95d660454a6ded0473c4088de48ed54875b6a
SHA2566adb74f317e30277a37039b58b75136f4a66147bbd780169ff7fb9462941a0fb
SHA512349180f150b77249146f2ab71f4b35e440a4585b50ab0cdaff60307b5393ae22d1f7e3058f6657d0426a2ec4b23ca7a5b7f270d0d560d8296cd3b46ddc2eac0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcb7a8e1635b988c79343dba877d7d60
SHA166570f8218fc623c1a24fb947c6b6e0231af326f
SHA256c3305d096b5dcb3e02fe68a96ced4003ef75e5c57a5f8a53877a8f849772f731
SHA512bb8b9e45333965632854bdda74ba9da48c72af09fa236eb3e0ba641d104217b67b1c229b32a59d88a5cda51e3192527b60e2a0773eb2b7e293a9f669435a72cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2ca83f9d4022085baa433e01fb7c61d
SHA1c8daef41cd8a3333cfe225a2f9556cbb4766d916
SHA2564525cbe5960a005d0d03cb07d4732592eecf289345a2ca0b3c78872049b16ea9
SHA51299eb7554c22077f0cffc43ab9d4f9e4140b58af13fd06f151717b976e45536494ea9663db4765b01982b32a5058a2a338778d4ba4219d007abf5c733a101172f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ae9490964b66cc9ff92fa1edab4561f
SHA1086abc172f4a3c40d99490e18ed68c7b0c942477
SHA25653ce9b6976de8cd4d1a6726474658129ede424edddf88e7abedde53bbe832363
SHA512168a07bbd7b21f44b3b80c5ff37cade90dd6f2ffb4fd2c40ce7315da8c0b20f079d05b5b3a1576ad2abb94d1e7317c96c8dd64d25b5589889a031d05934b373d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51497caf1ce4b4d37020d41feea790b6d
SHA141c438cc4f53151c3807b8635ec31f3ce5ccc81a
SHA2561854da95124ed33d3c7a9a99b272ff6d9eb95dfcc4069ae941ed937811ec0feb
SHA512af14097fd0abec17919f770d4902aa031c35ff32c327878482c14559e27c6ccd03faf6812c7646455d9abc17b971128bf925936b5debfb089edda72089d63a76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a5afb0f58e7d4dc4d19d9aa7a20fb4
SHA1cc7fabd32188dbb7d49d91d9f98b3fe7c8f899ec
SHA25673e0e724abfc16475407363433254d6d4c8900e0481d07265333c63fdb483644
SHA512a55732559ff894f36e661714c3576f320c90b2d7d169ea8f36e9e5fd8a66dda6e6bdd4e136c520a4b511a998eaa69f5b511f70c53338bfe2d09f4a2491fd529d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aeb68e077ee3e79dbb55813da22fbea
SHA15d5c6e2a19fff029be9f184cd32b34a606c2ca98
SHA256e32c337f395778b5359f4a77ba8740255c64a3297b5c435f6e6797c4bf0297a4
SHA512d621373588b9ab949fcef4998b9803a755be73c27bb06cad3228799007876a3c60849b9d57ae075c781153b0cbcc23b32660caab5f3bd0cb9920a3f580894b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5230f4e528971a05051281becc675b7e1
SHA1e3edf6e1b0261113f1331515fd9fb8fd9efbf5a1
SHA2560eceb85428384e3ed9df980ed0f2b0298614223f4885e70f7a872e20006cb846
SHA51240c745a1de4a1c66763493439874245536281040e42f157002fa85fd6af2fdc5c5dfb89021b9cd9430cd5d6ef2d2c28bf27c09da11b796d385b9162f5779b07e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b5d59e3fad3844953bd57eb6df6547e
SHA1049118fbc12a02b3739e8a8e2d35fba754cf1efc
SHA256547df4edf498d4feba3b12e8a163cb3e6b74f93e3822e255f966da4009a9b578
SHA512e70536ab2b1751b5dd7f8414bbf57850e2a563aba38358bc8ae8663c7aeb08a79432c5ad137403f00d4e4c9de3e1c17bbd46f81cb368184e0470055495c9cd46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fdd47968037f284a4d2006a808c30a0
SHA1498fb0d87da36e37268ff477e65ab089a62a5fad
SHA2560b88167ef0307c0e2c0544a4330937197ee8210bbeff716238574ce27ec2df11
SHA51296269b67601250ecc1455a423fca8c0d7e8fbc35c8caea35f400aa97b72889d3ccf92124341ce6e9923dcd6e1994820db1c3675083658dd018151e96bde96e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5029932a2832eef99ec2c1fd0cab9b0cf
SHA19423828ab3fdccdff6bab2848b018d7e5fef699b
SHA25669ea82b2c4e00543f9b5bbf25be38c91bedb2efcf170a1b5e65c0a39e84b9884
SHA51299bac3ad5d8f63ff2c854c265ba7758418885da642ee4427defa32cb206ab320e37a06734431f1d15a3de33d2a165cec05d252bc4812d4f5a2fb34f03a77db80
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
92KB
MD571e4ce8b3a1b89f335a6936bbdafce4c
SHA16e0d450eb5f316a9924b3e58445b26bfb727001e
SHA256a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5
SHA512b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7