Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
2cb3fc66aecce831fb0ac9bcc7b6d8bd.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2cb3fc66aecce831fb0ac9bcc7b6d8bd.html
Resource
win10v2004-20231222-en
General
-
Target
2cb3fc66aecce831fb0ac9bcc7b6d8bd.html
-
Size
1KB
-
MD5
2cb3fc66aecce831fb0ac9bcc7b6d8bd
-
SHA1
f4a8f5b1f7c1bbe2b1c7b709082b1a9aeb5c8dee
-
SHA256
b974f06e662ef94d910af2c1f34c83bbc57ccfa246c843fc41cc48ea8281ad74
-
SHA512
10ca479bb77be90c7e18261d6444dbc482ee3f8dc3b7b2b9594521b9bd5b899d011fdb997d217839e12993adbcc5ae326327b4bd74f45b7f3d4b4b886ee080b6
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{137C3041-A5CE-11EE-910D-CE7E212FECBD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000068a14ab5a95bc261216adf68dbf81e5e676c3ab18e0a32001bc65eeb4286e99b000000000e800000000200002000000034e55cf158c9cea2d1fc0342d079a2627e086b5bffbfd180a21ce4c7abb18f659000000000fbbdfb815a851eba90d3ac64876bc60668b5e12099b9d35d9f7603fb1a3c656eb3194e127f4232e84052e52a842fe8f7697698f944bedd5053f8a600623b11e5d8e069eb86e23029cf3ac7f912809b299ec1973116d8fe4cc7b326871d48262e8fcabb51e6a6bd72a3c5ab48620aa0657914e6f08cc83dd2124e95ed9ebc283926f562b1e6025130a93d4345f3f79840000000f4a6f74bda9118d3992b7eb9e90ca08effb69e06a0cef8e7f6d3b3201ab641257423a49a40d284b31ecb23c5d5a4693c24377f68a83ee9580701fe9014eeb6ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409963369" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000001c3ba3a318e05f2daeaa599dd93135c28859ad78aa8443080e216f4d234bfc0c000000000e8000000002000020000000e14d06f5418f3ce749f7f0b083f536fb4a9a090176d490c40c1ee45d81338d742000000009ac7e72be1d267048100dd6e9a521e3184b7b7d8059d93aee83b7baa0914c0240000000df3b10b2adb78c8c63a0bc470dc19fd62c8169d6e9ded25a82ed38c0bf0d3769d7a9bafecf63aa1f6279f8fd38387387a134236af45722f2a1562409dc5d13ef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00452eecda39da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2252 2220 iexplore.exe 28 PID 2220 wrote to memory of 2252 2220 iexplore.exe 28 PID 2220 wrote to memory of 2252 2220 iexplore.exe 28 PID 2220 wrote to memory of 2252 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cb3fc66aecce831fb0ac9bcc7b6d8bd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD534dc670f85d7d27aa37a28d2c5062fd8
SHA11132ae060774c4ceef2599c516e1eb06c7552c7a
SHA2568d49d05072f3099f6dab95269c1aeadebbea34fdfe59367e143f336233ed36ee
SHA5127cca0adbc3ef1423ca6bf37eee069d690b323cf9f67c23e0cf71035d2e4cd561dcb891474fba5e2b303414c9fe8a88e059dd056e8c2f760e12296ff61a9edfd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59862a0d57f1afcb373a73eea84208807
SHA1a424148326f25881f62cd51900d9173ddd84ab67
SHA256bedaf22d7506078b4b25c7fd15ee1b5d92bd287ca05736967fd9dd800c09d6c8
SHA5123edfdeb369754c7c6dd9d27e95c7ebfa33994cc06579358c58aa5a65b1b1d16f265df4c61b784b4a898a3e1434c669b38c7d86b096057f1b948fe66ef1108a21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f744c1be927c935eb54f60a2b4f088f5
SHA1a1abc33308acac768cdb26b4e99840928c29f8c8
SHA256aab17d77f7afb1b129dcf2b934f086f1e870ce4f1627a47ca242a3c04b8dc903
SHA5124dd1a0c130be602323e07102aebb44147fc789df1982e37d47872e387089fd2922ef36686facc033d4799c31b0ae3ff2918ff20bb3795d30328ef39e83d7f355
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c096de4899f6917e7898d853a75f556
SHA12f14aaa119d12b066648c8a37d647da85832edc9
SHA256804ee4e4fc6830f4e63b51a5b3be57126693eb127ac9d497207e5c9328802736
SHA512fc0323cf397f9239830ca48caeda0098fb3f5f58c6038a54bf0cf8a54e0ed089d29d3e15e9b6802153648a546158bb34f6d57cf0b439247f7724362d5a2d81a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55502f51e9b56e118984f1533a2ffb0a1
SHA1fdd6a967fb0c9072bd6f13bec9431cfd4125324f
SHA25695d7f3ac806435a1b58085be89e7710aadd0505d99f82c201c8b5db6515a3168
SHA512cbca9ee7c901b3c89a5d53f0cfc01db14ee6e640cd3015abb6f6355339471a2dc174fd5d9b5d594a9dc889916d8a6eb67fbd31ad2e574c3622834370a37edcbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aafeaebe82de8cede268a3ec47be70a
SHA139d6463622b586aff26ba10dc877e7cc9be5d5f6
SHA256aa5bc0d95058db0819cd4e49d73646ae09545196c53c0fdf8fbce28b525d2fda
SHA5129a2480efe9cab919440dd9133c0ed86a0bc970b701f6533bbba75c5c0d6799c9fde4950916e132338a2faf64fa0fd7782900b986df4800cad5b0763ad3816af3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c229a87c878c1dc133378c69c5a1f95
SHA14ba376c389726f28acf7df3a59937f2c87878a50
SHA256702b0cba144e6e3ae5d18afbce08df7c5e339bdaed7d25ebe4ebbcd94e230761
SHA5127dcecfa39a87203dba810ba100eb88cc24b3aee96b7743675c563e91917cea42ab5784de4a381818f14d23af3718e4fc76aac50fc1f89cfc72ea1bf06749f989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56acef3e680293023167d95c25411e8c6
SHA14ace84d1252c44a78959d7cc52f4869d352152f0
SHA25641d96804d0b7841c11a1f31e0de7971c4ba980ca307991ae4332541a0a0fac82
SHA512ab2a1a7d941c45774a4e49da818c358e3625212d735dc065171ba80f658110afcc668c79c88336241db8aa664bccacb5277cd511b2ab9d60519fa6846d9e5d41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5060c08d5bf871c354944c2891f562b0a
SHA143bdd0dd44c19b62edf5287d69ade42d51774e89
SHA2568abea3fadf36737c46c4205fe4d651334e1dfeb490817d121cf5c37f118553dd
SHA51285b528aa1a09930219d14b32ff946f09ebe66263ecc1b7246a508d39e840587ba39fbd8697ad5a87104bfe48dd15f08155b7ef86bc9357d0aba8a09382933864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc32a227c0bdc93c3e011511993c2b4f
SHA17fe2eb516fc16f7de0bbc04e9c7c0cc4a5c8a1bd
SHA2563633a0a15bd6e3d8f304edbf02efa609eab025e6701e2623dfd6c2d80a2911c6
SHA512df611b22683b079f0e99b7518b70627f0a98f210e186148ade3cc2e551c637a6f09c275af07edfa4e5a436fc92e253b42a57812e085bbd96ad52f8165204264a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561df1bf0ae51ba75ae9f29cfdd57c96e
SHA1d348b2f9196e2a5e803b9c504f17bd825149914b
SHA2562694a576722138f69e8716982fe9c2de1fa6200e9cd1d645813c104bb16f0095
SHA51216a37e587b85a69fe9c9b452cb02f06b7ab36663bafb4ce9140411946f141e0e6c3877ddf90b2458afdd904d982426135a0322c9f34023818e064b67acd446c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f26025c489a216b9150a4c083fc44ac2
SHA1e7fcff85c56edf532c1ab18f9c91c5cd31f7e463
SHA256b53c935c5c9a4e2649b5a425cf8fde5e45cab1c75e465abc03eea8fcbc9ec9af
SHA512f2b57d69eefb3e407211c9aba8d7a8ef858ef47ba83b901caaad03866734bb32a49296486c61f19cc989172e2fbcf4bb9ea07ee72d045df3b4860eb91d244676
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06