Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 20:46
Static task
static1
Behavioral task
behavioral1
Sample
3c3828301ab5d03c202360ebd605c252.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3c3828301ab5d03c202360ebd605c252.html
Resource
win10v2004-20231222-en
General
-
Target
3c3828301ab5d03c202360ebd605c252.html
-
Size
395KB
-
MD5
3c3828301ab5d03c202360ebd605c252
-
SHA1
b98bd147476e86d11f342cfdc21ebeb20de100d9
-
SHA256
2334cd6294eb19645ae917698e0476efdb7985e19f048d1e0fa3599e165fa577
-
SHA512
932029e5b08f67adacce9ed89795efb8f3af2e5a9ba862281c7a9aea76470ec54e1f6967f22bc97151ad971185f324b513ed7794778cc8cdf8665678531f4e90
-
SSDEEP
3072:DVcEZTRIxfbdGFhJuWq9wTflSS9+CjNEef:vSpBGFaWq9wTflSS9ue
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02b599a543ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A71D3C81-A647-11EE-B092-D2016227024C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410015587" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d66815d5fad97b97612911b106f530cdfe84f64cf04be81fa4dc3f019dbfdb1f000000000e80000000020000200000009eace8798f1d62b98c7eb8243f254c621a1e0bccf4976a9e85d2de7c0ebe79c390000000b25ed7f26a23f08c9d6c027ddabaafd5e56d97974525dad30f430231a32d97ef1da064c331c1a10ba4544dee3e57963c873bf3646762a6edb1149043d992f188eecc91f66afe3d332cd2a434b0532eed9f8fc6c1154e9d1a4c847174c68f12aa410bed09ae9eb08dec48452f52e60d207be2f26f684ef05d82e581761937490ed7dffbe0ed8753ea95f3b9e903714aab400000000c8a42cdf0cfe7a1458f1da5d21de3958c4ee7e04ef0f8ebf05c559e33e2606ac73cf709ae08da525b0a3fb374e1c9ba796c4ad2e7a8be5152bf56258da3d794 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000648ed1965cc6fa96eb8ac47a7b6aa52efdc33fe23a851e7ed64a34f6003a4eeb000000000e8000000002000020000000e97ef6450480cad906665f7b438dc4c21758a97e4b50e8ba5951a4e0ebca484920000000184e6bc941a160ea3e1aa1fd1db427b131fe9b34650067dcefc89865b15c26414000000023b809e7c4311c0d0063cd1d6e29e6de5d8d8fc3d7e63eaa92318faef666dff14ca6ffa05a2fea37ec5b5a01c9fde56b89d35491944a11c918f094a01d28530f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2216 2108 iexplore.exe 28 PID 2108 wrote to memory of 2216 2108 iexplore.exe 28 PID 2108 wrote to memory of 2216 2108 iexplore.exe 28 PID 2108 wrote to memory of 2216 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c3828301ab5d03c202360ebd605c252.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b0a1081cb963602f20b4cb1c53a65f5
SHA13e0354a5311cb5e15aea9fc77d3e882f4755ae9e
SHA2566d3611d78fe06537b43d734d75c2895cedf791e51b015045f27bfc2af7930b68
SHA5127121a9438b85566e7d0ec7b69e4a617518a787470e78226ed40e838dd4fe10d59089aa52d6a2c10a1068350b0c1d0d0622161fa1a0f73b6e1ae52b7d290bdd08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fc772e6eac83e92d80c2127d702be09
SHA1ce00489f56923720afb45f2e1f39714baba8905a
SHA2568018e6369aa0c945083fd386cda35da786cbf875edb79819f65dbc58bb597961
SHA512feb36a25b88e9bf819db0e925ed678326d6b9a370b9cacb6c736570e37b599c13b939e54fcac01deb8750d7f798282f275b645b37b7a36386e6e953ac77563bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2d85e85062b405ee8b747557e02747f
SHA1cc95601ec381aadc0ad25f005b322b6ab62a5b7c
SHA256ea22b0a080dfe6057b19a0b1fe45e0e10df9ce8a9edf9b4277686704da391173
SHA51251d72d909b8577166ec412869cd0864f9637ac97116298b08ea6efeb72d7d9eee3fc5654cf925292f66a4a8f4aef8eccbe50c6ff6d09df6d70044066cb4bf049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd4ccd0c73805f9e3375e212733a8565
SHA1367464e2bd9ec0652b8fc3b86eab7a5ea1638dcf
SHA2563e2785b2fbbc26ebf53a9371c7fdd2089e93e4ff7127a1c410b4110774a38e0e
SHA512bf48a0add1629d7dbc1bf0d9e66ebdc68c53ff7221d2e7671c9cac9a97a2007dbf65df4f8c77ad942aff7f1cdc59dae0e5b1572af502d39e1c073387262a5ae0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55de3247568e5c03a74d29e55d8fa8a14
SHA12abc77097d0da62bfc47e120a9e1d3495c53732b
SHA256b5b1af26baeefa5bd71d9dec69e704a078d457634f34ccd3deb38981f08d1ea3
SHA51225cabdb7ed284178d3f500c487995ebe02084cfc95d039e69c93c9295216945a16a81e489cd004c412ddfca1405e268c16b865791297e53078272720caaa7b2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adb4f43d2001296bce4ca1fe66b1c4d6
SHA1a86eaa0598c546c87012ebfd79e6a3bcf908a744
SHA25615b8e7284221b43ba8fb403b7ec1f48fda9931e039a650e7f9d87758c5f3d369
SHA512ec5c9750cc42c6e465e6ec1e07aeeee496b22d692a1b1d2ffa663d96b9532612ee5b7578322e8151953d5814e41349f8ba3ae5b8e2408cd90909715c2a39b6c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53074c109f232d220e93bf878edbc7d03
SHA1bbf2aedc72ac35519ac0e913fa8a2497d9bc87ed
SHA256a1b58fab0d61fd24b1b7748265fcfbb01655729f579b617f3b64069dc0a7a568
SHA5127a69dae56d244f648b6b63a8cb7d847b0f640e4f0c3bf377b30b90166f14a44f031f34e5c3bd974112183954bae7662489f1db878cd2ed5dd4c7d89bfd5288bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56435354646ee821e54192876f69f70b4
SHA157a792acd5cd0a891b6279bf3f1307834868e8c8
SHA2569ea87c99024331f9c2f1457196145063583c7872ce4a7d89d9582ede70edcf3d
SHA5124896efaa8a610750ab7064a56b1589aef2323c2845ca9555fbb831353d429c32e68656a09a473d046204113481a611f97912af5f82d844628720d32dc5b73d7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bbfe2e5b76b9182b09b77071539172a
SHA1bef2bb2b3e8eca0645276e0320320b33db0aa09f
SHA256eb64556096498c2e9775480f8beca6b4ed7663c9e472db112b5b40e74ea1f170
SHA5127d3f13a3f4e5efe6aaada38717d6cb57cb1f2cd225f848a8e3db197951981805621f733cb141c8bfc703cc01dd06f4f95672ceb3bd6a29e7bf80aca7856e6c6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4283ed4a30ca3aca09b0962d17dea75
SHA1966e93140c04c9bc5aa90d4522b2e3a27bca7a22
SHA256b8425f3611b85235e106122bae82c9eb3e63b23116e396422470939778b58f75
SHA512cafeba0b734037d37e58628143d6a3047fa4583c8ccb5db2393da69a052ea03e05f531efcdf6cbf222e206145a243117a284c1d722cbdc842e82cfdd00f744fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ccccffb754a0680931cd6af4cf0a33d
SHA175efdaf071122dd2fc02545b752361f60f9444ac
SHA2565fcf9010f1e427bfc15e86839cbfce4c98bab10cc8ddc37d34e7c57ff2e31911
SHA5124e4eacf85ef112824a859ebe2c16ea87458f6f2510ddd0ea7c15903b212bd0d817509a1f3d3a9d1b0d3452f2c067c5921d892846141a23fba6deaf9002030945
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7a916ed724714a02c61df170f1e360c
SHA1248dd6c7565d3f6d7c4351b29bfabfd44599bba1
SHA2567bedbef53a0b9246980fbbdb03cd33d6025235336cb27f00c57aa686d46c0101
SHA5127804c28b0a069b74e2bb9bb0fa8ee193941caab976c7e8453bd18e2408aacc44960a86ed9902c01e63593002bfa7b9dce7177d252f60af019e11f0f22ef10411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc346d39bced80ccf76936a5716d629
SHA19a5d0c9a7e712bdd8e57c4ad3be6d859152f9a15
SHA2562879708b34f100f910ddc3d35836b25fef0239530f83ca0033f8c57520e194f6
SHA5120ed4db25f049bf1f44ac3f16060234b0b5c95bdeaa6a74d65750aec90d47f145a083110d3f24fc84cc873b2c975db60bd3f3356a49b27e8486bb1c635205a4c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1eaddc8b454f7c6b2323bd6a53320c4
SHA17720e4d0d508318499bca815eb9e0deab2638e67
SHA256eb40b8cbbd29e1201964ab5bf135727edf1cb2a90c1e9bf27fb0e72f9bf4da39
SHA5124bc7018a2b5b714ea7e8835a46946b4a1753cb5a2cc88a2c0e2e2c32ade0d79b0cbaa77001b646fe07f662bc0428435889bcd620591b8e3f6af2439d696f2f9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b607d1045e3f4470ea70adfef5ad7134
SHA117b7823883a2315e1b2154dcc22caa51a32b8bb6
SHA256a9f4c0ac5bc26ba4b5c8e8526ee992f3e0aa660d9f370de40dd1de0c58881975
SHA5127d14ab2e1b69cb2aff34db42f4a6f89a2a51a674caee90e53020c496bba4fc239f63904660b92130d99240ab19ec569846c433c1b422525786e8f8880420f29d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5562c799ddf02702754d7863bf997f220
SHA14d3f7f59c258cf02db061d333a8d4632741bc588
SHA2562a3e94d7c4c97de10dcfb33faeba622181ecd881c34c5107a2daf0e2b8d1c37c
SHA51228629ccaf1a9a19fabda2cd07c968a58426455e988a6f959e27acf172b9dd2787c1a6c3f658d61b7b08bfc271f4850454488e80aa5af579f763ff511226f8354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c2c1395640eb884157824d8cc9f7e8a
SHA1100c2a0c04dcdc2138468901ad9e55e0ba64aa65
SHA2563028aa600d4b609623d60fabc30ab9f6d3f288f223b089be1e10deb7b8f669b1
SHA5124c68d1fb4dd471536a1018761b0ec0a3d78f78a51976c586351d28c4a380ce577a20a988b074e144075ebcb999e6f0305fe1415102016000f365d2078e481724
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531569bac1291555ab9605bac862dc8a7
SHA15a4481e75df03df0ed39abe4301b8322b34d8863
SHA25613780b9c355088f6bc8848df00daefbf8b7feaa4d4db221446cd91af2336c8e6
SHA512e43f6608d2b56ca4a7e78ea86d9a97630ecdc37c50f679fd5845d290fed5a77d8d8a8cee79efa4fe15488ce61d491648bd06a1014954f7c89cd6a77437daafc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6f72411a5c4817a9558651960c54da5
SHA1c60c74bfa1ed5a5bbd835adb9156188848dbf2ec
SHA2560defbf5e32d68cfeb87deb8022f4cfc58f03014262951677e36b4a60efb2005a
SHA512f48e45a44a39510aac5b363e5698503a1af8a335486f857b679f64cc1f8b03a19889b0db31879481f6ecb885450d744dc94fc04432085a1240e4c307d15ec59d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06