Analysis
-
max time kernel
128s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
4578fdaa87a13404eeff0c64fac29af0.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4578fdaa87a13404eeff0c64fac29af0.html
Resource
win10v2004-20231222-en
General
-
Target
4578fdaa87a13404eeff0c64fac29af0.html
-
Size
5KB
-
MD5
4578fdaa87a13404eeff0c64fac29af0
-
SHA1
875339a14aeeaa919e8b1f717b2d3b8954ae1e35
-
SHA256
dbf37d8e2bb3804f1aed514fe3ca1dc39a02a8f4e5457e6f5927b20cba3f3ff8
-
SHA512
6cf40f1e57aa522a10a04a17694beddc899e0255289349ec60473b98fa79cf84857f9f4e428342b89a7c9eb5c32ea4951dc3d555a2dd2f49ce5a3a183b75fc47
-
SSDEEP
96:Xyi2zmotzpGEpaEphpApQKpcptCp+scyTnyqxTx1sZRbcZJ:iziotMhus7TnyqxTx1sZOr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410337156" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000002a1e374d862b8a713969d678962d11196542443c2920f99a6a440904de056c6c000000000e800000000200002000000026409c985b617cc901c99a06ee5d8041dad58727a5d743fc63abbe484d2262c390000000b35e4bf893cc78c92a1271544cc42cf50ca518283e8b2d96ef06330f2ef5675fbf31c93a114cf1d8a43af30419dc5fa7e2268b56043e96bb5f76150a5e7ce7ab971b5421ca31839e004d34a49236f30d4d0d20eef7c1aa84973d886b3ed096ac27b490eb0ec365c0812f02d6b07fc81f2e5b9438bf1836d2f2fb99b2b9f870268066623488b5ff996005ea48f08acad940000000ad04bb0ec7ec873061f97254c8820450dfe8bc784c84b3905c5cac7c181726279c89de9008728745608ec6c6927caf0bd86d3bc31744dbbd7d0590f13933dd79 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DA68BD1-A934-11EE-8C00-76B33C18F4CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c4e92b413dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001eed033ca703e11e7032252d5766a17bd73b607aae04e36df07af1dacdd1b8b9000000000e8000000002000020000000a20a363ee66d12ed70c758a4d2377e6bda1a0e053e9936403c6429098262f39a20000000de89f098cc79c7c2aa9fe1ccacc0cfc270ed11bedc722024c46fbd241b3c062240000000518d6c159875f34b6488d525ef34889a2a70c6b0617ece1223604bcfc9bf3f7ffbd7a75a50c702f6f09bd3f0ab3838d1574507c23bbc9d5142cc6cc86f573a8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2740 iexplore.exe 2740 iexplore.exe 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2660 2740 iexplore.exe 30 PID 2740 wrote to memory of 2660 2740 iexplore.exe 30 PID 2740 wrote to memory of 2660 2740 iexplore.exe 30 PID 2740 wrote to memory of 2660 2740 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4578fdaa87a13404eeff0c64fac29af0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5128dcad69abb7a008cded5d95614f1e4
SHA158f66b657ebceea2fe24eafc2181de012dc579a3
SHA2561d307dceb0aa4eafe1cbf543a5900fd587d29c4210c8e666be464af0d0657b2b
SHA5128df267158a5bf14c0895a86042aa649b1b5cb0098e5871899fcb653ab82c8aa5080f61b597d0cc57b7a28e2be1938c335d9d350702aa8bce4bfd48a7f199e3c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552b7e9bfe766c45ae969704095ad6706
SHA113cc136c0ab826a7647f3dab94b24828aa43ea8f
SHA256e47e39e070b1bcfd2b363c1fc16dc1c83d59180a8a69223d866a6d68999dda1f
SHA5121e92691e5ea3fefa559100a3f0e29558f126693b7f02f57f36205c753a5fc99399eded8b5ad37b9ad7f947baeef999a5453826a91186c2b1f7dd9d0340238f22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eec040696364582009280eecdde7ab4
SHA1e320b1ca350e69c9af1170dd4ccac1b9a2983b0a
SHA256da947ee81edf0dc3217d95eb64a419b145ca83040ee4c18c8a47993d21649fd0
SHA512c9e87c2dfb5c7184ac7a876e3f6212722055375c8a78679438d27b150f12cd6215b175dce1801e66756e08f1e315974da5658be6701db0658c30976ccf9a221c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1b15c844f4bc856ef67ef6e2e50567
SHA19f132042934bc0cfade32d328e0ae207410a8aad
SHA2562c9e9ccff4340bc3d063e23a83f2dbf79cf520d65b28d3b85d949ae1f1e3b020
SHA5126a8d1904d302eec5cd558d6042af536ddf7d6f524b27daa4e1c30e3435680a4f4eaf9d6cd3f38a2b9749e8fa120a2476e150ea4fc9512db63d7ed0d7eb06e9a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503f7ca341a0f3a14d57799d5e44c752b
SHA18989db581f0ef252bc5b45ff913be4ca926e3182
SHA256d62f949980f1c298353a0f06bda897f3afe5d971984b9c579db8f331c0403264
SHA512f50e3a3d2104ac4bd319e632f1cebff437e35a30291c4b4a2ad92423128e1b7a96c9514ee112a7033cfebc3fab57f3652e522f88742cd617d0ebfe0464e2c379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db0fd112fecf50b646ee2bf619397f30
SHA1f19062b1ca05f20aa4c9853265ddc7738f33797b
SHA2565bdb35744ee1fcd7caf3bc85d3f613c6ac31adc31b839481dbb2392b7bd91c29
SHA512452dc98485c64a599a1762606c9c2a12a4dce3ec3366ef08e411ce6bdd7d3c69e3ca8074553c20e3b0e0c83e8ad787338c4f32af89fb63335577731e790c9903
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5808a62c4f54cd5e3ffd8f096cd25b559
SHA14e90f5a4362d386ec775ebdbe290c5a5ef73a3b6
SHA256f8c61d430f5acc8ff7414e5e0f1ae9b8444bbd6366e71394b7317681dc9631f2
SHA512e3540461f04ae514451c95b27d4fb5c1d748271da2bac7a1e4b127aa27a79d7337e2e8284af6d12c03b00fd477b252cc8ab9fb6f5eb5e491a7bac6411a338ebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5768a549648063e9977957a5e208bb1ae
SHA1b501f4ac2e8a8aaf715cc18fb0a48bf11b7501f3
SHA256c632d425027dfa883f4769354f3c3f37a2bcd27081b5f78a5a5d83bc243cbc89
SHA512c56286a2ef0b2a699d0471c66fc74f952af18aca46deac5d803fa73979cf24b6cf40d4db77ba5e8dd06ebd232f38f7e4b3955e38a3ca4845b10b9c2ad6d46be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd4bb27a300072f62cf43b767b773735
SHA13b09718b653c2d0e6042242428f4a03dbc92bf2b
SHA256c1ccb95bab6c47d9ba4b90097b288a6c3f904dd2d97f8192e61ffbcbe566761a
SHA512cd37749b57ec6e61c73070b74f4f5bce83d6752c1ba3fe16b24f447e8bb32e713bb0f2c579a808e5d689d04028ce83b8fee4d9be5d04a526117a4e618e1ec41b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a8373aa07a1afc82b461b2e3abf8ef2
SHA185065d4e02545587ed010e15908222c950818716
SHA256218d027df0f2d64af6782cea9e14326e2826fbbad5634352a7a13179999b4022
SHA5123b0381ed4fe5cb0b8d144ea5126b50f56258b69b3d9851b3c674338eba352537e48b98af90b47d57741f15c77f90db5f71cbcafd955f55b316bf20d0b4ce1aae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572fe044f730de5fb1269cf2d2b9cc2dc
SHA167868a248d1ca290be97b32579620233ca627d7d
SHA256b72a197d40db92b6ce530adf0af3316e85a5a570ea5fde5c7e2d4847909f27b6
SHA512fa7554dd732584596de40bd4accbf371edc0aa9b124ab6f77a3cfb6412fc5ecaeb5b9d1bd855ed56471576832a0edbf13005cb3f62c320832b081d357eb19c89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b116c0bb585dc4fe3ab35f5fd0d6f009
SHA164c76302c860582c7550bf37e6440c4c126695ef
SHA256bf8e8b225ef5c2491c0b85ffeb2fe5a81ac2f3dd8777ab53c8ee1b764c0be5b1
SHA512cb5fcd3dc2f525321c194b97e03f7b1309199fddcc799a5de14c03123eddf299a99ad4f65f0f63120d94e72b955f14d7cecc2e55faac719e126e6811d022be58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1768628fb53b568e4cd37f0f627712f
SHA1b2d3be89632c6ec409c4072d2bc34c9aa43f7620
SHA256239163b6cc5c2cc789f1faa9683babc29b5b5b11a4c5e9333e8103cec18a2253
SHA51292834038fc70a6d817f0bad248466e4a144d5538044178cfd43b1b992bcc301324f3253708eebd1baf7771bcdb5b8242970cc59372b7119575837af4808d2142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502a6cfa1931d4e73eb702a525c78c852
SHA18a8bfacd813f045f05097ce1da36d838adf717c9
SHA2564434c8c0b5505f32af717c8bc094fda9246183c54984fc984fcea1901a9b5dd6
SHA51291ecf59b23470f99fd946cbd2945a3d0f345f15dba4c0016b8cf71e3cb0a158c874f4b48bc59dfc22ac9efad0eaf82b5e42b8d9a0fdc039aec0936b45cc5ecf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcb403976319fd48f2aac172aed2da79
SHA1c54fcf739f6c79ec87d48ebda9d98302debd4fba
SHA256fb634df5ba3cff663b168aaca5ec6e2a421673e3c8e6389ccf698f5c8557d35a
SHA5121872650acb643d11dea91dbab9f710eefbfeea7be0e19829c25fcca9ac5708940251ac7f29bb9144c18857858350c1d58d29dc83ab1a83f14c2b0056f7caba72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c8471fd31ff2a255dead58987e2364a
SHA1b089050c8ee8cd4051de16c951a3d240428ee591
SHA256fffc9d297377a7f6a7bfcbd41c2d991663939dc1b5aca5b07086cfecb4926138
SHA512055e34af33ec978b68b68f24b73b0559c7c99b9597c8c6a19ec30fd0060be750e3fbe5225bb21d2ce4b9199314cbeed652b3a98a4b7b9ea25aa7aa1160540bc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab70671e26b6f5bd3aebaa3aeb5d7ad1
SHA1c2a01ce1d0eb875309660199c47df0c6e20f57b2
SHA256587644ebdae07c231b63292cddbbcf08170f878476eac696a11f045bad8eac1e
SHA512fd20d425deaea9dc01c91fc77c6ac16ff809fd8b23873807905c3fe854b1402d1bf9ae19fd1d8c580bd81a0be60eae2dba1d5452a6afb13bb19b0a68ee68c720
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06