Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 01:22
Static task
static1
Behavioral task
behavioral1
Sample
48fb9f83b313647e6abcbca82024c11f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48fb9f83b313647e6abcbca82024c11f.html
Resource
win10v2004-20231215-en
General
-
Target
48fb9f83b313647e6abcbca82024c11f.html
-
Size
3.5MB
-
MD5
48fb9f83b313647e6abcbca82024c11f
-
SHA1
b54121e88ff1f1b9d3f73f625abb009894fde259
-
SHA256
0d92ebb4c1755780052492847896276c18618f71d2ac2e464dddb0f2052bf783
-
SHA512
fc02dfe670b3f0e8dcb79573fa8914cfcc4f588f0499a2e9b6e0038d6e4bbc46c14a183acdd29661e9b5b0843c8973c28d8bdd6fdc22035f9eb908d432513c40
-
SSDEEP
12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAL:jvQjte4tT62L
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A41BA8D1-A950-11EE-A623-CE9B5D0C5DE4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202d72925d3dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000064c5e953afbadec4ac700e3c35ee362a61c9461ed7b77248d12fe2d07664dee3000000000e8000000002000020000000608ad1bd870ec7ba03f222602778c0b779270349ff0ad736f73c442c79c87ee090000000b556b7c24deb95475f90dfbd9b3954d33cd5cfc175955aba708f46b1ab9e6e7dbbffdefc7e529d6529373bc71e0a532cd6e86d54b49fc837327ff5af22480b93af67c10104e25306ec79cb7d5eb23dd482bb130317ff70bada14c30a9cbbdcfeb87ca6d235918bb9ea84d33119a5f39609c231a549d354ba57b034fdca6aa85162d54f5860a0bd28acb86677ebda6ac740000000b5df231300ca33d41e533778d3e8afaf9c562e33e824b0c80a63f121d0746aa1bf49ec1f163b7943e3036864d90f0e49eb628a04cb703c6727dc099d06560d15 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004e9128c917e4324adc0951bcb938d15b3e97dad688952e8d377b9eefe4d455cb000000000e8000000002000020000000562445cb0c747a479d5eeea143cf850167eae8b02529228566ac19a67beef6f320000000b6e037e568cbd129199fa04257760d3c22ab63529e5d0c843a0502e14c6c3e9c40000000c046eaa1ed7ebe16746cbf73cc48ed5b4beea25f8457a363cac25febb27c2aa374bcecda704eb3ec128a16b32304330a0c21b0a08dd05c8e5cb603424c3c1f8d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410349315" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2536 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2536 iexplore.exe 2536 iexplore.exe 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1604 2536 iexplore.exe 28 PID 2536 wrote to memory of 1604 2536 iexplore.exe 28 PID 2536 wrote to memory of 1604 2536 iexplore.exe 28 PID 2536 wrote to memory of 1604 2536 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48fb9f83b313647e6abcbca82024c11f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5096014cad3ccf77c51d45fd301342b34
SHA1cc6f547feacf0d0fa568dccef5389cf0bd214d08
SHA256315a6a47cf459bd3bdf86407fb5543618cb52d7d3ad041096b6a7e426922c59b
SHA51249b67b42742c18c674a3d2a7fb36c8c41a9bb5a28f0a3d52c1287581bd4c64e1d7ed2114d8f1f735fa15eb911fd71de20f9aff85f440acfce3dcdd850de590f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a7c2dd4005b6cd1d70b626cc8b431d3
SHA178679f7aff5e8ad62ef94365c1e46bd86ff330c9
SHA2561c94b946d10ef0bc4c6db85cd18a4486b025b49f67ad928dbd6d41f859315b07
SHA5123c1f331d8ddfdc222e8fc3ae338d3bcc397ac740d1210c51e6c67b2de8b461da4fdd67aa3c488d621de473a28da805501a3e58dc2a82378deb7be5ce5a926fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f48ee4a49257c5429757017bb53989e1
SHA1530aeb0ee90f67079704a74c7a683e3ae6f2789c
SHA256844642ae32c13bd85bf071f115152d33b11803465ace42b3f391804a4b8b2c87
SHA512f30f5d72f91eb3ebba31524a26704d1efe67689a4514269b4507a6f7a302fc622d90b875b8c2a6b761e7e0997acdfc2d0d435ca67775f983378f9496ed9c6c0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fb47128926b7218419afa8e625d5d98
SHA13747a8566de2feb118ce91f947cd16c7f3e28993
SHA25609c6bb7b70cecc879a7df2004dfe72281a55765884a6d17c623e32a97a5d082e
SHA5124a3ddb8b0ebe37c7fc69d2552e3d58050c1fdabb813e29ca2e5dad3b41998f914d1749a36421e91397d7c084cdc2ddfe4dbafd6724ce036cfa295aad2a275d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595933ec749a0011b1fd607a57660968c
SHA1dfaadc6d9ff54b84eae634a6a0bd33bec1b90623
SHA2568caa7617cd358b93098df998a8567b55fa6f518356918725bf020b97422b97cd
SHA512844cb67d7a7359e212785e47c23ef21bfa31dde388375a1cce649e76730e09b317606a0d3a297924ee05eeff8c5c56b561e1033f1725b9d4f80d17f97d75b367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ece3c8ce0312ce5be4466e596c30af15
SHA1262d3fdd3b0e80e5d80474c42fb3a7e7e5035400
SHA2562db8064982ad9e27a8755ab165b02c9d5d03310633cf4c59a5dcaabf4e23e07d
SHA5121b740a69aa81757c5a267e43cf22fa449f47932911fe17439c36850219eb9631dfdab8c768a03c3913e99d6aed21e5e12853f8568a93a93cfa4c49ece4bd8879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb0097e14fc3a5ef1364911a8f9fc584
SHA1e6889b799564d188b737e3ed0875cb9275d0168c
SHA256201a5792708becdc31a82b819338c49e97faec7ebb22e11a0d5084c2b9f82041
SHA512aedb7f1787ec98d9efae3b2973442443062afda22562b5c392473030513c734f6915d15baaa0e7f1f6026ff688671a65e16e1c6cbad0b7d66fb544246a8fb4b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0b57382224b7296bee44edd2f764464
SHA1ac0d03e0c63b6a169952551c9c7f76005a58415f
SHA256d962dc38de28a2260fbda0b7e64074e2623e606eac1ad9ddb59d4ead10f50684
SHA5123d1d943892393367734baf26858b13f67da953667554ed3b981fc7791f6a8ff3a7548c85d2922d0afbaf5ff74ff0dfd197dbf20d506e90f64bb898ede0e7073b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56205faf07b7b985a6d86713c11b2a300
SHA190e75c5df00840e3c92c821ddb54fb5fff031384
SHA256cee0172c8031e06e1f5e1666f9a2501e915758798fcbdcb63d87ec2b9c03cdf8
SHA512aa02fe5644da4a5ac3abfeaa82ebef7f309636647042f3d179b44fb7385d04d8409697d8077ae35d3669a13f069a22160006ea6d462db062df6b0936bcab0940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5815a6b6456acea3ca0d2d17298931b5a
SHA16c6d84eacd355b2d8ac07ceb3e91507f3b4cd1a5
SHA256b5ee520aa6d9625797fb5bafdc8653be7b7ca7b8c548911e7c227457af8647ab
SHA512999667528a7dde77d6f64c2a4801c89c36f9482b879084d1b6cceb2abe0fcbe9fea33c7a740e7a8d5faf8b94fecb0ca53d56aad37262b4798e224a6902a0bd32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c692ddb1c7d9c0bc445e8605a8fc2908
SHA154694080c19e35b8acb25baf54734518d76bcf20
SHA2569e906c208cc47ea87bfec48faa86c559e762aa6b0dcfdf28b94359c7f5eeb76c
SHA512b1147f52915cce2378d7852712d3df08a44e75e8f22162261a96a4e8a5cf271d04864615f0023408871b9f3398c09bbff898d4f3e180afc60f7b3160eb7851a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ff4c2ca335ab03b4c793ff93349b49d
SHA13b604189da23e253c3308d15d71cf644e848c636
SHA2563a6288d97759c52603526ac4c0a196707ab56c99e9f27b0d8ef8effecfd2e762
SHA512a70ea2db5102d44e4fe77715f4a56348e63dad1c42fc4f7b2f8c22438c719f7e5490cdd47fab6a57d73d42d4225c0977f109f20ff3f71ac4afb2c7e10de36575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c6ef2a01d935f36590d15b58664ef9f
SHA1d4fe2b97d7187e54391d63a2d8d613e8af4b6773
SHA25676bb19b7fd9f3100d27e6a5a89d8a9297a5f8a70de098bf71469b505c083ae48
SHA51293072346e2c7c5477bac89da141161ea7a94f35c7d18406611cd112e304b5ef7a8c9febad3d68cdcff5b7050abb762be9a489fb04216f6c94d57f33c8cd01e9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb05dba80cff605b741f48a522dff796
SHA1a809400e0db76b0add1cb983af0ea29f40f03751
SHA256d17a7ce9aa50e6850f879eb986a68bc99f52c5b096add9166c9c551e44da0ff7
SHA512e6d9e3cd207fb81ef7a97721854646fd02eee977a5611fdef7b4843e4a8f678a74c358bb0eda0f69c9ec827ececd2c4d9678645a13696b217824fd6770581d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd865306f1f84db763453e9c36afd883
SHA17461a35372c08aaedbc0e791b13a177307d05feb
SHA2561388d7cbf6f8a931f84ff45617f6d71778b0c1a04b04b99374b0ef0d93958f92
SHA512dcdf48a9af9a9867136f24ae9780350c93a0703a8db283c3cb2fed17b4d14b3097d7aefeba38b3a30bc92162fec42564e01ae29ce5183283e3877fc5715804f3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06