Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
5c1645aae69821c0233f782a35955dbd.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5c1645aae69821c0233f782a35955dbd.html
Resource
win10v2004-20231215-en
General
-
Target
5c1645aae69821c0233f782a35955dbd.html
-
Size
45KB
-
MD5
5c1645aae69821c0233f782a35955dbd
-
SHA1
ed5d9990e93491d704eed40fc2bfb85b7dc57b10
-
SHA256
e40909df887d1384de27cf5d4892b9c93e3c6f864e9eafb274a3d6b520ea7411
-
SHA512
d8d4e22240add0d432e0955facfde5107fde1394aaaed4d9513b1c77351b1972e9d79de123a044d05e5bfb1152642c2ebfdd8f9ca840b60acec5a22b5954770f
-
SSDEEP
768:SCSAs6OqGEVdmKC4qGZ2wQzR8OkmKJZH2JaGRXamidaGnEmehH2csw:SCS96OzEVdmKC4zZ2wQzRPkFZWJRigGG
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409839919" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000014329698f8da4b8a4b0b071f970a131f05d0f190588513c399d4efd02efc2180000000000e8000000002000020000000cbbb99c826cdda546fd32632aedfcfc6ef6ce6c1dc9df8cf0ee863c05d728ab52000000051ff8e8b4e66fbe8bd59c094daf50ce8d9c01d42477f8089fd8031ca9823b59e40000000a1fd602c65fcfc1941f8bf506404e0ab47cbdc6a9e4e6f9ba5699a901546b7862fc66b25a3f5afea693b8d380d4ba27c533c83a1ace90e1b62a307dafdd55b34 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20da477abb38da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000da87c04318565fadea33db781e049cfff7ba1e5861514b4d48bec1142cf83505000000000e800000000200002000000008fba0fee5afb1b109630440597628863e9fe3355ed51a2fb760b6d2bf3790119000000041837b28d5d34f2e7971ff6bf56719261c8acf9d8fd7f8ee2a0030407ae284d2942820ce623d2505c1879d086c970617e0b615fc40c97f424221d69ef4c1b9039e895a170358bdcd8b969b4e0f369a37859974cc397887e70da35bde48213fee587ed96d482d9b84c480eb871ddc89cc917cc42cc2b45cc1f72d8295ad00f01e0695fba8a88958ef342755299afc305640000000353862b721abddbce9583fc682dce95038f9c47bc6eb43e383c6ab685fc83427746121e169e6f84819316051ee85b5a233d22fdc9c474aca751d5a319024fe52 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4D55831-A4AE-11EE-82A7-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2408 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2408 iexplore.exe 2408 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2276 2408 iexplore.exe 28 PID 2408 wrote to memory of 2276 2408 iexplore.exe 28 PID 2408 wrote to memory of 2276 2408 iexplore.exe 28 PID 2408 wrote to memory of 2276 2408 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c1645aae69821c0233f782a35955dbd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1954189ace972b281a69de518502209
SHA13318bb6bf310e968a2fcca9c63f7ab8f0c6c50ef
SHA256d13d12b58527e835f57196038aadcbd4c87d833ca55d8081bddbed4b74aa2889
SHA5122b1c9bbc940937c8a3bc74f267e9e7eadeaeb85ec9375df1abc4d348f9cecdb3169782f45b56ede9acf88f12aa0451365ad15cd45214020fcf1c7d93fb73a34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db8cf93befbbc1e5edb09738932790dc
SHA17578da359972601c875bad8f2149c2d731034cd6
SHA256d7ac6461a8606540f6eb392076cba62887c1ba8f4667b394271358df68d1e6b5
SHA512e0994309416e3f7af42e11caed46b98d212b1fe8fc30933e9db6c5bc9fa324ca12fbb5496a1b421867fc077d3b3a58487487e94136c79fcbeba1f1dd250ecd35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5aab700464d75d8b031199b20f92d2e
SHA1018045058db85eee889da89002cfc095ec7cee95
SHA256f862aaa0a0619c888a36b8ba0d84a45432a3fb32bc87be3c628bc6e1ddae3f26
SHA5128ec2533fa06feefc5c99455c8789f046b6fef9377931c02c432e179813a86cdf068e6f3f87b8a6baa08c38fc0e5a304607bb389a2c996a5d9e219623ebb70709
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54364b7b096cf0fb3cee16d0296e63748
SHA19de196e51489b9b3a77b1a6af76c947a525efd1c
SHA256337413214382a31666afdc3962e29ceb42a8faafd85851ad892005527f117971
SHA5124a7386594e83d858e2f0e6c09743c13d5c4778af8845bab562c0b62e8f2495baedca43c7436a970fd8974fdc53f2367aeb03204fa2ee40186059ecadc4d54dbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5298527283fb8471a2856b4d696223949
SHA11adf82ae2d1252a127ab848b5a4f253b0a85a95b
SHA2566a7a5cacda876cbcc73ad2c0c993df507948de69b2dfc96cf6f0450e493fcae9
SHA512e01fe920cff363eaf7cc66b6a72ffb87c1526998b326ebdddf6ea5135ddbb9eefa5c978af92fceafc1976bcceabe22da07eececd53d29937177314271bc72f84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59db62e455d9138778c9ef45f905248a2
SHA12e4327565c083392eec15ea3beceab3555c0a5a8
SHA256fe7d2c6ddbfe5562c98fefe049e87a58fd90bf5995fc3c91dd52c5df4c0d5411
SHA51249aa22f0f3b15ff00d408c2d9994e62596cefc0bcf7da479c608c92eda696dd81013802dcd8a0020e823767183f699a9ca76c6700cf673ead2f4c1f0e3f40878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f4e1f5ce463bf3ef1644bc20ad2b0c
SHA1d9b2cdb24b4f333456fa8820399988f5cad92c77
SHA2566308802cfa66ecab32ff97cbb4f9a7973a9d3e905698d7080d53077eb051985f
SHA512c59e6fd106673dc1c8261d2f21644d464fd7a01ca5c15ae6013a8e1044799563ec355eee72b451a661e6243ac155ca2b6985b7e9eb6f5bad2176e4676cc596fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5ebedc94d6113a9543c774c2a30ccfc
SHA1f2659cacaf171088261dbd3b9c3ec6c3aca1616f
SHA25675978a2b45e43a6549fb160b3aae53b7c72a668f9b6f32d32157a3c4cec9d3b5
SHA512d007cd05919486a65de69ff3feac3063b6f2765f43717f179493124bcd23c198e74ccf5f413cf78150c6a5bc97c1ba9d26e3d2df63f6b6a0d6b4c9d191f71bd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519871980fa4294b6509e387414ded9f8
SHA1606ab81957e9fc8d24aec2fe6bf75c3852b1b807
SHA2569312a85acf21a9739fd5c1a4eb600c579fc31a6b899100947dbf675bf6f8433e
SHA5123a6bf2f10c1c41d3fae059316f61d2be19546601d3c6a79794b53c701e2467bd9cd3167a3d4d79a8bec33460cb8c5c5b50df908dbc18fac0697a4149ca7f5ceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2daa0c73bca3ccacada7ac09e6d14e3
SHA14557e33a1c9d87ab150fb5e51c5d38db8db26c49
SHA256427afa2f08df2b01b322fbb22d637076abecdddd9cc25975eb394d628fc2729a
SHA512fd1f5449bf9793a62a082717ac80954cbc837c3dbcfcc39867308d289c7a04961b075f67fe545aa1298c5fc9fecde3467ac636453b36b049f5c4e95add77a394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0dd9fe30f291635dc41fbadb17213f9
SHA191e58390dbc45baf6a85e551a2655b782f73a370
SHA25631075a2e2155383dc470b8bb10522ffd1b6d093041175f0b3ff833eb42a73956
SHA51227cf8ba59d93dac3731fbcbc84857dc15960bdfe39d503a117987f20253e24a420d1b72becbaea87858e732e1b30c657653335e22c8c6af80906ac90c433c5e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f1dfa093ba8d1f05fa928cc46f538b4
SHA1f58c23eb7e38e6c93b0a3a42cf33c22d363c2d5d
SHA2563383d0888b674a5de9647eda9a475f2c84d2f16d3bd0e79a6415c970b81e4b19
SHA512221e3390fed00f0f46826d8a478f0cbd842352206e1704007d4126838ae455890e8cc4801140e5d60abe6d0a4c9fa853d7fa3737e998e1b70e3cff7e3510ebe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d2fe72d05bed8f0efe2cec2b850cef4
SHA13ac6faabbb8d0915492716fb47b23d24475f1dc5
SHA2568d69e29077ca519bd0215df6bac278bb3277e6a4ab0dc3b6811788db777257a6
SHA512793b010cc7c373604bbcec2d084d6271d898118d37099ce5414e14f8b57245a65331798b4e75f22d5c3a4831f769f4bb1afcd7f227d1a467c71648162e65d14f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abe3848858dac7528beb10e0a74dbe60
SHA111f516eee4a67f934f0641a167cab986cd00136d
SHA2568b46414044ed74e16b0edab3b23db15c5a3d64b3db41aacc6c39f85afa6801c8
SHA51250127575c0805dee45e98cb612dd06b49af225b574716b66abf68ac7d2c4a5e97135c733843d3401a4c6212631afa1a67b14fe69b4c06b07209a2658c7241d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510ff230e8af1fb2f2269c2219eb90894
SHA1f3c37fee6bb24242c265eab72309f2f199a84622
SHA256559d8264a3b97137851720687e1d8c4cba430a46b6fe2dde7c609a3ffa2ed678
SHA5129917378eb84ca864956435c59fd4bceffc5c8e2d5acc553135a203256ba2e2b28b0fb8f7f8c9f69dde40d490574f0a0df16b50a9577593658ab713be5ed3819e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06