Analysis
-
max time kernel
119s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
6cef4b988f392a17451fa87136443d8c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6cef4b988f392a17451fa87136443d8c.html
Resource
win10v2004-20231215-en
General
-
Target
6cef4b988f392a17451fa87136443d8c.html
-
Size
3.5MB
-
MD5
6cef4b988f392a17451fa87136443d8c
-
SHA1
9a7bc5ced0b1aeecda87babb7870159c38608096
-
SHA256
15b42d188793ae9fc2fe9e84cee3550a14d0201570e71d80ead3379c6de87f65
-
SHA512
e8ea846442d82095dc4a01c9b92454125828bc027b4b49412d489865e7ea55f4ccb1086ae287f3f83fecc4956da992dd2ae8cdc1c33abffef78c9887673d0bee
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NGt:jvpjte4tT6Qt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007ee888151bc45bf79022f9cfe57b5fe6b1f8dd814476ce94ac532aebe900f8db000000000e800000000200002000000097851300318d08a91326082aa16f80fce71786f5841cc102c9d0686c9baf6d8f20000000c629ed6de6b8f42079d9ccc0aff4943b3aac78ee2c07097ff7fbc8504e8a2d944000000010a3059c68977fdd95829166cb11a19a9e4b36478394e88a7ce45fb91ce4c336e409b3a6febc565c1565f3b93135e01e86cf69d67fcb7f9dd28fa67429de4174 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409873391" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001e860d46304ad204b6da9e3c847695fb1c1eee5c3dfe6a5f7f076875cde2b9f4000000000e80000000020000200000001afeab7a166f91ce76b7cc626ef9dcc2ea33c1de2068548d7b6f829dc8ea034d90000000148685437e356facc21704c74592f905707f569a0541ab44b68ec6bb8790156a10a2095fb75b321a95a1b986b7cd9d2b69d738ca2079cc2c1380f3699230d953ceca72069e5210885ec632c49243cd26632df166045c17d7520f3023aa227d90389d71f788513f381d895520f4728612c0cc214ba71d6a920d5e2f782350e8941b2343e6f2db93d250d29a9498979caf40000000c247eb1870acd4ce4502b5e6e6f0f677a16999a395972d643bd3aa10ab0e0d035ab381ffde2fce18641c4f9ae343d0d3f41e30d67afc1bd9855e44e51d26675b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CD5FCA1-A4FC-11EE-9317-F2B23B8A8DD7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05c91800939da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2636 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2636 iexplore.exe 2636 iexplore.exe 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2660 2636 iexplore.exe 28 PID 2636 wrote to memory of 2660 2636 iexplore.exe 28 PID 2636 wrote to memory of 2660 2636 iexplore.exe 28 PID 2636 wrote to memory of 2660 2636 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6cef4b988f392a17451fa87136443d8c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b73d338287a72b9f14dae421ebdf87b
SHA111604ffa8363ed820188895592fc62cb73b5ebf1
SHA2564b891fbaabd02b8799d96e9309e36ffbd96b38657d68309c1bc010b7061ff5cd
SHA5128d40f34fd85dbc24ec9c49f47443660ced3a3fef5d717e39b023e0b623dc32dc49b869d029b08fd87e4f58cae8e55a4157381851329c451938047f24b6470ab7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530fb10ed5d4659350e8a45db4d5822ef
SHA15f3ab3a162a7665a53355dda2b760910846d93b7
SHA256ff0462688d4e7a960672d3b90960a5c111868775ff7394bd28d52e5f45a719bd
SHA51299ad656f9e8aa7bd995876a83923b98d873f2ff6bfa733eab3960005372403225d1ffd26def57d087ac9c12f576d1ff570dfb70abce41f193d7de3778dd20264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554b6daf7cae0af77507e76e9e0a08ec8
SHA12039ac2466fc8b0cb393cbc134d75173805c2a91
SHA25669aab06171d0962de4ad77502da4cb3639943a0a69323bc3b39a5dd86630bab7
SHA512a09867f2cfbe73f489fc59e04cd729c2db1d94f791a847859dff6b42b53376e59288cebeb7b323d40cda143bb274972de72d2dc34097a6131e524b595d2fbfb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f727b86b7a49cfce16e117273000817
SHA11adfb1f195913036b71744bf46e8ed2a20132c6d
SHA25610d975e91abe8ff4d7c71a3d78edada85e37f944b45f5c0c002e3ef6b4a9dc6e
SHA51203e8cde5daa85db89b9f96299f325fba542b84fb97470cc289adaffe7a5eda8dac2282350e516f91b856100a65674b0498000ea93d0b3deadeb165f2da70a0e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561760f0a67b64f32b8958cfb6f0aae64
SHA140dedbcf45170a910668757d62558bfbcad9d31b
SHA25684d0722ab55d75796be1bd21dc6c57eeca0b82ac1be5ba876dff09c3fb460ddc
SHA51297449deda65252304de7df3d8c782cf90b1422b9d7e9b792b7390610a565ae53122c58f35773f89d9ca39c402debb6727517c9f360a2136cc2b1efb57b719519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f659eb674b6569f98bac27e9d84421f3
SHA10ba76feb2e818b803c90fa4c041960fbc90f7193
SHA256c95e22680b54340e73b551f10dc12ad1a040010b8650b61f00c462295d04403c
SHA5129086f4251af008b313ff8e2f152140b413b92df1bc719e7b81c29bb1cb3f535eba664e47432cf4f6fe94b6414a2262f903c2ed39c073740a74c9410bde1d5745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df27412c64f9c2963fb422874f016b1d
SHA1afbedd3f071dbf0591de3812ba0663ab5ba781d0
SHA2564467b5a43618a873967d344c67621b5bbb7f1b0d7530d363cca2ede0a046a4b5
SHA512350263a7389c5a6d49309c8fd2422dfa2cfc4b78b929dfee5daeecbf06f210fb98aee52b4b711e09b1a52fabe15a49044b8f3002b8dc87fafcc0ecb9cf814dcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa6587675f0e1ff026ff6ec813a01f4b
SHA18ca3895cbc833190f9d9924e7ef59366f007b4ac
SHA2562cf685e50b4f09de4681198c79a8e932ad7b51b49ad59c800f366f324e90e2b9
SHA5121c7a3927b746ab25426fb23e390e2528325220eee2ed6ec50d56046f605b6355291bc73d4246d4ec47bb0b5b170575dc3fb4ed37629e0027bb455b2acc6ca395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb30ffa4791b359bccc02cfd82071298
SHA17f4d8f978e184171a11f00e681642e6f0e0d74f2
SHA2560fb718822aa4fc6bf7cdddee603203714d28c51d0318120f213e20751f077bd0
SHA51256d7a116dddf1992dc46bf9794c5ef8eb88300bacee20aea01796d5d91a0810146080943d3b7924d56a3ed6451d36b031a11b8d06cd0a4485325331eef7fda25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a3a4dd13c32cdfc73db72731c841ad8
SHA11df8a46ebd2da789667d588e9a879ddbac4a45eb
SHA25633369f3496811642796af98ab9f43f8c82bce302727db3f70321f09547a73d9a
SHA512a984a7f7ff4d1f02bb6aacb943a1d520afeb5c6dc0632c2ac0f25ef5655b15c40bba576b392f265e470303fa76d111ac948b18f1306423b71eb3b2e515d066b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57304d024692225c3e5dbde3747cad1e6
SHA135d1c3e5f4d1ba56e47d19260a7c9e7812228b5c
SHA2564b2e0e8a78406c12e5446ef99353d255ce7f7cf6927cbe1741e00bfee823b100
SHA512bfa31a2d84ccb3e6e6b7b1320e813cf34a518b713490fa3a3860730f28e173dc4f5f83f7794a65885982ef58b60e56177bc6016413a6f52a948852c7c15ac162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5704542a9ad6fd2dc1f86cdf3e218a766
SHA1e5eb592ef43a54d235406787303c830aff8e582a
SHA2561ce6f8bca0012c48978568693e7e7ed05275133bd7521e019e8a17f16384f16c
SHA51243437e6530de3d94ed8fc725cab5fa8bd2575bddd76c60c9284da4b68b07583b0f58fa9e56f27db35df39c73352357ba1722b2990e70599a1e3ba0282dd3439a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5197f5b6feb9151916b81c386bb87d789
SHA1d6ecceac5cab515a417c6ab5ff1df90fca83d3bd
SHA2563202ff42fcf5b467c7635de25c9d56c6c8d4db7388291621b2379d4163f7828f
SHA51242e78b6abd67a4ee7d355de87b6fdcf62668cc951f3dd73f19242bcadee5b713a98c14a787ac8cef986eb21d99f2ac36aaeffe1f78044c79da0edc1cb222f9db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5078913ea00734174422052beb90a6e2c
SHA1f701ea5ee184ddb007d845e1348a8892167fbefc
SHA2565c9e01c993d20623ef9b928cf42bbc26505e46493329152d6d874d43fe0b6a78
SHA5128c435efa18263a0a8db6b9e75fcc6caba9c21717cefe2d5cc228f265ea6e618e45141feadeef68a57e24aa23b4c5a276c8cd7818b978b6e8b7e7a1de4dba7441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf221af08d8f3a0aff93475be9070dca
SHA1b2d2bbf85a18f3454b00e19acf6e726fbbfec25d
SHA2569645f0fcfc028454976aee719cf564c024a548c9bb6db3bd07d92f166e45044d
SHA512d89508c1c0009dc9e5b8f6676d2ecbad63cf773166da5fe8980e83cf1864d2c03f7db8324096d2bad422066a403a3bb0d340e81fdebec91562dd32b97c5ab169
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06