Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
6bda9e4141c032c43b15f32866a623e4.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6bda9e4141c032c43b15f32866a623e4.html
Resource
win10v2004-20231215-en
General
-
Target
6bda9e4141c032c43b15f32866a623e4.html
-
Size
15KB
-
MD5
6bda9e4141c032c43b15f32866a623e4
-
SHA1
6321eeae06b0fb7e537bbf09a1f49f8f9846ee4f
-
SHA256
7fa40a954cce548841553f8ad1dd1fc289898f64441c7267773b9dba8d172e4b
-
SHA512
771ee3f58238d1faeb299d79031fe3aef7527f6f9d6755cf3bb1575a30ad42378ed3d014ba2d9320bac3cce7ecf2f51f8b841d3d86ed4cdc4cd1f74700d9f346
-
SSDEEP
384:S2t+ri1s8G2cQADv+WHQI8ojq8XTW+zc/21wdvvdL00:S2to6s8G2cQ4vvHDjhYn
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000012bd31fc3bd5413a396e52b1b5c5e74ac512084e4c4165dbba4180883d6a5621000000000e8000000002000020000000957fd395ec817701022924d351f3c91b773fe42b3a7b490a04276ae276a72a00900000009c9f18e3d7defd2e7a3a082fd042b953397a73cea1a1c26516402cb95316a17d00543e085ebaf577a2302add4253085b7434cbd7d1934b49d58ee61fbc5207005a389b4c6822f536290d0fe94176cdec6257a2ec4a459c0ffb79c5c0e4ddd2e97ee41c9923132f8e064ffb1083991340c011bd23702228a4c2f2e7c23e699d7628da426241bff4514461bd8de81450b740000000c8359e85bde8cf30a835151c15a7ff40748275c5057bb6849400b97be482a85f7840b98fbf5d915baf1db7fae8b4187650527eaae1f495ce5a9f78289f335626 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409871406" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F46D9621-A4F7-11EE-A892-DECE4B73D784} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000003cacc2804686071251fcea71a3e04984e8f3a3c7ce31705d95af7c5c47501820000000000e8000000002000020000000131987acbfa21137232437955da78d6146b11ad5e726255829829623c743326720000000a894d3b6a00ea07cec3e889058ff412c424b65853437da7b003b89c03317b2af40000000cb9d3911e78261694aef34edd856a6e81edf29a0581d6db243e4b47f8b7f9abaaaf255969017b706cda83713e8f15d408fea233b2d4289f7d18b659c010be329 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f58eca0439da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2640 3048 iexplore.exe 28 PID 3048 wrote to memory of 2640 3048 iexplore.exe 28 PID 3048 wrote to memory of 2640 3048 iexplore.exe 28 PID 3048 wrote to memory of 2640 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bda9e4141c032c43b15f32866a623e4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f482305d75056974f1d2f9d4090f28a5
SHA116a6208fee1c413520c3c33f8094edb3ff05dd59
SHA256a5fe0bef38d3f603a1e682651a39f2c8fc5494dbbb79a8e775ad3d1c36fa1790
SHA5125b8cb3233edf0abc3a67b8e3aea73b2026e13e6bf446c47e7c5966fb3b1282ab27487bfd03722bc3ae02aeb9d49425066d1e26457a3446797bb80c9ed33c9496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd7b88fc66da637171cc29127f89ec4f
SHA1652c087ad891f384930b844872d8bf0fdd3378c3
SHA25654bb3e2b1f9b73f86c18b873140f1382f537d27f729dfa272724c0ff1c66ba31
SHA5129cbc4db3784ad09aded4f5e8c90a81a71d2f1f7c327c273acd66ebeffb05a1202baf768bc1a80589c37db889c11f6513069d60025d2ca1bc0e6d121194026c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3687d30f9b4296f547596ce55977200
SHA18ac8d4b7c5229ecaef2e34a180e6fdea95dc18f0
SHA256391e6d840c3a8bb775cf0ec0a0d0d9e1d7cb073d7c556b4669b28e0f8456ae2b
SHA512ef61ddab9a07f3569bbc7af0a7fba8bad37fb7a55326d166ae8b8bc33d64952833dab2020f1e7b9ae9ecb0a7fff6a5fdb071284640f6973ad4a9ce047268eeb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d434780f380dd50dd7357bcedf70f1a2
SHA1d1f461323c2ee1d0668a0c5c8b2dfb2383341476
SHA256bdab810ddae82877892b6d54780e2823d6366d1c2f69efb4cad5d0732e83d435
SHA512f492bf00e2720c65d64cca124038448b1b7158fb6659be5401e5cdb1f0296e0c63dd87229b67f8244ed9d2992cadfd89ff7905544bbe963795ac624e43754fbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f915db334f08e97e16e9595713121fdb
SHA115c2bb4a82ac9e681748264130cd9dbb531ae87c
SHA2560af603bf5544953133089ac7185a8befc8e7bd0cf2f4006126ed0694e0c39dfd
SHA5129775f6b3741a7d1abb5463eaa1a132d9dc4c422e126e8106f04b4228791cb4c46f6182d8a9b3730b75b639341991a4440e5f7d08be7482a55816056ecc208e40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5470b93b12ad39ab2857d8d550a6f0855
SHA16c4c1ade6a6d8d80a0f45a26d385f5bea65dfdee
SHA256cc3f1bf67f2cec2aa8cafef54387856ccbe008363471a7d02aafbd051e26534b
SHA51217423a48e785ec479351cdd4958c73869951e2fdb7de93cdd1d58c4fb3a0d7ce7f57e615b219d463f399caa33ac29100b3764aa68f2cf98d6cd1856efbc7bd87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b3b27110355ea33ca9b8c084b2c984d
SHA19ca3e79519571c232a34617c019ec9473b08be15
SHA256434adefb5b1a40f196f3084a579b046690798d90fcc1f330b5aa1408336cb4f6
SHA51240b82a32bc84e78f82bdfa5c5dae8ed2d422397cf7bdd5afa2370fb51c1c52c168f391b7ae6758032c1844ed61c0859c9448272c49fe9ed38df4fd94c608fbbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5971407a9c6f38cbca51b1f11f5b72cb6
SHA1ca6ef56e6cdaeebe0be71e74ba6a0b7fcbbac09a
SHA256c91fab9eebd44ac3df9e17643b8cd8ed473c071f6f7a22da5c2becbe66d4ff8b
SHA512f35bf5ee1271e1185500d028300d4024fb2ebbbcbe497d3889ef14e7191c4197968c6533ce39e9ddf11119ed3971db858b2cab5cfa7a50eb89ddd1265520ac8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c634acd3b2e39c2b68192ac755e0538f
SHA10e4b805189a02c9f0f9b27a1a9f0430598d87a76
SHA2563a3d32ca449245fa786356934df60b4f6f79644798886bf26d92006f23e4f513
SHA5122e7fa966c54541b789272c244aad43988c74933c8227962c5aebddbad2a8b06d908793026fefd922165838391463f04d15182367305970fa778d6f1e0bda1379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582c98565d01c98eb4e5a9588d8fc0d48
SHA1069697c4dbf2611f9b62401b27742fa3ff7b4b4e
SHA256bb9bf6bbb5e27a46bcfcafc8e1f5c667eab24270838e36520398152d86dfb0df
SHA5124a9107a8198cbe9e6badf622d960b56a64a9c62036f32bcb705a398f0eeb3fe5187eb6ce90c5bf0671ffad3d60aa36283d1ce5f32cd1325feb8c3e355c694f6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e80aeb4223c9bb2f23eeb28ab236a0cc
SHA194eb80d2131b51bb370df7b861075584c7f1c91a
SHA256d66c7788c2b1ca4474bb004d730bffa1cea1e3d270fcd416b99cc819467c3932
SHA512a8b7192b204ea3c17776746a4ed5fe5e21d186c13ca9def95e6815dafc6e1f4d87e311fd34661f11f0528ff3f30ba0daa086388ebdd5b09bf2e3e3e3be200fb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558f71fc415fa207d993bff9b2edc6a70
SHA1707e1cfec4d3f0e5b9a542c1cd813ac101db73ae
SHA256d0c2d3ee98aad0a126e66253e8ba5bba0afddad5358a0b2a4914c101710fbe4c
SHA512e95b4f4a8643bf41e80a06afe3c7889e1c0ce4441bbe509fce1967d92f05c7dea280889a5f9b4235b23a065ebb099625810abd215190a86551ced002ed3f3b23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d64258dd74a3533e800f1b6fbd6062bf
SHA13094b01dd411eb81433ea27d66cb9f3f7653d849
SHA256fec9659bd972b8939368a6018cee27060fd399e0564a1060ae5de4cb5a282ffb
SHA512786897e77726fef847c90676d6fc2edeeaac13c324830c334852592b335ecf042f051457f944340a50b1c0c85fd68f1f28db1e30d2524491539fc02e95ef6c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8475a8925921480db055d086f2a5cb6
SHA1b3cd5784390fc33ee1a5183141f444af8846d9a1
SHA256836dae86f68542f54b35d8b74191e32cd021e6f21d8fb02ebc2f0ec55526a815
SHA512c1a8d555c255baef45eb4057387e9e190f8f0e3dd72f147fe642e4b5c83a5321584975c29b27cb16a8ec05b15f167e115a7afff75a58cfd69a56f76bc5d71ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c82208d064b7da0c25cef77ed46b21b8
SHA1ab03594c1842e674d7dab243ad1ccee9938c231a
SHA256fa65296f2915f575b06eca46d2ba389e2686afec57c0eee2a9a243b068ccc09c
SHA51212fb9cea182f949a814822714dd14a5fe7a24a4df6364f90771c69a3ca0f45de0f208aafc2359a9b0448ce3b57d18b2e56e3f8a8816c66c9a760872236c4aa88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d329b7a6ca32221b2161b698c2a0d0e
SHA148b03f0fd3c35eca075e5d7db45548dd99a02faa
SHA25648f0f6940d217b56f3493810b97744701a3db60f0455708be3843b06bb8fb416
SHA512dc05ea454ba61361893e5314f9a2716a467cd4996aae14a7c02719972ef15962ba27d55a2e21adce808ba46473662650ca433a6e9b35f6ae30373be955edb5a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582f1ff6ee31a6ac786d010dc364e2877
SHA1057b4e6ab170047c4d95d4ad7706690f6a4ec987
SHA2568146ffef0111becde7d8b2e6ec53f7dbd88005ea2f46d555286761c8342df7f1
SHA51284d0511e64c817401086a00f4eed46601e31a8c1b8b1c37ee67605f4d00c5de7b9306d965c7814b2c12dc4ee7b2d0d661169b596a33968456c64c760e238107c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dcdedc3ff30898f9319cb270bc01887
SHA16bf711ac04d65cfbd941701342367188a6f2fbe5
SHA2560dc7069bde3e31b75afeab17630262ce1570817882d3357f11ef33736719300c
SHA512d5701f309b1cb787c4f317be14a54d87c99f6232fa5f3ced2928dd7490803a3bd7b4b1437cf147049c16e4b27802f84142aeceb1077a10678eeb29b2476763fb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06