Analysis
-
max time kernel
117s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
7657a3f1f79df9b94fde688c04c95ac7.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7657a3f1f79df9b94fde688c04c95ac7.html
Resource
win10v2004-20231215-en
General
-
Target
7657a3f1f79df9b94fde688c04c95ac7.html
-
Size
30KB
-
MD5
7657a3f1f79df9b94fde688c04c95ac7
-
SHA1
0e3ca99a8ba060529a5be61febb950b24a11f442
-
SHA256
dad5685961e961fb5fa156ce0f96a8de2e800631ca5b6cdf05aa93f961e9896c
-
SHA512
8a2e475664d3070712e04c3ab0413b4ddaf0f1c35a141cd6e2449be9f3d84c383447d922b94cac3f56c001a8a590763ba0116e48da096624668640c730185c15
-
SSDEEP
384:S4xQWDTZddtJxfh8I3QtLz8eScGiE2ygCzHMdiJxX4tnHQ50eoXZvX9K7L1r2pfa:SdWDTZddtJx6I3pbkZx3ddYo6imE0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000b1d849ebd376faf07979234ecd5e720511f172c891db71a3e2e43eaf8bf0006e000000000e8000000002000020000000d5e8748a8c1c02c1e050025a1bffa950410819e4108b785a0ba48a967b6ac6a690000000d9dcf7e2946b5ee8bef315fb1585fab073087c87f97c1b3c65e56446e3002dcbe95f1fa457087247520a7335a73ec597987c8ced66c3bff3f04838881a47a3d9aaa75c54a08a65aa970c211be627cf47197039958336375ce97c78e6d2afe495cd62472179b0acf29d80d01302b33fe4ea24e895c2ca18026857b1fe2e9af5702168b91adf508054ea22f76de535194b40000000f504e808b7727cf8e68bd0f4d2b44bd20c1750d711dfaba94b72a53fe8554cebdb7f760635493ef84934de90e0b96750cae6dd51e52b6c34a6604b510d297a81 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D52B01E1-A523-11EE-919D-C273E1627A77} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909c51c33039da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409890250" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000f43af9bb53a5a61b15575a11b611eeb8f591aa4ab4204dd0e7998048654d2acd000000000e80000000020000200000007b73261c0a838d4b8992216fd369beaaae6f5894ed82e31f1253b3caa006d7602000000062e0c756657e6e05ab45d501c6ec23abfaf6e4ccfb0a8c277447e0bdaecf56db40000000e53f1f67ef66ec49cbebc0e5697a27b5ac3f52b82f1700d6d72716f9eaf182edc24952a9cef866be18ae95f5aceb7e9b7182dfc5abfe73f3f200e5379e679334 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2648 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2648 iexplore.exe 2648 iexplore.exe 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2740 2648 iexplore.exe 28 PID 2648 wrote to memory of 2740 2648 iexplore.exe 28 PID 2648 wrote to memory of 2740 2648 iexplore.exe 28 PID 2648 wrote to memory of 2740 2648 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7657a3f1f79df9b94fde688c04c95ac7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5752c5e69ceadfac4dc133e064ae15c6c
SHA1d0fee4a42f7b8156d4817bedf95fbc362383568b
SHA256ed3403d4e1e6893910f8633f851dd5f9df95e57286afa2a0ac96ef7069f54fb5
SHA5121b534a54fbe76c2e5751f6eb62e6b6dc6c40418d51e9822ac5757392702efd399de50cedb4c3608eb25d0644a4a758e2160caa2438d94a90208f34aad1a1c428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eca18b5e775c1e5111c3efe7bc7b9342
SHA199026a8f187df7b5ebcf0031980f8d130555138b
SHA2565a945de927f8a28572d3093d90bc4473a2e7487a163690a5314408570cc78661
SHA5126c38c21d294cd26b2162e0448a1307f8b718652686767564b0ce419eaa13991e021d842f4248c4ebdd9b1b8ec81a201a1d70e275d49e162ce4a7b773f3cabc49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56613a1e278ec0f85d3680c875a138476
SHA124abdb7ff235e107f95b4e8ca9cec5249c4fbfda
SHA2564c8529601a20bd827a46164fc39eb7e3ea3eb546a9a0d6f72d6b46c2f3cb1d95
SHA512482021ef61d9f6681ed807fb4401f540371114e74a5f08b9c82df1d88c483d49a0e9282967598024adf7e257eeeff53cccb94f4264e33955022195298dd35c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5861cce14f3212c60d2a0d4d9c14d9f63
SHA1ed2935338a720a7d38f2f4d60d37adf53e79cd11
SHA256a35153ddec63ea7cda2429c18f36527f291ecdeda33ecd1a7273964d0ddd3977
SHA512f02591082ce09ff4d5353ca92895b3768955d151b40e44da08328198728ee7d78fcfb731189afe19454da7232655e94f0eca8aa540b69d5aae50bcef0eefa812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511297527ab4e7cb425101a102a38b2cf
SHA1b9d977772e8ff5ca84531db7c49b21da9dbffadd
SHA25673cf5b6ab1019bb3cd26d8b8fb6373675b5561e989038b79e5711dea5898ce35
SHA5127c712d6f22a30b1ed0b3653ef7b5dc961261050c356c2beb7acf6e3095ec52da58029099ef3e75f9d61c1b561c43e5512b2c84a0a4310acea92caf7cc5e705a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59389471c7cf92a1432bc008c96d5b6d7
SHA181c8066e734e8a4c521da45f1c22f67b290ccad2
SHA2560d081d379f711a963784340a4b81de54ab33abb5af0db0c886df4a66492c75a3
SHA5125c0773a15dd34ab0ed9444c524ae15efd3de1dc647b6059d1cd8ecb59286fd151311d4ff62bf84ea35c0bcfbc132cb9cdbdea69bd71fc00579f8107a5a0b1f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d259d4bef91826f4a416a8ebc8304cd
SHA187ebab677848caf8904ac6e20714330557ad7e91
SHA25683db8709bae44139283b8de9e34479a5da999e6ba37bcb7599fcc8a62812769c
SHA51260379f87bf28b34504ca1720cac75b3039ee7224cd7a972d69115c9ea26c534775855ba3c6bf54cb8adbc0b7489d5c856e3e4b0eb709595b57d61333cc0b36ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543cb3dabbfac35de0d6197884924550c
SHA1118a4b560181e86cc2bba25c7e6d379dc4910bee
SHA256a511d05dde0e8471e88fc97ce9e82af85bde2a08eb101ca344c10a2bae4ca691
SHA512c3aa5a4dc3d10088a9602e4944083ba9773291d88c2acf7407c2af4113f41330adf792268222302ec7e2c01c9d8d004ccf912ee7cf475a61681aefb9d17d6d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc581889d500490e39f46b778314eb73
SHA1e0e1446cc8ae23035e0f06030c1b0f6c96e40fe2
SHA256dc4facc21bd21ba897ebc409f2a23c96767a590a11506a9e97305dca7165ec0c
SHA51215d2488cf5560c44a069f13c8519c94daf1a744c0a76f0422124700754e5ffe44834b745c06ab88cf0a44d1d616e5113f926a94ef5e08980b87c86d178cd4515
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5221ade87677b2a4ea88f56f796aaf4ec
SHA1345b8dd699f455e4b22b7fe9b05c1f8181cdba3d
SHA256939cd60d9c5bf7b3c2a67645e5ec3ece94c5aa225c6940b8a4ee63d14551a0e1
SHA5127a66cfcda098128840c775a9a7e2b348cc0c4cda294e852ed3ff3f74c53018482212d96be1c705459595bb5285791ae73fad7d0934fc3aab44e6f84b70215340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589585cbdcedf75471a262bc00e8b1916
SHA1be1445fecfc920eeacef2890aa56f9b9aa490ca0
SHA256183536bb6f3eba550245891dd95aa7fd174d3f7d29ffb0eaee0d099796f0117b
SHA51232c815444b0546cc451043dfd091e2bf80a1e35fb38d2e9dc4c15a2e4f1d1d9d10c289bb55dd376cde24dd996bb138e87f3dbc13c307576d478bfc469f6651ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5e3553a492e0a26e56779fe244ad5ce85
SHA1fef7e8b378e6c961985448236d508071c6d9a68c
SHA25614540cbc064e9c56297f1e4089a655f506b0b2222deecd21952ffcde5a6792b0
SHA512e5a5178183415898699195d4fb9fc1959ed654bcf02aa1fb0c0bfa1b97c3775011ddc8aab0819de444d1cad094861116aa6979e93488909594987951c094aac5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
57KB
MD56203908cb75c93e104b76a1275d7fa21
SHA1f6995d56387034ec2dbd93ba1682af147b05ec0a
SHA256380782d38234ff8a666ad7678517e4b3a18eee29bbdb6504079d4b4ec4b2be0c
SHA51299fe30d8ec140bc6e107319513b0a81f40f52956d1ac1e929483bf0f0d43b89f32ee582feba3e4c02702256c45f32846b5c6695b944c65f30401253b72ad8daa