Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 14:36
Static task
static1
Behavioral task
behavioral1
Sample
76092cc893e65acfa6602f292379c40b.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
76092cc893e65acfa6602f292379c40b.html
Resource
win10v2004-20231215-en
General
-
Target
76092cc893e65acfa6602f292379c40b.html
-
Size
57KB
-
MD5
76092cc893e65acfa6602f292379c40b
-
SHA1
de1a3c980d38328926d000bbc5e7d31acad83525
-
SHA256
e5cf85e93aba4bd52581a09d21bd1b2c079a22db0d5dd105c6ae89bbce9d60a4
-
SHA512
8af36b947876f54089ffe1de7aa7f21a4207d3a5728db6347d55420258d4dcb119b826f4717e5f87be7fc66c26d1dbf2b16d6927c2850f31de961f0b02a483b9
-
SSDEEP
1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVroxUwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVroxUwpDK2m
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00199e2bc440da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410723250" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e032647d7f0a1a0902325f0d90fad5c9fb0707f5be7e40067c0def863eae658a000000000e80000000020000200000002d3aea64aae7a4173a0bac6a2e2c5a5a4f5e599467d161597dca6129aba44ac6900000003f7735793ea92c015b28bc440309ec9855e72daefd233902c497aa00d84cdbc3ed5bd428630416aaaf36cb0f1c7ed40c6a9b847b02f5bbb8092b5cedaba306503406a50d7758a035eb0dfc000228f236d0d0b2540a1faf57598e836f6502baf8b4a15a202a7f5b95d2e6a9b1b9d31c19f7bb671436a3d7bd9425dd6efb3f0c5c3006dfa679d169d25446b03fe511e0d0400000005b94b1063f0d0d4f6e38af4a436375e2b55a714b7a9d1068c163ad8b5c90d135d9518aa7eb26a4403e9e4086510d5ec6d4fd069701549ee52a88f84f10d88487 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006030b712ca822f622ff12d300486b8dbba979ea8bc4f699e03aaf88c57884a85000000000e8000000002000020000000e645df25e82fcf8e71f7246b6f7854e44542643f96c8b5dce8554c36a84653152000000098178d89641713d49a8856a32e860f75fe4853f8837ca6d64bfd3ce6f6fc573f4000000056aa9550211d05b37e99b160f961d1c0d069639f9e004a67df95d3440ae25991467a9e27ad6de050fcca7ae3c63a276e907cbe16501147972e8471d65421991c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C231401-ACB7-11EE-94C2-56B3956C75C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2312 3048 iexplore.exe 28 PID 3048 wrote to memory of 2312 3048 iexplore.exe 28 PID 3048 wrote to memory of 2312 3048 iexplore.exe 28 PID 3048 wrote to memory of 2312 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76092cc893e65acfa6602f292379c40b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD506e141de6557b46ca7792021a054c3d7
SHA171ae8bc539ab3d4421a6bb2e34fb07ab554dfcf8
SHA2560f27ca9cd48e7c30c657d00d8bb305894612bd5b75cc4619b600105a75110ee0
SHA512f68ee3b40a19f60a0dc476a1746579b19c0a02adb8eb632554ff48ac14995a5ed1e6d5636d6079eef5105683ee665b05860e44ee88ed8f424978cecb6df512bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5245ddd3955e8a93baccd2bdc6e7a763c
SHA1d2f6c1e5fed88e7e2427e9e82320d4da89e26b99
SHA256e65920546e228f2616ae2c0f4234149a459384cad0626a410062a219435bcb8b
SHA512d63b154ec2aa821c81213f16c20df7bf806e044b1e5c66e67a9988144d63a187f3d8bcf25516ed3854f2ad6e1d4e45e5c8334936d6c1dd9e08017698c48426f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50069917ca2973b21158f8ceeceb7f5cc
SHA1fe240daedb20b3a0a4da515b54847df9ffaf6d6b
SHA256002bbb34a6544bbfa367b7ad7ac9d489a67cf49da4b4b6dcc85c8d34eff22ab6
SHA5128db34a6d7dfe3e3eedc9b799c5f5eafc99f2dd58df0cd8147ce9fcf69d12649f77a3a4197751be24b6284142cc250e926bfa1836516d3aa354c1113cd8d39a22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5995bb614e3f82c421e610d7bc8f91ddc
SHA166d4b9dcab4d46225b5473889c7c7f68ca34f90b
SHA256b00cb72c40e5d2b26cfdf19600ac1ef5c9dd01293af9b466c94ba467072c7e1a
SHA5127dd646f5a3ce551c3e3e93b3abb586c608cf24815adc94cab6888b220f5e1ffb443b1d15492f2d8fc6b1d4858827f8f5ba2d70dd27d68aca59554eb12c671eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec2e506aae21626c29e37b40645c2aaf
SHA1e481cdecc0e999b5bcb429e86dfdc3374fd15aa7
SHA25602cb8d088b4d55e6f19ed5629146a62f808ed6fa89cbe58ef6da668326b16d78
SHA512355c19ec52fd34fc9355024d86c9ce3e04cb87ef7e6add73382d5e4193abdf5da7448f0b408d10ac9ed26404deb793d3a98922e690bf249dbd0873195b9b9317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56caf2efb11fac954f97e051d60381e2f
SHA160c45152654a5d1973823e11a8ec3fff1369b7df
SHA256cedd8edccf2ba4ccb6ad3f34c74d9fca79d2e4298dc8e9f30f2c53adb5b7d76f
SHA512b8ff5dc127bab951c46320cc815e56d0a4490a0733ab04b88fb14c42270fc4c638a62fc03ed3427783e2f948d9f0ba500de4a42ed52b80838cbe902621418cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2897a1d99450a4ffdcf52aaaa09d225
SHA1c86a16912a46ed4656aaf7ff29bef2090e465bdb
SHA256531a3eca6c13dbcfe47ec68e3f02d3379625ea5f72008a43c0c1b701bbb76387
SHA5125c14d323bf897c8bffb674b1d1480f4655af7ed13466917a97a3def0cec77dd02a6eb938e4b529e90b672bc78547b42f959ad754d0928a4bdfe7234eec09eb99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590910a37277b8a9a5e8fda079ce6ca86
SHA101f4958f9da49040d2b69a57738f6f1c51b324ca
SHA2562ca22884539eb68e6909802b2dc2d550e25c2b2cd2aa23577a57f7b200d1e91f
SHA512654e61786478964aa12c10d0f95e966f4520be9bfc6510a5485827125692cafc2b12c99d65944d65c62fee08ab212fb720617daa77357f85f8cca5af779cda65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1c61520c6510685efb6340ec27b54e7
SHA1b34a95ad72b96e9c3d8d4fff0c2bb12db8346d84
SHA2568ca1fbfdf4f24fa0c8f8f5a93341fab52a43e992e72ec76656d348b64e14cd21
SHA51256b2ffa8940ec57011328abea8c8015534945d3c63e2b1eb775949286a281b961e1e760712cc461b024b37e6abf10c450435ee53fcceaef695f567126ab76ad5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582190be384801f57e72be9c8da3321d3
SHA1155188f1d3fe422240d14a28818293ec9c6bae18
SHA25631925402f3cbd7780d0a5df622a507cb773aa5e2c3a0762bf9a4f280ba75ed4c
SHA512a65f3a021cd7c86fae2da30227176def8d74fef14fdec1207335850650c39cc7ea5cd23d3d124d023275decfd5bd80433e1832d3eb8da0a4cdc02e610d18d63a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc11a2b579a098cf348cab6d86ec0e04
SHA12b07be699d4e7d94ae6fc48d76f89380b3b40835
SHA25611ae6efb6fc52ebb9b536e2740c58ec883ff833e2084f4ac435a4c90e7c39085
SHA5121a77cefea841b2a3d530ad4cc128b215ea70c528692f1797b300735eaccaa767dd45588db4b3cbea705598a011456a145bfd23085a3ff28d254c240e88bc0f0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1cf044437771921d26e6368ce9c6ddc
SHA16a8d859e6dcbe7b4a36eb9ff413f40cd41428b11
SHA256b086da99a8e83bfc136983f520592f82fb20c161233994660ed0f3ba7937c38f
SHA5126384ef1490bb7ce1e508e31bf48339eb2f17e7cd51197431e2e4fd8a6f866a360d31dbf531aa6cc2559d7c72fd917dc91f12872938656cd8045cd45674a189ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1526d39e9413c86145fa2f31707af2b
SHA163be86dad1a3164c2fb5baf04f9c10958e6d5206
SHA256fea51519dd3982a6f9188e532c80f05aaf5b1b3050c18d6883d8f6622e8d4853
SHA512cd0c8b77f29d3bb184a73594bce377e4a0b9dd3aa6915698ee96fce7aa69414109fb48aeea58ef45f0b6442b973cf0ac236a81a8580c8263c5ff2b118b073c26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547452d1239eb65082848e4f7a7848235
SHA153071ac830f2788955653fb6025b5d56c7e02ac2
SHA256196b60c3224543fb37f772029abc4124be03e5c0261b11e2b1c435408a60a132
SHA5129243ca87caa0ec79d80bc127870019c57850c4bf16cd445f77d7ff64e60661a6f53fc5b87dab59491805fe6a9fe87650db6d59c011659df0e0445e8d10fa93f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52362d7b53f31793b08497440e51ea833
SHA1e9334a87305c267907fdbfbab7ed65cf7c03aef4
SHA256b3b8dba5182ae58ff10466a5c47b760462ab14bd3279b276f8a251b80af78d54
SHA512ebc6985cf25d472cf30f253a1d4bea14d76869884f71031f93fbbd860e885c0735b80c7e3ba4a018001770d52a5c6aaa3e637a3d9720b2e6449b203fabfbc9cf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\f[1].txt
Filesize34KB
MD5e1b7c684505a4192732d78958041b68f
SHA1cf91999b7dc74ff18d9750c61e1547f5dd4603bb
SHA2568a330d4186a862f13f46e92f589619f39972cde089a8b80654bfa06598d4a54c
SHA512e6445333e90c06534511b4110b505d4e02a6fa0d05a21e855b576478e357864c5d329f2717085050d1a73ea1e162a0aaed1910d18ab64942c0ea99e70b1a0956
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06