Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 15:37
Static task
static1
Behavioral task
behavioral1
Sample
797803385b15d9de3693d5fceb0fe715.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
797803385b15d9de3693d5fceb0fe715.html
Resource
win10v2004-20231215-en
General
-
Target
797803385b15d9de3693d5fceb0fe715.html
-
Size
9KB
-
MD5
797803385b15d9de3693d5fceb0fe715
-
SHA1
5fd620d17a9939d0d1f16acbd8dc5b8aceca8290
-
SHA256
e727baa9796d5811c793488466fc6c66cefb0cfb05c7b2ae7fabb602c345a573
-
SHA512
616de90cb9b8cd30a3d93acb01699abb5d02054bcf3ccd1939a8a68e593c64d4d6576ef84c444b593422f87e2f582277c2de7ca2c6a505a8a5fbae3b883ada6a
-
SSDEEP
96:uzVs+ux75LQLLY1k9o84d12ef7CSTUxGT/kjgpdJxq6WF/xyVp9elVHcEZ7ru7f:csz75LQAYS/A6dJqeVp0PHb76f
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5039aa693e39da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b64d0b688b01692296f09b0d65ce136c3759967d749db36f2f335369dae154c3000000000e8000000002000020000000ac8d3f015cc7e62e46c1ae24c58c2197e7382db0cf45e6e29e5e71afdd17576c90000000753e291531ec261ff52982abc7312be184a8c0af86953dc951ad3cd24b746aa6ce9c9d87345cfc186484f77072751723cf9ef35a2b43d8341a592c85c3da46e6827892c1496a987351a2fe1a3cf9b04dc57ec971b4a78a1e4e0af1d78b498f706e0270186592864403b84e87b71d5484f9932a38bed8333aee88c62f79606094b1b4ffc438a3779fe141bed3bfe346b940000000764f1d967d50468a98fc7adef00ec7330836e09f7a20e43a69bfeb3e5d5ceb8ece92a91684ee23bd1fd9db92ac1fb047910163c38d0482000babede6a3c5da09 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409896153" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90C5C9F1-A531-11EE-9B21-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000050305d9349ab2c2fab06f6b20bae3bd08d7c8ec842cb0d8befa75b862bdf9df000000000e8000000002000020000000117752f96ecb0d1abf10187c1957cc8782f14077b193a960f9a0f73fa7222c20200000006dd6af75379272a986bacbe10461ab284a5dfb7b8a4c542ebdc791d6bce103a640000000450cd2cf93bab75db39297d20d560efa1440dfe347700c740aa07c11d3b08e66169edc393cd6823f0b42c2567df5b243a685eeb562ecfe275175bbd31968f459 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 760 iexplore.exe 760 iexplore.exe 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE 2204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 760 wrote to memory of 2204 760 iexplore.exe 28 PID 760 wrote to memory of 2204 760 iexplore.exe 28 PID 760 wrote to memory of 2204 760 iexplore.exe 28 PID 760 wrote to memory of 2204 760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\797803385b15d9de3693d5fceb0fe715.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abdfcf8e7bcebc2d820fc360dc124089
SHA1d8d2e263c4f1fac1858c209f657c718dd23f0a01
SHA256f16fbc3ae85c7305b707d1ede8d14cc6e5b66d3f5c5e49b213fa3ad33c06ec53
SHA5121a5b1c346429a76ec9c0b20339d7ceb8e21c67a591f78ec4471717902a42818df46fa99dfa1b0ccf04a7c1992f73a47b7f92b1b0742b234ce79b6fb41a202fd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b69abe9d9b4871733f097d65a6fda3d
SHA13dbb7623c8c228a8b8206dfa5f475bebeeedf716
SHA256d88d6bbc61d8cff5d82b963c50b80da2dc6378a694775f147580a2dd93e8f747
SHA512191dee1fd6f79e6c32ec70ff1d686f2e4e772933da6c5c70540d42670209b37c754699d7b252b2a0b80e62ef4fefb1f4287bb8f5987206910dc71339225b1e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e1a112de33e23053303c2c07c5aeb38
SHA1d102ea646eea991b0a112535437f730417bd2518
SHA2567a3baf6c9740d63f424b1ceb4d886f8f80692efb6e1aa6c26fd73cce68018e53
SHA5120127397fc3292dec3dec4a84be84103a79c8cbe8abf7977531e1311c0c1a53377b32d91c687574e1d66ad8fe99b0f45671a215c3fd8a0705694c9db0bffc6ee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51208366197f2cb1d3f5d2236c1253332
SHA12c08f2bd898cedd6f2432a60105f30bcd4304502
SHA2561bdd33f77cb7504b6ca4f965259358f912670e417bfcef280da0328ee2d6cc14
SHA512d72e4e46ab18c017c922ee9eda4974f612fe15292654b42e1fde2a33316d6e8292459e485958841d1cbd254ea149f34710d54464ff4f312300c09f72fbdb49a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4fc9fd2c985127765b4320a85f41dc9
SHA19366e5d81e2e4e026e15a4a8bdbcb87bb313e74c
SHA256a00e124fe051e8927eda60a10aaea520bafcf78f311cd59e500d71dee71fb4f4
SHA51296e92678469316a7b477206c42f00e6c181d5bb6f076577f2e5c6208be4b7f0287486c2cae98306ef7418f446f77b964934e729d7584cf544804e0fecdc622e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a07e1f16418662e7ee701fd6d59d697
SHA1b816648b6006a189dd8ccb863f837fb80cc0084a
SHA256b1a7e1d04efe6847194bc7ec07ce2c06ef53c007762468cc4cf13b6aa9fbb521
SHA51222ea06903c1100d4a0bb550e89d9cc546d0776dd24da1861e6b9794c70c1659e796480815fc391b3a02ca3765f2f0e8159dd67186f217666a5b967a41261a878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54018ad372a80de18d330a293bfb05ddc
SHA1fe3250d8c11bd76d79ec046ba221131f90816b31
SHA2562dd368c39adbd1e91f755ff9b0e05223d3281b41b8f519a4dbd033093e01717f
SHA512d863fa8efaf6046fa862f1470627e284645bf51f3a8a199b16bd4849ba52ebe76aa8312b26feed89626966bf8f778ff72c445a425eb5037a4a8ae8956d6f2f00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517a746ce40aa751645ef3ebb9e9e9abc
SHA1660762178c9945e63b2abc29a1843113ba292107
SHA256c762030ac1d2635d6f9297fd1db811829dee24812b4d0db9cb4501ee1dabc558
SHA51262d90e170aa5d79cac024601219739facdbe76a86cde15e4bc4ae3cabebfac2493f627faeef7f4becdfc5a32ec67a1fb6e9a3db4875471a47866cf167aa833d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5681331452d149f2bc9c656fba925e5f4
SHA127cd196d47ab6e793924ebc192da4cfc19cc9952
SHA256a60329043dfff78037c65e59613fb85a8bf63518c7067c83531f4f72866dec2c
SHA512c1cb61bef2ab72b2aa15b89adb504fe4aca55f7b1ddc725ee53e6f435c336f43c2e0120fef389c29d18177b62eae593e809bb6518a3ad269c8c394e6a13c5f76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de709821b2bc96f0a26d60bfa0c16d3d
SHA1d27783e9b5aaaf430c79409abdf86f49d70ee26e
SHA256f59e9a439b093221b3dfd975c1c52a51bbb327707825bcaa74f627b16f64cd4b
SHA512864953789fb03e8495350bdd4ce14bd14caadb8454f4db310c45951f7e44ee734aea5858da08d1228f7f560531db0eb54588a87a976acf21c89579b08760eee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9028a931bca065f7b2bbca22144f856
SHA139eb332fddb6f019848fe3b094cfc09d4b4e1f8b
SHA25678cfe34d94a0c8ce49eede9f9eaf01808ceef221dbe114295a00b931bf36c3e1
SHA51211ab2fd2284ac046be709a661f9777cac732e1a9cc46ecc5c814c9bb3ff430827f7908d13ccbe86710605971948f2d615e632a10303e8cd216fb2eedccf06631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52828e377c5bf3f82305df3e11b736a4d
SHA10ef8e016eab0ccb1e85087e45e4b8289651890ac
SHA256df3be84ce3b68c851ca2d9bcd3555955673563830ce613fc51c4eb5567ae4ad8
SHA5121e4a875d501bc5ea206495c3573ced8b578d22eadea8b381f85eef90c55a3dd70aef55d41f5bbfa29a25133b39f30e6648523ac34acc081a5dfdb92218df05ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6dc90b76d1f9f27e8953cad59d85e09
SHA15f813643f7aa0803327d793f50fa9d9562c53e04
SHA25637e156e25ef7b1c8127ef27dbbd847ab99c522c4837640dd3d0e50eaf9470479
SHA512aa338229117cc1a609461022e67a5362d3af74cea7ac9501fa48a6a94c87e8c117e5f47d92c8d49efb54ba1895ef63f61582449f5994831cdab2cc82351f3276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ec74707d611c0149a82aaa9ee9080bd
SHA1621b48103147517480a7209def0cc3cee6c98a65
SHA2569441db0ef6854e65f110f1698992ddb047b5f7600f99115fe3a4da0bd6f888ea
SHA512502c3e383291aedf70cd4f42a38fca68c9f7a76454a53844bee232786fd74d64fabbceb96e09f9baffdd5e7731492c19c57f8398c00163f78321d93fff1dbd6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536b8d6c4c9e51832ae192163d07c4920
SHA1553586b04f30f5ff9b1a2e15bfdb871bbe74450e
SHA2567a581a0b8dcd65a7618c0e7d029da316c849953324e8166297c7cefd6a808e21
SHA51232869b82c2d054047f6c479fa860f644186f0f57c6fff0e0f342c0871af5abb0e2df68e369724adda743ac98d6f1d2247b5339ab5591e77520a3f4b1f94399eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f65989a5f5f8230a1a4fa15e37a9b5c6
SHA199937972302c1aa6d791b75ac21974f012368705
SHA256a9fba6f369cf334450096a13b68909d280417bf450b2e7b1b9ecddc526cbbc64
SHA512d841b838864ca0da9a6f6d64358883092c97c7bc3fe292f5c1fe79496ac1dd8e511588a100ac6ebb28bafe1fc590374bbb3524c05e7a993e343efe5a7e707b17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef33ccf1709961bc3cc996fe6478aa72
SHA147685867c64963dfff3b6ece10e9dc8caec7953c
SHA256b5d613b3c24cefacf8d3a1307b923347b1f66a8b3e0173dec6812f75d17a2f9d
SHA51275967f4137816a3c6ab55e31766e6ba1235cd07d2390ad6598b85318919d9e344e401e3f74cb4f0b8c1a0ebaefc179ef44d5a286e101bb879e270006d9619ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0cf60ee35a0faa107539d4191a39e13
SHA130755ad1b76038a9d7ed19d3fc30219c6ca18d32
SHA256081ee987f2d017acb5226d823a757f505ac7f62d264a5be766be7a19e1405886
SHA5123b191f59a0068a728aa0dd96a9e5e0253f95d78a21ac22268f3c15eeab6472089f51a4891c53c0352bcc4b92f7ff67280a17024f768abd21c49e0afc95590c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592dafc9f429f26c654e2890c9ce4b837
SHA133d5caba05cc41e7da3bd20c57b6016bb6bf208f
SHA256e8bbcc6abc067fcf2aada6f7c2f9f02429de85689d756c99e5483d1dd29df644
SHA512c4e390feb75a4c2b2281e6c21a3868a4ff618c999e50a4abe0532264e52c649a8453280b1ea492b818757accb7229a53368de8d63cd617a965c5a542763ce67b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06