Analysis
-
max time kernel
2s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
7ced71a4579ccd219341bf068a4f130a.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ced71a4579ccd219341bf068a4f130a.html
Resource
win10v2004-20231215-en
General
-
Target
7ced71a4579ccd219341bf068a4f130a.html
-
Size
3.5MB
-
MD5
7ced71a4579ccd219341bf068a4f130a
-
SHA1
a6e0c797a9d970950c3e9e9acc1a98f7994cd8ca
-
SHA256
969656888b232171ac7b63626dbf9ea0fd4aa97cd3ac2afd106cd4f2c4530211
-
SHA512
7d809b14727a2cd074b512a8f685915fc6f9f769cbd97cf7516e25cfa6b8a68ac1fdc5ba32e45cee7364c8544ce365594b802ba45995361805498b633b0e2e27
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NGX:jvpjte4tT6QX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13C63981-A540-11EE-B0EB-D691EE3F3902} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 3064 2552 iexplore.exe 17 PID 2552 wrote to memory of 3064 2552 iexplore.exe 17 PID 2552 wrote to memory of 3064 2552 iexplore.exe 17 PID 2552 wrote to memory of 3064 2552 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ced71a4579ccd219341bf068a4f130a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD584753f60dd3cea481736dfb1a9e9b077
SHA14081c75b55170523c3211a2e9f393eba8a01f3fc
SHA256dd4c24949998d467cc348c929af0eb945befb347ab6b740dff6d8e4ce202c083
SHA51273524f3e229102114aa6aee1feab83edf3b79654cf8125a67bc3e537652ab02906ec63de6846ee592a77ae2aeae4fb7fc16e19d85a5f8cc302a4944a881c2809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb65179dc1394cc98876bca5e59b9be5
SHA1e1596ba04b3073001b719adc3214f38c56db4aa8
SHA25698dba3251fdbaa86b7a4b8b2d17ef226422434a23e8a1cb371e6b98aa8b33465
SHA512aa93369e2a369c6b6e8839610341e7b32550157181178d6bf63688a8829f62aba235d6d7e7a831acba928d2c35ff0c477a22860d6c1b8d1c64907598c1d2b74d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aee41392783adc4a1e77a9e5d30229f
SHA12914f070a308e7ae54e1d90178c9954d4f69f69f
SHA25672a47a2e8cff90876a0eba839c334f255bcfeca2893ecea27cc2425d4a79be57
SHA5121d39f4b7e0fda7a0c7a891b75e96f5707ec95b516bf4f26d016fd66300d0e8f8d9a49509a415c77c0f2e1f5b1a10d078372893320beee8cd1fbba98cb5000e3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0b508670ec747c564ea6a804d6605a3
SHA1d0d512f781e74c51e611b715e72f38d1fdf621a4
SHA256a9f353623b17632961ed7d169db4fe09091c2fc929beaec19475a4d4ee335768
SHA512ad8d6f01c56d3f446662f813bd7e543b3adec85aa7d38f37115d22e0c26b6334bc22f341e89a83a235b1be1778dc94880adc0400acd2005b6db7358a2e616647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f49d4492758b670730eed32bc510c73
SHA1555a33d62baebfecaff49a71d34ef98dac6f4f1c
SHA2560864efedaccef864826d7fd9f7b7d356149e4cf91ef2428389c32a3100044c7e
SHA512601eeb2ec59c5e45ee47f18daf018a7cdb67bbcc78b3571d32139e999e10bce2e21256b2b1f38ea17dfa4718e6d73675d789b48d3e1a0da20add60b6df8c9477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5433ddfc1daf8ccdf88a7f0605724c648
SHA1b2ec342b769c4d9532c4db232cf29cfbacb3ad9e
SHA25689b325e59a066a3b4e46520f2c7652823ebc874c43f81a0947d0ff1aeac260fa
SHA51283f276b05138be564c1d017264f9e8067e1a833a799ef5ae3c2014837f68abb60726c972dfb984dd4790cb926d6c74ecc0346e93a65dc6c2fdbfd02630acfcf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b84c878e2c1a7e6a4874c798c1aacbc
SHA16334677f2240f88d20f96617343f478734781c39
SHA256628b79e09d0592e12b79ae9cbbdd3182a057b04a0dda2aa25b47adf3758f0fca
SHA512822ed0ee9d302e2cb9ab6e1aad36274f4133955252a5a04605d4fa010fd011f48d926bc62690e30a83d406373fa742fbfb29c1d4b65d2e44b610ad5ec6967bd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c790a5d0975d023e41358d08cb4826e8
SHA12d425f2c6f7d4ffc35c1aabfce075d9e48a5c865
SHA25612646143b907941ebd7df808f867317e90309c17c809a46c39d30cfd407f6b25
SHA51285739eafa68c52e82924ffb3c1c88372e75e2b95709cf1bd2faf6803543c9018fbb0286f76a155847bbd85a980534911241b3bfde2edf8aa39ebfa52b1f59815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a237dda6641c16c0734fead554edd4ee
SHA1e14e01f756d20de7b7486fe1ae903e10e7e0f606
SHA25659abe654b78cf0d0bc3493c1ac11f6fce7131673789c523855f4d34ae4148d7a
SHA512e4c5cc373632b0f372b2950404705170060ae3a398a016a2a6a8941b10a2ab60b2820219d7883679a43481aa237624530fb1791c7b5725dba9aeeb3714688c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576b265e62201fabdea2a1588b0e9e729
SHA196d8c858bcca0a45899c77053762b455ff1cde0b
SHA25653bc6ff532dd26f56ed265c908bcc944eee704639aebb7a8112faec7bb1a0fa0
SHA51226ae75671b9f5ede631ee4fa43fc76b2f0705fd88d2cd08499cf183ab8a93710950643b94f35004a5f62f4aa7ec164627717ac5508dfcf7b8254da795c426ef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53393ede22572827e6118e44a8c58b70f
SHA127486a6263a0f12a8e4b9a5eeda70f2a9474d362
SHA256675737d23e93aa9739aa5859f942c2b670ec64167976df5a46341f2ef176c466
SHA51231c4ec31aca6d7885f89d1ae3cc076158606755c41426f915441c20a63a9484eba8b638df9863f63d67386cdd08c74890c4a874857a89c81727e61474b72d4a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a194d1186e993cb71f1c546f717ba17e
SHA1f2ff0a7bc918026a2c268a934a19e66f78dc6770
SHA256d7d2aaef9728b04d14cdc6623e13dc8877bc5af04b17bde9034ef23623bae134
SHA5122b5ba52d9030f0497835c418471e8e66f04a75ed1ddda5850f1a1f2d56b9f0c8ae68fbe34eb85a1703848e5d588719ccf8cb9e560d05be0873149065a68f7afe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564dfb555eb35f1e9e5d8ba1ed2241395
SHA187c5224ff9c9755c974781f965fbc55d0f383b5c
SHA2560d41c4f8c5017f68ce707152ee11e1e4966d183a9e3e5db2eedc53b4482d22bd
SHA512391ade1df313657aa6ab10f2f187116a70c50d0daeb1b5ece2c17ffc0749327e989dddac2898520e80a16a439df24eddce671f9914b40add6775f4105a0793bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c676653666a49b1c5f415b5b865c53c
SHA1768292c93812c9a9b06a4ccc0d5d35c8fc28548d
SHA256dd07bac494655b5a0a53db196016aafe22c3a5994358bcb9c37fdef85073e511
SHA5124ddf7e0da510a0951ac1fe0b34fd4dd1276a577907c23da2c8bf6c145d19cef8b47e22092b790bb833b36ee9481fe02609729552d28f94cfdf969b3fc52c9790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b54961bdfff046c2ca575daa155bbd5
SHA125c7c7145eb7d503260886dd31961f1b40a3d738
SHA2561d8310557a2a1303f63bbf5a00b726d12053e25082c1ee42e1a51bcf2858551f
SHA512b38de0ed97b148cf3ae4b68f4e9b5697b35756c45b209fb0d9206a64a969cc90c46bbc16b1a771382d4348103162a8a88f346811041c686ae0cebba281d9f3d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eeef9b1d2fa8c563b0759b4804876c72
SHA19e59dee746cb0b6b476d6be8c97d4078b2cc2d32
SHA256bcb4ec44ccd4eb141284ac3b3a405b3a0d3cc9e2b57a15238b8a850eeb9b0a9c
SHA512fa83e9927e85a8daa480baf632973d8e8878ae916f691371d7f75e3ce91f5e295ba716d59e88265a366e823e64c9c32ea1bd446a2288277ffdc47e7a300f8c27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfdfbfd4a8fb00501bbb64c3f2c31aff
SHA19fd4ead5165d94e323606d22a5dee047acc5524a
SHA256d49860c130a7b80c198fad0c2493cf3053692857fb962fcbb5b548e1abd5ef06
SHA512da060b2a01755b39b34649341de6a0956545e1829f274e002c743d40b00f6ae7d5b78a021e9aa1f1dd7460da4c9daef8fd1cdb040287cb0b7b4ef53da664b389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572edab4c3b899a5f10a26459bd1ade13
SHA1950503ea1c8f86efad69f07b185224356da26f87
SHA256d59527cf41b7c9d9c72eb5f9652810516f10db66e012728e2e84a9071a38de2e
SHA512f27e4d2462b8b1e421acf93e732a52002f51bf2747eb32bdbc442bc37256d8acb47aaebb9e5777ff3e70ad1f895ec3f7672fb5e58545e9769e061693bbfc1f0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e604e28ee7699b9b793702d2e9412bac
SHA1df0e21d4f77c19a130a0174e667b5b31793fa856
SHA256912b921f3218cfafbee48f61d46b685c482c31153dbe645034141da112ae091f
SHA5121340ba21f584b0c73c146c5426eb43d71549a43bc464ec96291a12908dbc9a6823f021c1db20f690e5b1153ec771862e5a8f4d719bf6892127404d089a689f3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54da21298e838917632a3e4e4fefb1dfa
SHA1a127e2d4855f2d3814a5438f6ad86cabf4660ae3
SHA256325ad06b798917fb866dc90bd36a6792dd0d20b17276c665f9eaa92ed6cfa389
SHA512fbac7f9650c151df129ceda52457a4b53191b511777222f2faf01d9e6fc33a876a5e7c3704b658f160aaef982f947e889f88b025a020029d1f7b4c3906bbbeca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD555e029ca26226a0109118b5e9617a7c5
SHA1c66df729612e664b11688ac22094ead1fde72ea8
SHA2561e71421fcb9d4de110ccea2f188c3d55f824ce2e1ae112e15b8b086656aeec4e
SHA512746b8d268fc8759dc390f1c1c00cb78b5f3cbbc4e81d07661366d93c3dba826a9745eaad653569ca8585a87a5f848068ae7dba19ed4f4e79b95d716b4e1dfe0d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HR0ACVB3\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3Y681Y6\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YC3UDS8F\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06