Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 16:30
Static task
static1
Behavioral task
behavioral1
Sample
7cd42d45599b7597686da5e6d653b91d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7cd42d45599b7597686da5e6d653b91d.html
Resource
win10v2004-20231222-en
General
-
Target
7cd42d45599b7597686da5e6d653b91d.html
-
Size
89KB
-
MD5
7cd42d45599b7597686da5e6d653b91d
-
SHA1
91d2b660d4f24ce9eb775879e5f4fd957ba0a776
-
SHA256
013565f612eec496f53c422047d959ceb20c675269de81c2dd1de5f369dd8d64
-
SHA512
f563f22bd64a6b3e2411df5a8e7cf1b45d9849fc6d84536704b2496da49008238c1a8f191eeb61a3d7a4c7cbd43c0ca041514463b814cbe7d5d7101374d5b7b4
-
SSDEEP
1536:MIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZXYd:PXY3MNySDHJDITIlWga3L
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fb5d686fd64da71224c2dbc49362101052631947e138acd56cc146810d4e2193000000000e8000000002000020000000473493dcc4f4d3aa4a9e2936f1aab04ce5c41315b7ae0b02a7b0c5fabbdd772320000000a6744c193e5c9d0a0d9bb8dad0c6594c2bf666e06bfd60c38103069809e06809400000001f76a93973098820b72bbe782f922fad7063b59170664d6fad9ba4897a22caa6290ef4366dcfd9f3444c5d69e09fb5afe7536b22ab2c9d552a6cb8f3943fe2c6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409902138" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81265DD1-A53F-11EE-9840-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007120f53b5eb2e0daf54527dcf820469676e753e4fb9ed761167638f16ce28376000000000e8000000002000020000000ba9a9b00f7afc5af226c3d5e75e2822af0111e93b8eaa02a5fa8dc7a49ab9fb2900000000f19b1c1c22b84c6630333c9c59418a72ad13f29257d817884b65899903ba0e4ed847cb3762c085553892103e0359b8cbca75e260036e50c062d4b430e6eac9b234081b8c844afcc504e8d19313ba9dd7bb0ade439be5afa5687b8e83bb814d1195c2df150b9ba67f79ad176c787116923f85831dde21e0ecb0a866d386edc39bfde50d38c0c2bf324603b7ee7a5aae44000000015208a84bfc44f8610a11cffbdcc0584447ba0eb8c62fdf83d7e6d4377f78dcd751a6e11c6af5c1be7278439ceda76d7e4ec1411d930693f01e7474dd66fc1c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01890574c39da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2128 2332 iexplore.exe 28 PID 2332 wrote to memory of 2128 2332 iexplore.exe 28 PID 2332 wrote to memory of 2128 2332 iexplore.exe 28 PID 2332 wrote to memory of 2128 2332 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7cd42d45599b7597686da5e6d653b91d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e17f6dce7e491236660675259a9177d0
SHA1640a70dfa477582693f9e2ae723af932bb57a234
SHA25630511915225f602b90d31dd697a1faec5f395657ad963fd33a3de8bd499e353e
SHA512457f7a16fe00c9b1b43736a20eae5b979266ae553004cc624e419d748d2f953b767b791f1ebe084fc035a4282b207e19a31d666e08b22a285002702a32fd975a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ecfad5130a708d2927e2fe4e7c686a1
SHA1b16f9ce2328ce3b552297b690f54639c33389d0c
SHA25637605d0a5c9a7c1c8259bdeba79319d6ebcdd60b074b1b14144b876e410e46d8
SHA5127263eb29037261ae130cbfb3d3f4e4dfce5a5523fcf97bb4185c196740ec4bd84a05a588676095e88f626c8f80cf9c7611adbbb762942abdcba0fbeb9e05e5db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd6a13edc4047d08b47d9c8fa6ac2a2d
SHA143d6fb6ebda7630e428e3d5ef2c59e8c7d7d7aa6
SHA256e020a46e3eee7774b5d57a35ffbd389dadef725f3ac31eda5c19850b7e8c5fd9
SHA512db158ca1bcc5908c33942277973bef47db06d9dd27ebae9b51c9eb67b3d93a45eb4b5375f5631b9bca49b8972aa09a2690e4b768fdb6178cccac4d612af89ba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504b8259e37803fa13fe5f8346567f3a5
SHA1e3de1d5921bfbf76191bb170fe3f5dc6f23e51f5
SHA256d69a15376a91336c2ff73d0250cd05aa95dab407134db17aead921587e739a80
SHA5125e744ee3dd411ea98f042793cd0e89139e87b9e7002fb5743d51b5eef87edd4b82ed8914c0616f4f8538ac92a25b95f5de4cc9953725b69ab3c7d29587fc1aed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8800faa6f4b27c423f0c24d1f4ac5f5
SHA1ca4b2da50516f35c7651d18cbe374ccb532e5b77
SHA256e8bbb15b56daf8b66b954b747477c043df9d896b59eb24eb23e5852229fbda9e
SHA512e26d055307e470ea84cca9f5dafc4b116f0875a895c1dafa384cea76464c7360b29541d81d89e0b356075cab41a808efd1167c02044c3834ec701cdc161d7cc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561a0824ca3cfd6a0a53bbb2c0c46da9d
SHA1b92f266deaa60443659194242af6a9bb99317db4
SHA256c82c4fc181fe347543d80c39e5c711b8ba04c1fe3f12818c2f12332bf9a32132
SHA5129b37470f969dc7a99f676e7596dce7cb84b715c20773714c6e070c6978bd8ebaed45596e41f1657953667ee3dc0e0a85118f324e5778b5032f5795ac47d4848e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547916a9fe43a96eaedd00f277d0a4cef
SHA1c87ea4350d44ffbea31764b255bb7ad7aa7920b1
SHA256a26ed03e9f636fb7ff10a96ff590ceb4d59686f252bfad0224b589927b8813e7
SHA5126dc845d5735e3279357cb7bbc5b3f97d80af95823ed59c069aa7587ec08721257e03e3e387707d29fb007fa2bc55fc7428e47099d7c7be6205ce9cc29a7ac099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a241e4807bff150a9363165ae4f34e92
SHA1d6a7a4247626a1d684c2caa51733075f6de2cfb2
SHA256a18cad305c557ff4f8992ea11906f5773ff03f5e75efa86280c45f67353f7924
SHA512c72a233f233e39c4665a76f8b0291ef176935a3fb45a879bec6264198791f27f9f5a8cdbb306d6915bb284c97686c28dad54ee00f18522161db0f00927a510e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531f01087d2dcae0c4768e6262bc2e159
SHA1c3a97808d6661d0a896e4e551927a869df42acc4
SHA256b4fa92460de724057d7ff1fd1a6eeaf090e094f203f371e4868a6a54981ce95f
SHA512de8c996bb14f6ec756b5be0dc4aa3c71f04958a97fd8a43b3fdf52f7ddbbb72a589c4536bd36250b2946dc8e8ed935050c8094808969c3c58c1c26e3b03f81da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522796239600d2bf31f7364ef7c0038d0
SHA13b3a936cd4f3e3e5579ebf95b195d0209abf0846
SHA2568bcafa3c96866044e2c9e2f8b912ff78d477d06f604f8bb4ecc3d412a56a89d6
SHA5128f54c4cbf356452936d02ba257b96b0f3faabd25c54ec89a06a01b0aa30ef374e610985cc33a893a5976fdb978e0c62b2248927f42d6845e1e4b00c0118e134e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3718cfdee711d9b1f3054451f19ca36
SHA1ab6f8b7e94fc522a003c67de17c38832294ab634
SHA2567f7de9bcebfcd8cee9398871a35cfb22b61d37236a05f64f07440acc7a988b1f
SHA5126da91f24210cd769110edff0c2e3b5051d00ecabf310b841ea422f0cebd1f8a9e05656f11f8abf90062c55845c652048dc2b81054150b5f1da8cf36c8aa3b333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8b86d45559b4019b3a90f82617381c0
SHA1b686184e31b040593dd227fb233ecf60dee819bc
SHA256e99837bc60955dc347b73b8f85d5d94da98af025557b2e45fc86df6bda33098e
SHA512bb53935f53b67b15f52f9c0502d98636b29350b4697667d47de50f471f31e6be5a095f76f0f1e0f75ab55f785b7c98c53c6692c4bfba1682f30190dd14844499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599e7d467043bee78c1450db9a3a31ce4
SHA148f5eacbc0affbeff00515aeeebe731faae7197f
SHA256c031639be1bbdee9080755e78238f5371b32e59f19bff421b6d6f2f743aeb6b2
SHA5120adce22b488f3cb552e27b13efc80f255c18448552a43b9b3b44588d1c57fa54283c78b633de5dbb7d3943884b20020f743a521943d798d1702038e2564f8f32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588204dcd34d0928c5f7f4316f9d688f3
SHA1635fd27260b5e48dd4bcca9e3ae06ff04523bad3
SHA256569b0ea644c167dedf78950891cd8f322e96bf7f727cec045a2694760e7aaba0
SHA512e996e24922257d84ba95b0e87773e5d94d47345a5281f841a6da71cae156468a79cfe718792d68ce272e07474c4f9b87e5862d2e02cdbd96a6a5c1593f1effba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d82ce1c1d60a633f7358a67f54031d7
SHA1f7f68a89fa222ed081a28ffacd0ee6231f361fed
SHA256abd30b7b6a769a156f7b0cf668b0ba61fe6f23d9800d9232428a4ededaac40bf
SHA5128a297e74cefb4b7dca31f84fb56a01eb456304ecbb6706aaef5f11614959118100378914291078c294d36393c67ad61cd1657a590534752426f07ccdf3e279aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbd114c66f8a1a1b4351413d91d6c5fc
SHA1f589b51387a47f7362ab3b58267d51f1943b75e2
SHA256332c81ff8bdef01a933bec324d03639b24c4dd51ed1db820f1201c8c366b6725
SHA5127566ca1c4b5f0ea40cd2ab67b3f8b659bc99631e3253da906eb09a3c9c4fd63c481d6380f96063211e001684835920d6787adc6c96d12b59de978c3964a270a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5921f9429249ee04e83c1c862c4e92f6c
SHA188a58fc9dc25334d03cc9648fcd6c4ba560322c6
SHA2565fa55bbc2d3eedef7bfaac123fc045518cb4a4244a66258266b26fa2bb6fbcbe
SHA512b499e4f04eef2108d7c67c039a54ccc3c994abad150afc721731ff8858f6f24e69dfdfb5afdf9f4d105dfbb2c57e2ae09e455f7d941109791a2f1d11a2e5e912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59eec262ed5573e36fa58d62f66aebd0c
SHA171a947e5c22d0ac6b827155a2bc308cda6d24224
SHA25605737852540829003fce774681e22aaba968f01169a8c9d3cec198dfb9a434ed
SHA5126c4f18f7a60715de81b868093c0772045d11c26bfd39870fb4c32f6fc5384bd7d5e82f3da5496384688e37967f9eea4c910d76c12d36e8a6482f0003cd5103e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505729f14f1ab7f2ef73b9ab2c40b20da
SHA17e431e8151f9f0caea0a32269dd3aafb6c29e8a4
SHA2568674e148277a75346e473366e1c4c39d746612bfad988b4f376209a61788b424
SHA512492b3d6e9f4acbba6f32528dcbd52814fb79c9b1e209b536efa974d32d53c88d689d02b72598ab2960a871f0d464aa996f54b5be3afbd2d15ea7809e3b553731
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06