Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 18:05
Static task
static1
Behavioral task
behavioral1
Sample
000143d89de81ba25df9625a6058df20.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
000143d89de81ba25df9625a6058df20.html
Resource
win10v2004-20231215-en
General
-
Target
000143d89de81ba25df9625a6058df20.html
-
Size
655KB
-
MD5
000143d89de81ba25df9625a6058df20
-
SHA1
ee8c82fa993d3ddc508c70e0c9bc934723625fa0
-
SHA256
9a53abb93d094ba3f4a5741fc9530e491312af7ffb1aeda4c3031e770c4db3fb
-
SHA512
c26e334a4c4ac6749137413d79c55a3f86a64deb3fd7aac209e1dc9c671050842eec72e4b6628f7690f75bdb2345b3c3a345855fed3feaca9e65ad385d40ba40
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NR:jvpjte4tT67
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000068467f7c5c02599280b97f100ffb2686bd898f783d132a71a65a30a13dbd418000000000e80000000020000200000005ea9006dad1d060012bd424562425609d6fef19425f4afb69b0ef5839ecf093a90000000f70f81ee2646a53e67507e2c22897a0cb06e454ad9984715134996115ca29f0477d08fbef74c52edd0e34f8a2f26f53dac7529940d00cef4c345c79e4b48830bba685e31a54e7b4d5a34fa79638f7cb1dea5c86ad22975ca356319a5c2f9a6470ba675b1c14c3d11056bfd04ae5981960edf921af92cca433b0cc5e1f6b41fb17722fc0b07f7b0d7ce042e94504b177040000000a940822c1725b593747ae400bf4c2972f8cc38db8487002e186ddc6b8e354a9a90b1a5c73496bd70bd4321a468376d6d4c91c65181f56ca4713c48de8b114a8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09DD0441-A675-11EE-AEE7-F2B23B8A8DD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000bd7517583f6e4aaffd08a72e82aacbf7847e0601d1ce00265b613caf75f0fb1d000000000e8000000002000020000000d1d4b4b8d0c4311f43958de2dddfd88fa4fe4f1997caa016abee420b6b8f79da20000000e115158a6866dd5170a35ce078508ca2cf3a6e7aff84e962a1dba567e99ac626400000000b9ace9b1a61e3f52887072e1e6990cfc3a0a58e0e3c19ddd85e270b3a7c7711bc041734401ef48ae6d8df6b4d74c5da0e8c4696624e03c956218831a76121b6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604e03ed813ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410035083" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 616 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 616 iexplore.exe 616 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 616 wrote to memory of 3016 616 iexplore.exe 28 PID 616 wrote to memory of 3016 616 iexplore.exe 28 PID 616 wrote to memory of 3016 616 iexplore.exe 28 PID 616 wrote to memory of 3016 616 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\000143d89de81ba25df9625a6058df20.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579e498650beae943b22c5e4c864e26a1
SHA157162274f8a92bf7ee76694bae2870079d3f7c5f
SHA256562a8f05e054e154e2885f59f598ac4e7abce603df0eadd86c8d33ce80599f59
SHA51283c5e83333c3f279f7e83ffbdf4b861e51394abdda5714bdb0076e7ffb391cef53b048034f670abb0b1e37a9cd50e452ce899eeb7e1b34c6f331f513eade235d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552a63df205bc8653c592820925755c54
SHA11b38211bb0dcca9e0668028cb925fe6a2f6ca81a
SHA25614207362109eed713ee89e42d30edb6711f1ef26675f6da39a270e2d591a0e1c
SHA5122e95e8392a302e8eba57f1ec46af75425389203f853cbdfc31f3c6acc35f8e11d24c41918150061e9849bb9aade8a0ed413ffc2206f4840dff46c50d4ef25bdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598b164340d6d615cd695759d4c4f9e12
SHA1dc739af6390cc8f3d2fe8f2b0eb1f1093c83e6c3
SHA256a9dafa65c505920ad1abe557af451ac28956eaf9dca98bd90bb42434235e9b61
SHA5123444a564a4b08230769d9cc339ae96a1d44be417284e4677eb52f8754f4898fd461e71a9efba9b10b7967e5e52c6a98d7fb12299669d56a827d006695418fac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555f1b014b94541db3577fc01472bf738
SHA1509a6afb30f45478bafc253b41506cb32bf3a352
SHA2560f8949668012313a169595145b49120f1604f165af6b6ffebd9e24dd71fdec47
SHA51266280f4bdcdd333343dc117ad1125a30fe944a4fbc1822570c9de042a32c0a79d86971b8113fa4a49da12e4c33f21bccb22e7d60f85ef469c46eeaa7f81b0f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55868e65e59e13c0216ec455b21708f36
SHA1997dc0eff9561c1c9d90c1eff9f542a47a1aee09
SHA256b7d85b0a9af977fed24f89e494fbdb6b12b7d0a766b06de2afbf548893b7cd34
SHA51280858167c0800f38722ec40f0f579ebbda45771aae5dcefabae71d2b1503b152647ce23620b8cd57ed721f1618862b8e1136faef589d60d99b00bc02520d2b3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe95bfb8984ce7a5c6c82145fd658e7c
SHA1168ccf6c9f789f76a30d5be57cd93042cf024568
SHA256928a3537ceabb91c207ab0aa0fe8de7aca873a4a85e872cb574539224e44dcb8
SHA5126c25a445a207389e3a367e3660790c57263b46b72a6f3d4ce1cafe8c6308f0ec80211e879ab620feda2934707c7d5966c445f6a836d234bd72c7c0636421d909
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59afeb06de88424ecfa2df7c659e78563
SHA106b7ffb6534c745d2ed0557964058fb54b14f8e9
SHA2560864f64b8f0a0e90ee6eef32e1f8a57d556158b4574358496c7fd0fc1b28c2d1
SHA5121fda54dc502857d9131255f2d94f8e616e7c46380f474937aebecb4914303cc433eb7def22997b38d6a9eeb6d45777d4a514c0d03965cf0ec084a72ffd08f9ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530634fe5c97120eb37797750e9d2eb09
SHA117e4de733e207c0a23b323995863d1f170b2f026
SHA256c63091bba185ba422c9b3454b5b848be0c85e0a07f7e7db8b619651b026fbd51
SHA512aa079421e686be0b075951677fc3ef8b437e38ac33859b6a2a46622b9fce692d50a6a071e1e7023db73709cafbdee24e769993d8a4c18a1b57f7a7685dcac704
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ea6702e003ffbdebe1d4d10174964a8
SHA1c4235f4b429f77ca9f3b388f4f585de35e46fd89
SHA256335f4d9b171354d348f2e529bdba3933b69004df14c4c2eac1eacf7ab33ba3f6
SHA512fc2c70fbc60323f4740d826473c74c2ef1f130e9504a8c3fb44a1ad9eadd7e3bc72fdb4711b851c3e613a9aa09f8f012f252dd378c01ea18b8f3b25cd4b25a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57aa31c712180c7c268d6efa7f023aa85
SHA1e8fe8407ab32471e5ec58a6937b8caa86e6741a6
SHA2569004d612acb92978aafee0b6c50f1750d2c19ddd383cd25ee62eb555a18f0fba
SHA5120a25252219744d4730c301ae7118e69f96f8f1041f3ee92bcc3c9f89cedb283f35aab85ed2f8c94e03932e986e6d78ef87327a185ee0639812d7cc956fa55dd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2b71c699bf74c109b4cc50b73b75f2f
SHA184f22de0a3c64c2b07c3f5ddf65546876a1f7105
SHA256256c965b0b855dd94909c990cf7c9544dafa407b00627c4e9e1ef276cdcd70b0
SHA51284b0ff63dfe996e4bd7e5ed40fa48b3c5bba0c49664be18ae8445e2eaaad29f686279b10dc0bf9076b711ec54804b0239e4284c8be2002c82b5ddb9414e92247
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1561a167b6ca161b96d7dd4b1d8a298
SHA1c0c9c55519bcc67c4aa3eb5898443db300da26a4
SHA256cc5dce090543de26f91da86a7e9ef26da8c411a24b71c511ec6d20a7e82b63f9
SHA512f7e0d51a57673c06f0199d76bf2b80a2960adf042c75b4b6236b630547e0333bb9aebcc8c3cd8c000dfa0f3d4b8403673c19e108006a6efd0ca5c2b6e443d28b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54df8a64f9fef85f5f34daf1edc741065
SHA1b7c4919c90c101aa21cde6faf104c806f261e5f9
SHA256aa3ba62e001d76c835cb77f78777d0f669a27af392e4d8c97b3ad9c9e673ec87
SHA51278d136e88d6cd409deced567540589b1a08945b29abc9412d468c47bdae554b124cb9c4a2cd235a11876b3f84fa23ab78f7bbbead051246d58ec34a9746d4b6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584649e88f49f778c9befa4f67ed9fbd1
SHA16a0155e35ca509a7b3a54740c061d6ac83ff89e4
SHA256e3d663f2b5fc054fb6ba9fa3ed85d35f954c2e4b8d0d9f21a4b17e422a35ab0f
SHA5120e6b6e5cc18d36c5b8e7abd6f9dfe6bd16ddc8f87f3dab0fd8af9ed30fb2eeab78648b9c9e2d7d18188312e2162afe9536b2e0cbc0e6d64ecd71eac3687d62cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b113a77db181dec046c4402340d54216
SHA15573877c2f536e0ce5a8b6df640ecbe045789a64
SHA25608a18a8e9025febcba47e73c4dace8e1e88bbb249f52acc427155576c215a981
SHA5121855d26e38b266f5e872a7ebc227acd85a34b8895f1b9448df0e0010fc5933d86273f9b62cedc010f309722b5940e0dc91acf44de3b1afc17392278c9c06dd52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55212d9a482b87ef4eb1dc54c45b0ff35
SHA1bf98c8c3c694dd28ceae4eb18e231ccf94dabd1d
SHA2569217bd81b7e3cdc13d7b366d756bc126c928d167a999619fb7f01e61b984cefb
SHA512c6b1ea8ffb6fc48146e22bbea18633ab48bbc7e01c743dedc0ac7a0904dcf60e7ea09509c24a3b308119116619f33fb8e8d8794770d46a640bd5b07b9c75a56e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5265f5da7ae806d44c544fa1ca2a62262
SHA12ec9216140c7f026e4435a969d2fc5f3467cfe84
SHA256473ecc59c733b75b6531b0ed6e6d1ad28ee9a0c02df75524ce6bca9984e1aec0
SHA512842fd7c699c809c0cbb2cc9f12a33c8c7ed0805554d0edc8df9184e3fbeea9328aec70d0ff5c602486d3475cfb2d20e45a8c14950d2e731305e7ae910db03bf1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06