Analysis
-
max time kernel
142s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:18
Static task
static1
Behavioral task
behavioral1
Sample
003fb95ca0834569371f02e2dd15dab9.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
003fb95ca0834569371f02e2dd15dab9.html
Resource
win10v2004-20231215-en
General
-
Target
003fb95ca0834569371f02e2dd15dab9.html
-
Size
14KB
-
MD5
003fb95ca0834569371f02e2dd15dab9
-
SHA1
2868cf9f03cc8ebad4973f61fe159374d38d1d29
-
SHA256
7a020e93626fef5c54049d2c7bf9f455cd62cf1a1da2bf66b2d995af31e4fedb
-
SHA512
ca077fcb2fc19b374e96e51240e9a1dcbcebf1bb91f6b2ea1cab22ed62fcc8f7bf3e72f24e8355ea2c0e21196a6efdea32020a01291ba752355375835ea90769
-
SSDEEP
384:qwRjNmcvfMzRFLgtho/greazaMM5x/Dy9:NhNDfMzMHo/gwMM5x/Dy9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6636AF31-A67E-11EE-B3A3-EEC5CD00071E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a6ba4257a25b69af2af5c9236044156c28ea4a743685d0494b01b0428a9a67d2000000000e800000000200002000000017503fd665270b1458be7d0bc09d88c958422427ac705da70488ddeccabec3eb900000004949ad50ea54d6f4de556a3620c701a46fc589a31e61d94b331e357e920f434605c11b21871af86f04f45b363d6fffce7326c7f0fe93c6d412d89501c35e20a234032608d0fa2405451c2f98795e8504a193046f6320f4315f8e5cc12ed092e59bcf55b57476f8e302bab9dd7400f69f71fb7cddc4b71adc0ebe686e217e7e76cb23068ff203fdc88ef1a9cbaa4975ae40000000714aace95f74cd1ead33ec8d54deb8ffa04dbff1f1325c748c1dbd5aa2cdcdf79f6f5fc57058cb6ddacea79a8d241d69b4556271e9c6961090fd9694a9ff8a1f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000203acf1806eda18bf5bc2e7b1aa6d8993f2622eac02fe79b2d05f97cd234310f000000000e80000000020000200000003bac41fdd162b60abdbb8dcb658393213d12742a51ad278add7e3ca9801fef8120000000c049f5dae6839900f87d6d039d62172822038be29a16e7067bbad313d90695714000000079a1c4fc1d8a9a5118b0c4d8f1d89790222e4e5606191dd8ebb14f0164b5dd663a17caa89bdb1541f8e2f917997fbc3060e2f1cc832a0db8ff375d467688fb3e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09b184b8b3ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410039105" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2888 iexplore.exe 2888 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2776 2888 iexplore.exe 28 PID 2888 wrote to memory of 2776 2888 iexplore.exe 28 PID 2888 wrote to memory of 2776 2888 iexplore.exe 28 PID 2888 wrote to memory of 2776 2888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\003fb95ca0834569371f02e2dd15dab9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ca88a4f773ea8f72b2b04b59c6309f4
SHA1ca27ce4420a5a541ed528351b525fc9a616dabb0
SHA25673b59cc97bc48a5edbf5329dd32f3c4bd978a11fbfbb175f1bd8897742a510b9
SHA51258a3a0b71c577d58592621b371c2f51e90cf00cedcdb9adf4c45b7c80d26fdf909b0aba1cca485c9a0044f57df66744c4903c5844dc7b85ac9e09fa16053b980
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aed738d64919a8463ba7336f79e6241a
SHA1f68cc900be9d5ccbd2f2c30ac7a88462ef8d851f
SHA2561988394ffdcfe8d9bd17f40e8870073edc47124f214b7ad044626e991501d550
SHA51281bfa9c35c2f201379cfe394da43a3af114023af696d366e7d65b6799071737b4ea1e2e7b2338deef32214d464ad6043d144c0826516e85d353d44ff18774876
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582fac43effbb1b5284d4bbc84cd8a12d
SHA184af35106ba289a30f469137302958706db5a28c
SHA256179e14555717e214c8360400ec76570401ecd6c5b1a3d1eb42a5187eb51361c9
SHA512807524f8a8c37ba2a240f23a516f0dee0c3424b243d2c03fe6d117d902c017ec166e186bc524e4fa91a357270ebf1414a1cc652ad356fcbb0ca172aa2b75fa97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ff46c7ba6b52606f01373a8b0a31532
SHA1877d3689a146d068e03087bf84590c95e376d7cb
SHA2568dde4c57b14a9485802fedbedb1209012b9b70db6d9eae60a2c27e58c443eaa0
SHA5127a6d4ad39f572e5a5e6b5f00950b96745278c711ac4578b89f50c17aeda74a00974d5d44ec8fc1bc3b030e6d983e9701532b7e3f292a3649ab3a4e712e3d64b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5408ba69f2da004f10ecb62a949bc0886
SHA1bf1766042629d9ca8d11865dd9c97dee7fd8a946
SHA256ce85abd9cf54ae17670007ccb56eae284f9804258a724957db1787508aae4422
SHA51220b3d2e880447922ef911aada9362acd4b33d4dc79d0de0ca61e5e69d3c68d66325e97332888fe6f7a22219737aed09c87f0e11be7db64c3646ca0feb6a387c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522efde2ef43d1003d1ae12a629e12342
SHA1b6caeb540e01216d9731f94cecaf56cdcdacb387
SHA2563894fd3674c9ecf4e954818545bd7d9cec78b8f2d2ccc24e7995b613f8a1026f
SHA512a9c37efe2be9a3e911ff3afeb8571edee9b384c3f5fe978d01249ad9290c8bf96052324b89e4f7f4a9dab8a960ac1d3e16fec0f621fa83071ae68a8966679e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d5787f90fc13c1ac567f489f58f4da4
SHA16c890d0918fd96b04404a1614530eeab3aaf4a0f
SHA25674c2a520fdeb5af16464a04de560ea4da1e532f96d5334dd92f71eab74023dd5
SHA51236696e756107b3693daa0d49e89746b4016ce9458b1b9be5da0f773e57ded3be9f78ff73318d4fc766820672f561a04e328a42cef0257fa94ab27a4d3071a4b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563a5a5e0b3dbfa28f805f00bb66bdab2
SHA1f072ef51b0af38ebe2c3cb61b916e336eb18c612
SHA2566de4ea9916e18af175a51469f58eee5a1497e91924e5f75c64feb2f1521bb088
SHA512eb196c6996424073a8ca4060506f269bbd7c97a0583793e4e07bcc21ee3ca68ec540862b729065f34812816bf2ca1689adc847ad5b65aca49e806ecf8ea9a3dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5ef2c94152a035a90ae7338b54bf451
SHA175f4f02ac24f3967746c199e539771e6e760daed
SHA2561f4ce155a45805a9494b89273c0d4230a4495de458e1622dd66f2f72c7768fa8
SHA512d8d56015c3dd9d19b65f50ce17f6fa87613abc909752f9172ba207bda1e32fde440ca26c8e0a08afd74355aa9e6557bade42fe1dc3d51da4eb955d3223e81ba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543409c16cc44beb68c30b45ef4b5dd93
SHA1eccc2dd681fd55f10841f5ffb4d9538ffc172511
SHA256797e063b3e69d3465e1d94dde31dfa9b38f767482d352133f59aaa9fe49f0c2c
SHA512df98769a53379d920efc289695c045eb56cb15aa52280a3608fb6143fbc39a3789b0ec2b07d396caaf68a86a4c74815336a6cd59c0b10ec80917da2c94c1c462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5496a22e8927d89fcb08088fe56f184ec
SHA16983ed8140121bdb7cd3c26c23bc117949ea69a5
SHA2560d8e3f71123182089e074bc1445ea593fdff9eb475313f28a0476adef9acfbc3
SHA51244d62c7955afa27322e02543ee074a5016639ee6e3ddbf4e5775923eb3a46685fe68ad2ccacf79a8778c7c512c651334f40ff7e381b6b1da5613300f83a498e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56555d3e0bbb3762fbe7f3ad7ed704aa1
SHA1b3204220455d9fee3f9ca4a6446d7a7b3224355f
SHA256134861039e18ba57ae835fc8bb536d831c4b0ebea5376309702ec87d88d044ea
SHA512e196df0128a02bff6464d8a1845682603e6e7689b5da14250bc237c55ed9854e6c67d2f80bc337e274fef92cfb2e06e35e72430817baa94ed23fefe58e64ff52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555916c9eaac4ac56b776d4bd3b9d2a8d
SHA1a311d789d38fcbf127b22f9a036da2741997da73
SHA256bc49f5ee4425d304238c479543558738822617eea67135a9a3865b4cc89ff9e7
SHA512e07fb72d482abc04b97ce57fee0fc963d90437e30e2982baeb2404fcd43c6c944636765555084e43660d10b6d459ad24153d4f2e8bace3e98d06f24c629db16c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585a0b3fc9e486490a193a1c2a93e7e6e
SHA144b4eb0c704bd97ea5af7b187974a9a5d91ea81a
SHA2569252c9c0398c85e708ee6d92cf107a99986614701d5f743dad8078fe972ae2db
SHA512ae55c8840f7dd5ec7892a923a31b8faec8f247419fb78141b397aebaa0d4423695612367cc5e1944e5b4c3addd21f81db72c70d9cda581123c23f2f83236a81f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5970ae9ef3742f23e5f099d323ed873c4
SHA1296f7fb2da6e53e6a62240694340c0eee7ee6b3e
SHA2562cfedc3cf171db24faab1a22dade0a05dbf5540b9c8e58040ce117c01d1d2c87
SHA5125d374ced1b1bc6b4797cb851d4179be5bf4f0f47dd238194f41553e3fa87bd043354741800cd6f6e2c0cc096724ceb561840e6f370c3dec1371f0c6b01371d62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a264c0b3393a04d0f2121b3c18edfdb1
SHA11532523402f382017e18fbfb1b2eba9a66d42df8
SHA25638b056d39bbcbf2e14a6b0e61a98b68a1add1dbce56b4c37f51f749bc83877e5
SHA512848f73dbac326f2dacef474f4947ef71ed74d4908c6aa8635924b233c2cc757029f657e9d123f5d107c08091f541ec1c637fb5547fd36e2cc04057235dbabcbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559e0257fe047dbebae3e4dc83d958168
SHA1a73c31da28e8ebc9c1d872a4a2971deb1c1ab896
SHA2567fcfff3068866767a379d0b4f62e17cd8c1320cedc14d2cb193b7e0ec3d557bd
SHA512c4cfeaaced658a6a3af06d958a2b0fee2ec2fbc1d3c2ccce6cf37cade8f6d78645fdce9d3ce936911531ec76ef252155fb63a2070e9a94ce50b239cebefa2c5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521ad6139f951f93ea1a93c4a7f297da9
SHA1d01d36a46a6d082e567d3ca6c4851cde48b5ccd3
SHA2569a0bd02d66d9763e24f792803cbf1c18254d8906219e3fb3d9238a66f5d0e598
SHA512d07fe3da0c8ac8970b62a7e945e303e62535a1541fa50b33bf68f1ec8711ad8f13d09eb9a71bc5d16ac32e2eef7c28bdc0ff71318aef06f2ec52e920dd3ddf4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563c4ac6f4d52ff6888ecca3377a66bce
SHA1b805d8b7cc755fc8cacea789686db460fe53155b
SHA2567291fc945573311214d8cea5b1971f564965cc5b49c8e86a85a4375a952009b8
SHA512208a773eaef0e347a5e0ae2a5a88d0d0ca20274967ae5f8af2c2c0006aae3efc25486e1109d230442321e00840cf4298ff0c07ac46e52df30a0d42cc2052cc62
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06