Analysis
-
max time kernel
161s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 19:26
Static task
static1
Behavioral task
behavioral1
Sample
01ade590a69832687b4b1124026ae9b3.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
01ade590a69832687b4b1124026ae9b3.html
Resource
win10v2004-20231215-en
General
-
Target
01ade590a69832687b4b1124026ae9b3.html
-
Size
22KB
-
MD5
01ade590a69832687b4b1124026ae9b3
-
SHA1
bfb21001ea735bc67065b8d8f2bc9d24bd1ae583
-
SHA256
c61eaf1b5ab19499a851d34dbd0a3317ed1423395a1489275b5690b6b2114c11
-
SHA512
da7afa7cdd4184e272aae26e7a7d8369f37ba85bf96fb67766b6ccf6bc518ba421ff639a5c2c3bc16108c560f6ffc407cab6780afb0f9373594980a6d53d758e
-
SSDEEP
192:iatweGuECfhL5FyTs6Ypkau6G6papUaXpqlsdr000hp8aepdr000UpS08000sTaT:NhL5FGYTDpafwCeanXRQKPvwU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d5cec9933ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000863189c053c6416725e82ac97a41742b4905dfd9f657d7b18fe518abfc09dbe7000000000e80000000020000200000001128909be4c442a018199a6fbfb1f652cf72d222ac0ec84111ae6326e0307f5e20000000a2434804fec1aed085c464a4ee0080705fdc3dde56d269efd4820962ee03018d4000000047375fa16b00f2172a715ba52c44909599fb9a3e5ff65c93ed4b04b1e7a05e1226cede8d075fb03e43474cf35abd0d8275da1ee1ceb3844324c16395dcfe5497 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000069a0afec33e8bd56dd23ae9256c943092ec6b77cfd551207c866055156b64ce3000000000e8000000002000020000000c0ad75223479e6cfa21d813fe572e520b44a5ec935f034c4402602b07a2b7e3d90000000442429fde85f4b5f92904a9fa3b38523f8a382aa6ae58082d524e7559bbacbfaa4b605880f65bb56f7f641d310303d65d0a3fccb309f3f4a68f3762ee800cd98393d4e8c90cc216e03d5a5a376cda3f912d1b998522f70fa12ed9d83ee47c530c63920b829db7192ced81a40806b35296c0a88a90c15345a71acf6c364c30436a59dccf3c2689adc48db3ef1606961f54000000008b98ecef11802be580356a8c518df8e719781f63b2516cf212b79579f1f89e3a54bba782e9f49a70092c96edcd4221eb7b4cba02dd1f207b7da1de6b8a1a8bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410042767" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFD7DD11-A686-11EE-89A8-464D43A133DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2676 2232 iexplore.exe 28 PID 2232 wrote to memory of 2676 2232 iexplore.exe 28 PID 2232 wrote to memory of 2676 2232 iexplore.exe 28 PID 2232 wrote to memory of 2676 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01ade590a69832687b4b1124026ae9b3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52da42999cb778137050f412874ab6141
SHA1b1e1b78e40a177a1f95b4b84123e94227deaf99a
SHA2561caab39c6c0ce5b86c76903a988b0eb70302b98a9405173becc011854f1bd151
SHA512d30e676f0b2de9e1b57fa99dc952dfe58fae785f7bbfbc81556a7e682d0e10d27e73f4c8f2ebac224fc19ff6cd47fb17607223a3b23115bb869e9485ca234574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589cb440fcae244dedf13f7ceb0b83503
SHA15d3479b2d561ba26e41de06070f22e053a0e0747
SHA256dd8c8367b68174ff4f80e898b1591790f7ac46d542f994e7fa791c85c77b6bb6
SHA5126898328a097f061d8ad2a4397a20addf2270eccf756f2e1a0298de2f19fdf81cbf34db54aad42bd8fc989f3291b13ba9d50912530c0f20c4ea251a274f62b95b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531120a1a30e3c632ee2018366608bdc3
SHA1eb0b6a38f1011b872c0216e21dae91f0e5db9d61
SHA2564b4dc78d9f558a9b68e042a7d3aab5d45a4b4d51ae7210425c7f78489899afaa
SHA51205d41eca7445d1b2d119a9f939bcb1a69345c5e50e42b611bdedde02a2fe7c5d7f6c2f2693ee97403e562495dbd46d2e1f7e597376f80e5ee0d9573ef44a9e3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4738f78c0429d5261fa46871eac56ea
SHA1786efee82e31d8a63a6b9be98b1c58816b388fc0
SHA2565daf60de16e15beb56dbd01e0c5005bb177ee93d02ef4abb5bb6ed08fce4bd0d
SHA5128c26316dc9cadee325511fb31f71a137945739d2854c764a24120ce281ae799547142220e0477995611e049499384cec3fd0fdff54633a0d09e0bae3da372aa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514eedea4af63bd1e43c6e507bae15d95
SHA1296987b9148f87a544a9bba1f268640ee72925b0
SHA256fb1de8bf7a0988a87754cfa350da8cff9b14b290fd2676a2d774e138c1d30b05
SHA512924b5e9bd0a230b878742b1b38115d6eda6d2cf09c0878a0adb38bb216f731249afe9ddcce2c0f84dc7b42d3f431be290741beb72acb32bf5de3bd619ba4ff36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53074fc6e3cde514982f26112a7f53083
SHA1f56f7459d2d11f00a0cce51c8612545722950f9e
SHA2567232d140e89b69c4b976c2efc4211fd89c94200022e16e5db0fc710d7b37611b
SHA5128998bd57be9fd99fe48da6071004f0eb8f392f04057af6609d2ec7644b87acce6d85ee06ec84a78b47743216e4f76e144b832f85e148892b0302cd0dd9e9fd16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c17dd311796e2460c8c45f33f75f6a26
SHA18e15bcda150af6efb618c96280b8278c53a84881
SHA25657f1317ad4e0298c3173052b4554f5a628c080d53d04872a44bca7d6a7e02e8a
SHA512bcc880ae0336de6d401f9cbc41566b6387c8f4cb1b6a0f247ed73f19c343455858956f8df950b0d8521afbb2bed68fcc6e3c74eea65b45b339a3b38c87bf3068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1f1660dd09814916ce2292dbceded6a
SHA19edac95a31688956b1288e772fb9175589549b4a
SHA256c530fcfe845a9dd33833c503e50256165bd6eb3429473649e101ff8a532124bc
SHA512f034f7d22dbe080dc9df0f8552e84ecd5b631b566b4f4bcf30e13ebb7222b814dda3168fb95feaef618f4f68fdf1c2ab5826c1b3b850304a598071bcbba27edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb50db754aa571ff5ef558086e322de2
SHA1803a5519dfdf83e9e733ac5444f362ea63a8152b
SHA256d1f92836f473f9662618a9fa55a3cdc6f70f814f6c958e65a8f7cffbcc53a6ca
SHA512d3429056916b4ab875a380fec120005fb2ca4d3e78d49ae05fefc2c0215025393965136af84d243711b9145602a0d9ae24eabf10294bf506084c3f69106af786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f45b8a78addc120d59d13ebc45a78d3
SHA1e4917904d4382333eecead638ce955deb7e9a0fb
SHA25673b8787491eb75caae5b087687aa5c8fe96665d3c2f62349f8c804c27941b48f
SHA512ae945c193cd84eae8fb28c23ee21730dd30eb4390d9fa48823155daff02fe7db930dab85f4934bb7720463e18ef3a5607b72785293e9746d2f54d2c500990f3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550770d9f575069a56dd7529b3c49f229
SHA10d41f4f50f1950b72a61c369cdbbeb3a5bec6082
SHA2562768a45c323e9346cce03a3397b0f7cafeb62584d178c6af8fb876d176f2dac6
SHA512a280cb0360374a5f29a5bf62b295feba449fcdd85aed636fc2d8a39df5edce21017508e9f55d2aa72716750482768fdc9cb6789d4e882944dc56247a882e8c4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e4cace38bae10031071dc2cdfe337a6
SHA13d7913dd8d1a595de55d984845ba805340f2a1c2
SHA2565e83bb459af982be68d314bd7a3e6bbf7332436915a095527d10f36ad81f5c7f
SHA5122df78cb4a918449b591aea12c785d25a4e2ac79dd6e4896a8fcd48d3766ab284487bcc3c1e5ebdcfdc1343f5a674e160d184b99f470ae42ae41b09536ec95590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f46d054cacfe690f690b2c5f8438c93
SHA18311b25f4c3424eb17d494885407c5c0f110f561
SHA2560975da256efdefee4ff80d8819b0c7576948e10cc8d3dfbd1fb967fb5adfefca
SHA512cea8c41aa320c3ec2dfbbdcd121c3a0ad2106233d95707237d5f1a43338420cdef226e8898f66663389e61ab11852e082173d76f09f7f3eee3c250ace0acf2d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fba040381de8a634b89d94a0d7c721d
SHA107264f02e2da7bcaf64496757e299af2343945a7
SHA256beb706d3cd076424c0bb51544f4fb87f5c6eb770e55ec9919078707a544fcf6a
SHA5129e9d30e3bf8848a576b23c1243e701327e4734b63fbee0ddaa6a3b50f72fc0bf55fdd81792184581ef21b17ce7b165ded747a2e082b79b04c0f44a722d00a801
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba2f20adbbb2a12d15b2ff5c78c66244
SHA112ac3ba7cf35e91b1f736f7d57724564e95a9b4e
SHA2561c983646983a279429d39bf8a92decd5d771bff9547cd747ce8d1b12eccc486c
SHA512643ae9c35cb0d10ff3dc50b03ea09969317252069ae7d093c9589716a6fbe6fc341c97bd92bed496d38e42759a017567f1f86df0a38f4d67cdf8a91ab50d7d2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3f363745835b814b599964e9d7b0814
SHA13be5f2aceea50cee57c9478caf47db4d9f0e3f5d
SHA25618683caba5bf78484cbc7b91c90fc359fc4e2274af1ab2fcd137a608ab86a4a0
SHA5121055172ade8824eae6493ee0a29dbc8639e8faf807aa58f11b051c9299b525fe637743d1dd2c39b29e84bb4884d1ec47ed5187ae00f915877cbcb3f4a52ec206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584e97c652d832595baf83b161387ab36
SHA11a44a1e01e2d261e12f9aed287e4ad69c941a2d6
SHA256b00f286b50ad7ab956a0f4eedf9c2237a76d46db50428f2f6ae664f3c97a8d35
SHA51244eb7ceb294f64e845f9a655bc9be65c6480b981fa2100e2eef6b77d11d67bb77294e97d31730d272611fdc73006dcec96ee646dc924f4a8565d3d8ebe5dd941
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502f0830bc31da4ace7f8f8b596653cea
SHA1396b226f593cb037e4a4c289293782a08598e423
SHA256e7b0362883a5ac836b29e40f49629a95403a1ac77066a79bdc9b61e0633cab48
SHA512b459cd8372d0d3ef3d4100b31bed0fcb5290ec8cf0f1e5ce11fa3cd4d605779ec960c083de93095a41ba028979eb2af7a5825f9dd292b08583ed08798feb5aac
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06