Analysis
-
max time kernel
117s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
0d170ca48110cbae81a64dd2171a1f7c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d170ca48110cbae81a64dd2171a1f7c.html
Resource
win10v2004-20231222-en
General
-
Target
0d170ca48110cbae81a64dd2171a1f7c.html
-
Size
432B
-
MD5
0d170ca48110cbae81a64dd2171a1f7c
-
SHA1
43ceea871fae97c3b2a7b52c2ccbe4ad4e0cc0e4
-
SHA256
5c25274064c2bd44b3177f45ae11ee2401b24d8af5236857606aa5dfbb746586
-
SHA512
f4da963eef73a25ba1115e288a01cff916ad973f07db3268a41a4f311929805d72064940adb8a0e364fb1454b1dcaefeb8f219c43d40b2d262be5814f04638d5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000002659312e449ebf53030581315fa2b11b31eb90750141cd4a1d45585480f1ab3000000000e8000000002000020000000f8c31eba747fa6f00178068c9d3889581885fa4e84c07f1a9c751689ca820b99900000000fd592c6c386f79e84f22a40039d549220a7d426fb30992238aa4a2fb5e3f0fd0cad82cf5f3be7b295de5c69863eb6277330386cc08a020dd09836d6647f7a5d92ce3af917d016c53bcafe784255865f485fa542873edb474971797c76d58a7a11c23ec7d26f81b96ad679e2b6aca25cbf27cf67307204bb13f9647d1f5aaefcc1f7433a56027262cfb0b099a4dd40a6400000005f85e093d3585775a1e0547ead27a3a32fff2a86eea15202b6936a6b594ab8133635201abdbd226316f7f17b1ee93b9ca244d4c0628182995fdd0ebc231af30c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410126135" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{087CC571-A749-11EE-94C2-56B3956C75C7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000062b33353601ff91b7107f8236384ea5f4d70144910e1cb5cb93f1e0b5afbccf5000000000e8000000002000020000000319a299d4bf63a7d0a7f48026557ce1b2c9042904f18e7c16c94d72932f728dd20000000542bad67ab400bf3e5a5b83763c579af481bba4eecd03e4c6e89aa89b618739940000000c144f16cd1d27410b3cc747d0dde8e3430f6c54507d263c8664e10e620c4f6a40b163fed7a7149690ba9d7383ea424cb65d23984c08430463f8769557cd94e23 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d0bfcd553bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1404 2988 iexplore.exe 28 PID 2988 wrote to memory of 1404 2988 iexplore.exe 28 PID 2988 wrote to memory of 1404 2988 iexplore.exe 28 PID 2988 wrote to memory of 1404 2988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d170ca48110cbae81a64dd2171a1f7c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a71c3c43a96e2a48616c88af8be91649
SHA18280a9f2a83da2d6c17a8ae509b1b4b4f98bb715
SHA256af955337208c91d2fc4502e393d7a2042934d35f1e26f03446f2ac12f84203e1
SHA5125654c5a8d7a7a81da1fb2330bd9f816bbc1c549857c3de77f89d768c8ebba9f01e11424c8383589c1dbe0c999e46df5068c5fad3beb539a24015db81669b6395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfac0c55a45d12e19f50214df091d21c
SHA11d70e14e24a6cb661bc58d5b962c791ca886460e
SHA256b7d0c888b7475c4dc06872d712d809e190e97605be4806ead7938355dd4e4599
SHA51274511cfef3b1e1d9b31c08264be060df2f2ee4d66d926e1c3ab3b74b0b1d42051a36148a3aa66347eef9e352917859893c87ad7f1558903800072e790cd10f4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ff74898620c674ca289bc3526d770af
SHA1da7e293162273e6259c999c9051be4ba154a65e7
SHA256796b808b6424eb8cd6d2ec828b84a1f60d81cf1a0d165e86969c7b42e1df590d
SHA51287c069b9cc6b538f44cf8d3f996e49af72ad671c11f68b663c4a6c37ca0618a5b2e38637c0d77bf2f1f5f8be677f6b4998101e66a625bfeedcbfc41063714aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e543f48c2e6d67d8cc18f6d9a0bafd6a
SHA12cb5c248c1697e0104287e5a715d1b94b7106356
SHA256c021b8b621dab6e4c0dbd6215f4cee61281644fd0949491f82df0add6f40a49d
SHA512113527a338c97f7775f92873dbdfe8303e42efecb39eeee07315be4a6c8a4f0eea59fc1d247ce46700874c3bf5d103d83f960fef800378b09a781a1d7cd5c952
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b485bbfdb36449834d9c5e7c63e73066
SHA11a8b165fd0641cb1ca3b8688fa8e8c741c5b83ef
SHA2561a93da0ab38a88ef4ac19b91c27cbdbd4b4cc74957d9185d66a83551fa88d96e
SHA512fe8a6a04bff4ab101ae904c3e3a4f71514ec7cac3b33a9b2daf3a9b23cf0388570fe058a1158fbc60ef50dbcfafb461980dbefdd7f8982d978e0aa8b0dbb674f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ff23b1320c77a0cef3360babec32896
SHA1acfcdfacb0e733d5901ac3b63257645233f7e04d
SHA2569284f360ff040752cc6c4e8826e7e370b33c73042043c4b621f741dd2386e163
SHA512eeeaea350a973d86aa6d2263577bd30a4060feed9365049ffdbe3b143c8a81c7c95a1ff4913ec0aff2cb5ab218b28a6249887c3554086bc40d814758eeaf94c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52827e52e882218657fd0b351a6858d4a
SHA16f3d2ccac81e3c200d91a18635a924b9e2e12f5e
SHA256a5000f579ff21336728c98094a2854bf409be5e78f0000d9b3cc7c09af656cb8
SHA512347e44c7ac8fc7ea15120fd120daa20de7bdbd4b2ea217a2e478ecc7be4bd2838fb6531a987a30edb0007f9a6951761422a9a05963d5654302429c8ddee29381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b1ea49c796d1fd71595e07c640b49dc
SHA124a59e5d4e317a17e48388f139d275a2b5a263b2
SHA25649e0056784857d336ed5b5103ebf03d2a045a4153e85217b2885171c5bc91d54
SHA512acd58bd9b9717eea6aa90903063138211327b9edd67e798fafd8696c145ca831a1da63943182582cae8458289695fa296d465991b93a1ff0e3d9f61601221b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc6c198a2d4e6a59d970220b3d134741
SHA11a5f61043c2649df434551ad30c7aa9b9af82901
SHA256d0d09752944059f5051cf28608eff71c55396894bbb390e81ee5f84d734c413b
SHA5126ac088d6457d0ae7c9f29a19604e7e9f35f528166a1d4e4187f3191b0c5fc7d8b188fc41ed49299c28199f0f5141a790c1a0d002975776c3d51a49a498bf8aa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c114847dc47607368a0449925aa23192
SHA195e45f787260c0b45feb8b9645d12756b86cec05
SHA25683c530a683a1abf37c14216bd2183655f539b71bfcccd0abb424e5bf236c205a
SHA512a3f061cab8844a5ccc9cc9dc77635ffb506ef01c53d8570fdf44668f750e1d5ff5ee0d12277fce6b78f6e085bd666e4e9d1c6dfde2344278bde49c123cfc1d4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560c5cd3b80e40b587bb0e255f4c634cc
SHA1c5c8f6e1789d348dc89aa96a18c524977568f330
SHA2562c6f60700e2b7603fc6c98905a2ec25914bbdd81ad261f543150076cec4beeb1
SHA512b1beb62f58a8e8cef05fa35e0ac2e3a4cea88f90a9f647ee652da225534bdad32e58f12788442d270cbf973adbb765a30a75ff9ef9eabf74626bb60c34d85931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530dabd1e85b5a4b763059292e10de3bc
SHA188424988b39f8cd2cdcef94cf5273d87e8a9725e
SHA256beb0dc3d51906410a3361be1c0506c98f94ce56076b9e345777ccdc6b9b04eeb
SHA5127b1063dd88cd68245841680d54e3f6ab2b36172fe93f5e00d11a324ab6a0d4dca07a7038a8f8530a4c15fae39ff3aedb1bc9d409e23ff632e88acb80bf19c15f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513edf2c5c850f5396a32054cfef2149a
SHA14d5a0d12c84935b9ea42fb046f2f96111d477c74
SHA2564aadb02d67b383a7698f7cc939dcff18b7475685b51e0a997c81ca96753052eb
SHA5125f34f87665b3c7f418f257ba718030dbafa6d1ff53236aaa86259f37bae6778242df4bf9b793862dc94e7b1f9f743d8a999d6aa239429709411c5b67ef2f91fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ecdbf12e3f6dfc1cd8a3ef07b46b5c1
SHA118ed093e3ebac827f6dceb19269fa0ba9e1aa819
SHA256db19b55c532f2a27f49e57f876180a85d1f1089414d6b39f3effba0f7fdcba2e
SHA5127f5c2cc2f3aa2878b89de4bdfae1c95d32b1ecd51a9421e685a0e3b87359a6d75045f6c330c80da9fad775dbf472626140df0e72abbe66f80e42b38197f56c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f744d45f8e0ce33099342fbaa005d52f
SHA1c9f5f1c02d4e8e71bb7f1f2416e44fedde2b9fac
SHA2563e0cb1e871d033dfb284499f164d23ff362db842ecd17cdb96409476ebb81fc6
SHA512821e939adcc5ae7736bcc8a0203111e9811df261385323c4283ff80ed78f19c05e250a909e2acb8bf6c15525235c7c3ca07ebe1d670c875e606947f7454af0a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592ee6e99a7352d94f75bef6bac4eb381
SHA1c3fdd1f075a02fdb3f23fd6bd204f2c1b1ca1e30
SHA25695fb3bcf8da64d70d3f635e3de8d318a94f5e6ff11128541b11fb26ee2bee2fd
SHA512a76a9f79fb5203b459c0d801aa400bfd564f3c1878f9ec911d4d78efb74edd7714050a83761ea653fd9663f1a26e73fe723ceca0bca115e2d684b13138db5e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503138618e0ec52f9b73bc4f5b4a2a3e0
SHA198d5c1f2a998f5335f9bd3d79272e4d9d5e07c56
SHA256931a9cd3f7d6795545b608b4d0fcfc289e80a2423c560420b54561f392063b8b
SHA512deef16f64ce73c1e3afeab727a97e6a04ac6f7ee43451a40cbb7dc2aa170bb5bfc7871c68fcb5dc7f93da2f51232a39bbb40af1757951d0aeabf6939cde2a1f2
-
Filesize
1KB
MD5a198ea4e2defa9180132a61a07a7b715
SHA165d5214aa6aab7dc15190f76754e3667a3f1efac
SHA256e92c180af7290cdf0078719d0406ea8d7d4ac4b000b70e1ece711a15f15e12c4
SHA5125fef1604858dbc5d3dc44c562ad958c0dde462cec2c940d723580884da518f67d9573b18c96da86a04c287edc678ffc973d471a572391fac882c12a7ee490af0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\favicon[1].ico
Filesize1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06