Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
0ebbc4b91c484d06ba5f3bf6989c1486.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ebbc4b91c484d06ba5f3bf6989c1486.html
Resource
win10v2004-20231215-en
General
-
Target
0ebbc4b91c484d06ba5f3bf6989c1486.html
-
Size
151B
-
MD5
0ebbc4b91c484d06ba5f3bf6989c1486
-
SHA1
96a5c2b8e6c2d846cfc3b64e4e98fb29d3fb86dd
-
SHA256
c3ad083970d4944f33dca08f9af66c21fba8556892d7c2c1fb7a04c10eb3b8b6
-
SHA512
c141232cedb4a0e5911c7a4586bc0c0a281ff01ed774ebcc8344d97ac4958fedf8d647edb03c53a77249e6df240e0d768328476da41cbb1e2d6be4e9df0742bf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d241c268ea542f0f47db7b6a2c9eb8c2157a89ca11c287d7838845dafdf16905000000000e800000000200002000000000058fad16839418dbf359cb23ce2c4ec298707a8cebb9a68cf0e72065d7c4ae9000000012b9314633fb708557cbb07ccb63058b96754e578e8fb51721893abe2c2243617fd56961b5893e01a5d82484c4f8524ce6deaf0dc6cd1b19485aa84cdfedb5e32396a0263bf602c97d1082927ddd776a23db2a98489d26cb4289b03c4c1d9257147dedd4eaabc1ea920d26c0d30d4c31e13bd122f409a0eb717e1d31277a21005a404b9f82fa2c8453b573976d32a62e40000000f3f7fc0f40c7c4557c18114674b7eac707ff4d533c90d7564f82237e7a99418b5c2d07a38233165a4fa7abcd8fdec0c95fcce097185b719a64e6556bc2583c91 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e42cba2d3cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5344561-A820-11EE-B9E8-EE9A2FAC8CC3} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000dab64cf1c0a6ee681de9adb6f712abc378740481bd3b7a65a0a4e0fe67c06bfe000000000e800000000200002000000094cd4cacd0f46d4d586732a3c17010aa51ea819eb13c989708e21513835cf20b20000000daa723ada7f9b61edd3e4e9d560ddaa2c33421737eed3c29941dff7a1a39edc540000000fb8bf2e3894c7d295873da3d263bf378b932528d5b819ad4df21ce843296f77d18dab0c77f07be24f25c5860b12e6a1bcbcf3242b8b8c9fbf1a9991896862f7f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410218844" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1756 2460 iexplore.exe 28 PID 2460 wrote to memory of 1756 2460 iexplore.exe 28 PID 2460 wrote to memory of 1756 2460 iexplore.exe 28 PID 2460 wrote to memory of 1756 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ebbc4b91c484d06ba5f3bf6989c1486.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526daf1e98db2602efcd722a4ecc46e88
SHA1781c995d41e5aea385dbe43db977438b6c51b6c2
SHA2567512dee772eec23f104ec7cc9eb60bedce97360c3a015d845cb7f15ea251488f
SHA5121cd121096753eeb984b11458657eb04718def71c9ab4931e34a388e5ad462f8aa07d57f2e65d0b9278e34836f2e937e22982b1e8eac2621a37795406c3cc89fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57964e676987d213f33ab621c0db38cc3
SHA16134bf6074bf66f903a512431e3ae0aca7bf514c
SHA256c9d724d44936939d8888c1b8fa8cfa189b573252d6e32a36634efe89ad843041
SHA512a9946c57bb2223153de965df813143fb51c845e36b10842a3e898c5fae138e630684a7fe4c4e9f0075d3f312d003616d0b0af675049792eef8c74343c2e45fab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d94b76cf5c96c5033edf02a22c84ccb9
SHA12508f564207b6db755a6a8b661e28ef6fbbcdf2e
SHA2569351f8b5307a5ddc53bd6b780e09855225b478d404e5da8f85264f43a741d35d
SHA51254a44636b01a80bb0ee1958c5a9d7f9c69ede236a54c94f501f6623f6ee843022917dc747e23cf5b3c74b44b79f3d71aad4d9b1a35d4f0161217a4ac1a2d0d8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef52a8b99c473f4ae4d92a0b254e6f18
SHA1eb316b39c48cc730bf8eb43fb539b3dd6f8a0c72
SHA2567b346dd7145f49afa3463982c09b11f58fad7141f057e18e73621e560eac7fa1
SHA51232dd7e4a13c8d28bbdc771a7f3404ee99c67c128acf9dd2ec6bb3ab644500ab6b8f083e6dd726e236bca07a7800a4a5c0f7ff0eea31479b1f3b62f3fb4ba6af0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad02894fb808e184dbaff1020e5c503e
SHA107741c2489108f8b92f5136e086a5a65d643ae2d
SHA2567fae46b17e109379f8303ce003410b0af40378d6ee0df76c748d4f88c93d5e83
SHA512019f7797d90bb34d8a1be25ba633188eeea7e6cff1dd40bb26128305f096108e8a9f701e4393fce8956e5d06e8e6bfc6b04deda81fc0d3746723093946866914
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50feeb9aada88046e84ca991291c7f56b
SHA120408b9179aeb9320fc53915d28695f0f3cca49e
SHA2563b434b95a2b6832fd43cbf43bc09685052e4cc23de25baa9d1b996121330a2f8
SHA5122f4fcf408941e0f7b538ee64718b4498e463cad3472f24761500fcc6557383c6532b1fbe73e4401bfd9fb848b74834ec3451dc57423a9ebfb091561ac1d887eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511b904a9607f55230ca3fc709e9e664b
SHA13efd76fd19aa2a8c28795784cf9b0219a34bdae7
SHA2568cd19b320b34d21bf144726d3b6f26f30d5c73fe2fd60658316aa37de3533a9e
SHA512edf757193b943b948983f32a842c357711c2eedb3c06065ee243d3c9fbc2dd5c77e39660961c5b8217cc60380ba642d8be1f87e26fba506c472cb8d3ab1b1b85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fce554aa2f810394cb0d828034c6dd0
SHA12b275f0e0a7503cb62d81f03e44419dc3a259e94
SHA256ce0e9f93dd71c7f8b165cb5a1dec71e719e6f56e7a5534ee1af1e46f305ba25e
SHA512b746af90e3b2a41dc2297c936e8f7b2b075fc6c090cd12f201c2bea71f9e83e90cc85ea08ebcb8e58db4e7c9a9a55f9e3b4c94c0bc806e507f71d76850ebfeb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3de81dc7bc8c00cb29f6ce9d192ff2f
SHA1a52ffae2ebd6ee815c43ff9489ea9badb04fd67b
SHA256512b61199b6203eb12c9785ac0cf41c4acdda73c27c4e44138c89ddcb45fe107
SHA5121bb015dccc00aa0079af2d43537e7e8b42fe012c44e8a13ac889cf7cb3ea7e600b51aa01529ddfaf2fc732c3bfe699e033e0b02c4a935891cf90e39677cac867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594f1b21dd4f9b8357e3bd6bc235c6b26
SHA11fe39947013aacaeb1a887c20ff6b7d5aa45387b
SHA25685f6df95b705f1502f27afe87e1abdcdc30490c4a7d2a14de679391851ece40c
SHA5126e3cec6a56b5aa9a28e0574ae767f4c7f55eb3238103937de6881f99ed1e0def45eb7389dbc96eace2de3bbea35ff036693b348b4983a19a21989b355c5fe854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a740f68a3ae7faf63d50ed75599ceee6
SHA14db428a634a575848f0f24cecaccb1b0302e4055
SHA256d797baa28bc85f5f25d2cfda908edf5e81661b850f677d2ab998f98879d8e3d8
SHA512a042559e55b97ef398440575012765c573aa9205ac153d2c4554cc330e6c0bc0b4b397b273401002d3d6838ab52fea75ba42df2830f7345ef1ec405b2663d532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f68fdee7722dfde2d4f9a17c057b6e8
SHA1d88f10caf583bb5d022d05544510981572c29658
SHA25680a197208a7467b75175dbb61281bce69cc175e2161f7bdd2d6668cb316b02aa
SHA512ad569dfdfd56f6c91d6d86a83d0e51616587371edbf413806882e790b3099ef04dd15e7677b2cc5b2bebfd27d92961667fa076d6eb6fea53bf4e6cc9d9724c33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baef9c918c75b877c8d444b55392ffdf
SHA147aab9446c52a18ce1f4bffe0068c166706fbdc4
SHA256402737844912b2a232a0b4399c9d76940f7def7f763a4ba2ece7226dcfb2596d
SHA512751e48690a09eb8fab5ad29314f5471424e04335336a23b12cb3b3e16145721cbc7dc5db926cd4343737845ca96e5ac6d78f36800156f954c109802e84212150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbd2127aa12692f4d451993bdef11278
SHA17f179d5b472e26fe58e885cc099c0d011b7abaaf
SHA2568a822e470e98c9e86de79c449bc63fb206566857d9f0bdb44a0bf105719a493b
SHA51223ad0012ea3ff66e749e0bbf97f51ea5c03978b8a1c85d86c5f7a1cbf55af46123b71f72a0433ffe9b5daf738b90cf30b0725b9a84e9a2aaa6d53a8ba58030d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a98f21e8400cd5dc3e560eee63c6b93c
SHA1c5c3af3d397eb2ab22e604e30303468e2fa8366b
SHA256b507db81b5d95c5ce48c0cc84312d36f1e62c8da5214200290a9f1a11b0c0c13
SHA512e1b6f4e8d2374fac0127bb5ecd952f62cacc442c3542f1e32c4050f8c50ccb88462e6351b7320b4c185e5143303ae676e549120c0c0f73c31952c1eded19710a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a725f8c1a13313ced25c149b564cabb2
SHA195b408113b25dc75023bd838edd27346446c095f
SHA256874772da5c7040d53ef4773746d942b370962f4fe33c19e027a9d934bf6e9dd7
SHA512d60f58e419ea8f6fd430d8c93b05dd7d50013e5ab6aaccb8ff739b45e104939a5e7afb889b8fa6c0a237ea3a4f8a693753c4b2f6aa157ffedc11172a919037aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594f2ebcbb848db6d521ea0bdc93f5b62
SHA1cf0ab84e9a5519874319a7bb1095074a1af90629
SHA25684582767bde20da2d437e79d92708d554eae87bd75ec09880c26670827b313ee
SHA512e2645c5b4fab461bcb45befb2cc32472eef70d5f8128ab7b880d94f1f170f7c7d686a436e1cd60c6299523d89e04ad613d8e9a3458f27ee5b5541f604966cde6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a58084249c6b3d379e6f90f944d46192
SHA1c2d71fb49713a435d96e345729e9864e4dd79fdf
SHA2567c1347ca9eea908328f9c24012565b46b62a5708d1f797db575b4812ba62cfcf
SHA5123e6631111e6ca4ae8e40c11090317f33a4cf5d8d6581acc866990effe67166642d1b29bf742b159804cc41f47c16e7bd13e7d95fe4b1c7de94e04f1db9746413
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06