Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
0e5acef481aa7a7ac2d713681613b0bb.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e5acef481aa7a7ac2d713681613b0bb.html
Resource
win10v2004-20231222-en
General
-
Target
0e5acef481aa7a7ac2d713681613b0bb.html
-
Size
173KB
-
MD5
0e5acef481aa7a7ac2d713681613b0bb
-
SHA1
30fea5c6ba7a2e465cabe50dc5b9ff36278373bf
-
SHA256
bccd2f192101a43123818c09f11678c341fae569cacf0083589a833c56a2ecd7
-
SHA512
ba07ee04dd38ab129f3a7931477cce5ab798bdad0a79c2c508c39f5dc0a7c2f9eaa835764a454e71ea8a50278753b3718635d6a2696e8e269b8730e3158860aa
-
SSDEEP
1536:PsPuhuTnpcWAV1deaQsbag7T6lFHB03T92HUY7VZI+MQIc8DYyEtIa1WLmTm/Oz0:PsPuhuTnpS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f023cd6d212f0a7386e8bfdf8604b7b927dfd287a4962d7aea2f1f70326c6dec000000000e800000000200002000000082ac24b91b2c605f409eb88eec8f2cf67044b4a3e652c015bb2be3b433e5d9a6900000006fceb29e65246de3a5c35e512f89dd36aed0716ea6a9c28ba2018211bd6df4e9e5c126280c3ebeaa7f85def96fe6eb8bff0b4910847063b62d046de374467dfd6552021097ce527c69df286c62ef77c79d47fbd8dcf273e4a7f8a85f8bf9841f9c7601badfe6eb256723387fbde29a4822c2f0af8942bf61c6eeaa4eb0506bd67dc2cbb4079a1a933f3b0667f5cd723740000000355766ce5366e79cd15758607768c20976675d5cdae569fff9aa1dabac9056fbdf62dda5b26294dcf3e5fe3d5e7a934de375d5f99127bfdb63dd492bb6a79109 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702da6bd223cda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410214103" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D566AE81-A815-11EE-A3D4-6E556AB52A45} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000023db65af20e076497afe9cad1996e53405f655031bcc389812d293ad090c0581000000000e8000000002000020000000f2190ef96085b6a883f0d04ea24ee980c0390300045922f62d71e3bb3db5d0332000000021f707a12043d3b2e44b92da992088373c4514602df544f2d9ae4ea7bbd84bf4400000007d89f8e5d641078d2d44a2501c92a6a3d433112893efa9a4df2c1ca35a987d766231d5cccfada1783141de48573ea0504f1a285edefd27726f1276b07777cdae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2376 2212 iexplore.exe 28 PID 2212 wrote to memory of 2376 2212 iexplore.exe 28 PID 2212 wrote to memory of 2376 2212 iexplore.exe 28 PID 2212 wrote to memory of 2376 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e5acef481aa7a7ac2d713681613b0bb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
893B
MD5d4ae187b4574036c2d76b6df8a8c1a30
SHA1b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA5121f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568165ed474743fb00aad3624d1d54340
SHA10e2f288155d287352fce5d10d2685639c8c38e15
SHA256da1d77fa0e17926e4abd2b9e6182fdf6897a413dd060054111d1c26f507ef159
SHA5124f0bfc4a094b34527619494f5e9cc2b8a262615d4a56a8b43ecfcde3b45c700a323468d7a563d653ff96c956803fb98ff847a022b480ad69cd3735084b93a2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4989a5ac98fdb4e6648e1faf1883a4c
SHA10935e6768b71d6b8505816f12b0912e8724bf14d
SHA2565e739887855dd14c77e15d0c0d13be1f757d73808e11472eac1a27085945d76e
SHA5128bacf91a1624538402fb0c831166cf270461dbe9864d5bfac38c6f2a3781a4be9e54105161618e1f3d141ad23a6d5a866c6f723ebe6675e957617e07d1b5ad72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50860afc962652f77e74b01dc0090a712
SHA1867f876e89e330d1cf3eaf36b9c44127eecade1f
SHA25650521d3d50c0aa056612f26ca498c2a00e20f2be491412d63917e165ba8f5ab3
SHA512a0c603e335c2a9059410aab81cbb3b54f84b08550b8f19299f1b5f05dbdf4453abbc2ceefebbd3988ce18fbbdc787bfe051c42e60464359f4416e748b4db5383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffdd5252e4c86f400025866551fb8501
SHA1deda44538a20d0fa4fe8082127e9b48d6ae6118d
SHA256c0c2ed5318d4925fa0f7f018dab9f1d9a39b1983cd0592ee61ad0a58899520e8
SHA5124b749c23de39942e5ed81f75e2787f5b9463af268fc9657448097b4e02799419eb4e9d9368605d75941d06701cc3eb4412454a43d520bc9e7fa67ef4f4a43aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58937c49a14f069ee73fd8c157a62d75b
SHA13e751c810394b29076367418300753c0bc1c4598
SHA2566ed3224cd2f9838c9b8826b132811d25ee2472b64552db33dd8afedcd1cc2499
SHA5127a8dcb5982d7b144c2b3040e0012cdceea8877edc407745b626bf42dde88907c140db6579d483854b7f9db0be43b15fa507ded679ab364b69882223944eab05a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a13f7a618c5b5c21b1d235980c007b60
SHA1790dc9d53de52a7346378aab6bd4c8b3b36994d1
SHA256101a0ec7b34bdf22f66bd3bbb9b6ad920964f30874a9e38b4e01e079fd472478
SHA5128d08f5748466f0e878847df439f08a8d676f2405813cc40664a0249520f12b01983db1148341c6e30a171f59d2377c61f05306b65484ac93970d6418c9e35710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53426f4ef41ffc44ee6c574a649079514
SHA18b7b38c6932022152b538312c9f3c33c03aec04c
SHA256a91e4b16bb89cb909d1514ccf20d6926c215a1edb33485ea96b01efc1e921dcd
SHA512f4b078c49ad040d21e93e66c3a8965973e18da57a0add625d82a2babc9ce742d71692c9556a904f8c98ec5a629a2d901a31b5c3c61e8342a402e79e2730e8924
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59770b55b9d7bbcc75680b2eedfb7fc69
SHA1727de4a294c347424a607694ce50dca95b2e1293
SHA256168dfc6a361eb689974437463050fc2b70ab1768bc7332808476318e55b0e8a5
SHA512d49457618a289281044a3d06600c2a43bbc70d84f8514ffa3309ecabc4cdc994054dc6e2aefcc931e127779492d5f79e47ff4652d0955723e6f4eaedef8dcb82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b7d7212fdab9edd86aa6220dcc7560f
SHA18cb7677d86335f4a2d8b87295d2029937448a92b
SHA2561e8502b0f8cb8aac2e5a2e733ea41fc547d466ecc90c43c1db0c4ccad10925cd
SHA512a834793099314bda1af7286ee45c0e6f5daae0e3119891659ab0939cbe4712715e7e95004db1185414a129d2b20825b0fbd6f558f8d0b8efc500e977bd26f9a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bb82e4338125ae152ae97c740b3d584
SHA1e3fd76d8850ae444927e3a77a58c74b574643e0d
SHA256cf3de27f5053d56dc4c28c7d433f27262fd0be57d235c251852777f93c16ef29
SHA512a70aa653d8cda66076717d5ec85db5a1e38d369abd158f12108dde109ba03e2b6cf00a6f0cb4e1f7b00933af69046fd1c0a202fa9830afd4837e4901999ffb67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58298497ed6a0de278490d231145819fa
SHA15e084bc3222b6f778ac30b90f895ffa22415c251
SHA256fda7ffe68923e7cf8d52d1175028d495caf9a1c44a83268fc362812ab15496f4
SHA5120cd8c1d7779339209ba34d647242f986399170fe26969372921f58d904922c362cf4cb77ffab50332707d14e47bc3d36db3eef17a87cc54c7d2e948e6c72a69e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56561818f6035a50fb60f292fa9b15b6a
SHA1ed71366877890375c9e45b9c245b3d7cf7bf9c5d
SHA256b2d41329865066008e8142dbef88502921c64066b77c1f26331852f2b503ea89
SHA512a237de53a4cca7215925aa5d5516e58b8aadf87e175644cf452562c03db94991d30f6f5cfd878ac654fa625ce1390552fd8fe233be9bc73663e9521f67c99876
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563939c8c665e352763351de502f930fc
SHA10644f67807b9f9cd112aa222cd1da1ce34499bc4
SHA25660abd110f03d198c156e757b613b4da2501943f41283a3718c671ca2613686ca
SHA512c18fd31a9829430d1c7ed4888be63fe5778d7c01fcb28aae2f55465c565384c2930b58311afcbc1a1cf404e7e9e3646925585b612f4c61ed6fb0afc62ee6a800
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7686f0c479da444f9271b1ba77bea2c
SHA1f9a00fe94c02f360a8270ffba5ba98e86bab2695
SHA2566a30e0fae6600a236b305c43e7b22ab83a064757ce2e9fccb68d7b029c5f8808
SHA5122ae85c6122f7093f535fe250886d37587016b3f69ebf55f34a22920dcbbfe85342c844a2b2cdc17d5502e4f753605c16acf82e616b6dfcb9d5c3e4054902d757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56800547fbf667845168efa7a82ac7f92
SHA1306a3bb452d63d883d574e00a60832c772484a24
SHA256d5789de730410970ef1db6d7c7e09785763b46eaffe25cd7bc89ed6c67cc7dc6
SHA5122c3b64d38d42134c3ed90994e54b2b1b1fd27d6d851264fde95e352a1eb47d7295addb988b238eba307762bccab97f748921dde59433c3a8e82142c47a880c81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51906127ae0fb2ee9f522edac9ee5c723
SHA13aa3c4628817bdf3ee398cab89fa9994202ea8c0
SHA25669eefc41c7b8f647c564f0019a8874d68d98decb91b1cb781115af7dc8ca728d
SHA512dccdbb2d7e83ed949377151086bbf7f1add867126c78d25ea55039c9a15ba3cb1d2e757d39c8181c475f52c8af0152b3f32f5f8bdca1c25613b6ab6536af6082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5614adb4383ae77e6b6b651c1dd460a8c
SHA1de384fac54b7a2631ec724da66fce8056391a81e
SHA256189da8524cc219fde76c80e26969939f26cf2457d5ccb03dba832cfa9eaeeb66
SHA5128d93dc441499fe2a1c9645faf8670b6b196436fa51b75055dd53bb8fe2c5e840cd5ebbf8436ecdf43df9ae5bfacca902b7ed9873259f03dae68c5fe99b37852f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af38b21af424917b14cb513d9ac23b92
SHA1a9e9f9fe3a251f6c724d5f9dab0381ae3a436a24
SHA2563d598e74e245570432cbd1c45b0a3fd590f291c37d8a25ccf0392b4617e80884
SHA51252f680cbe5356d5d918e63b167007e47fc0617edfd619cd917a934d6481f1c7a9024d19ba0a77e491037de724439c57f3c6e2dc303bd4d029a89c8af4051515f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06