Analysis
-
max time kernel
120s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
0e5649b7168040efda8890c5abf87b26.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e5649b7168040efda8890c5abf87b26.html
Resource
win10v2004-20231215-en
General
-
Target
0e5649b7168040efda8890c5abf87b26.html
-
Size
51KB
-
MD5
0e5649b7168040efda8890c5abf87b26
-
SHA1
197b0cb354483ca7e84a9ba141db97779956daf2
-
SHA256
adc8e31d73298725b7132222891a8d089a0ea297815bf621fcdb15ccc784e5f7
-
SHA512
8902c789cf009f7d45906abbc8095abf80fa4d4581e44143eb9825b89ad0e405cf207eaacaa91d7ef2ed9acdc72e6b04411fa1622ac6f9857f5dda795dbff746
-
SSDEEP
1536:WlnVOdaJkw0hFY+OyT+xATF/L2UxHByXgIYosG:WlVOIJn9yT+xATF/L2UxHByXgIYo3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ab5a11f5ffbc3a9421ae61fed070b55210593e37817bbac8647e1aa25823f57b000000000e80000000020000200000003220b7a1bf98a475aa016eef8c195f83e48c1e175423a598e65e6eaef8d9c75c2000000098f65dc09b100a044b692aeae4da33db1fe0449d5b04d665b198b4ceae65170e400000000d8580c968339ae33a5aa66c41a6a7a44788457c298b7b4c26762bbb58c2c75a57935d2f3627ceeb80ec85cd462a1cd18fe7f442e72b915d53b04f1c8e1a2025 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000073e14401538407d1ae5614e3b5c54c320e2100bd28d92738b964d35601c0caf5000000000e8000000002000020000000969f390994cb54cc1dab4198ff13eef4350510470ab281edb0e31f3b1eee8983900000004deae69c39965559347eea4025a31bf0351ab21fbec299def6743d6cd2755df71ec08cb88bdc43c80f94cf9c4da56317694b8a1fc80095c511bd3ecd00d46e5d8bfdc313d8df63859b83f700834e287d70257e3a472f2a2c22d035f52d830e9e43f33a52bb60251dc2e00f9cd15f8af9905b7a66e10843f1b6728eac22169c2ec9e1622934ac6cd3f5116906b3e1313640000000bcc079972fe754a1a623693d832a01b449adc29132829e1574d89c3fd42768d783b9f388a64ccb9ccbc3c2ed8f9ea4d63919aa552d7cdef5d8bad52f591cde6e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4EA08D71-A75D-11EE-9D0D-D2016227024C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410134853" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06049336a3bda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2656 iexplore.exe 2656 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2704 2656 iexplore.exe 28 PID 2656 wrote to memory of 2704 2656 iexplore.exe 28 PID 2656 wrote to memory of 2704 2656 iexplore.exe 28 PID 2656 wrote to memory of 2704 2656 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e5649b7168040efda8890c5abf87b26.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d06b511b1185cb4b814dabe08c4a97f
SHA1a382199ca170280ceda3abcf7161e6d9fccee8ca
SHA25609ed4693524aa6bc2535da61180bc6d4751a6720f4988f1efd353b6c3e7eb257
SHA512a4a33d82d7332d8af40690a6c254f107d237e92774cb9af2c78a70665ff710b9419442f60f18824d2a268d88736013c131440d2f435d9d1de3ff39d9e3bc23cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528dd6b5632b94909ec67700a1e57acd0
SHA151c119d9c9686bc10125591a6ff1f4863efb719b
SHA256219e7906e59da07c47adfecd9f0f6e980146dde4ddaac62c7fb5f2db271a7646
SHA51278a8d151bdc01f47a08e74429a0865578d5ab79739375760967505404a2e09a37c884165085bb2055858d4862a2562799ca16f1a601a5e12e72ae59dd757ff03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e38a0cb8e07f42766e8e34b2c4f366a
SHA133d49aa932241639ce927d5861134356d1be0fca
SHA2568d4b80c2f13e61d2e7b984587de5e13eb0f12b190d48384511fae30b4b7aaec6
SHA5126794f6fd0e8de9e544be7c4ff40265bf27d8ff534df2006bbdc4d5ffbdb49af510235bf6f066edbd5c70230ea34e54ca397f042d3b51fa72b4688ae61829ed30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517e251476f4408a7af3b912e5fd10288
SHA186bff028d368ec1d7370705ff546f7ceaf1e6c3f
SHA256eeaf8223dcd42c5ba829e34b76f3096a450ff0b9e2257e15a93b5d0634e96730
SHA512ba3dacaa4df7b1935f607033c5356dee3c7a7fcc510e44d73504cc321f1fc06e28e471d1b67394d24b1fe6e0612074b2604271f3c21cfdfd86531931f3d54d07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6eabaa96fe36daedd0b7e309e7f798f
SHA14b6b253a40563c772ff741dc182415bc4249c00f
SHA256495d0b634e7c640abe8aebf05e8df8e4ede34d8168f044ac75ab577888a07a7e
SHA512a1382f3629f23ea414073d9d2b0ddb083b47480074f78be607f135399e38239bc576441f66ff030b942fa65cd99a0a426c943587b8b9af35245697c74162d3f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f610327680dd230b1929266e32a0f94
SHA1cda7e766e1fa10327720fc7e2a375d30babb10c3
SHA256d8f343972a449066b422b5201b714cb6e86f042bad2525ca0c1c6df9b49f1da6
SHA5129cf9e19970df85d77bb2b560d207ef7ae10e66586c1badc4f1cfdf056e6e01a71003a45d9799b791460cf494210f3d377ae423c334996a7ec1d79c2425c0a9ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a173773877bec8a26aaf247cc3046ce3
SHA1944b6f1d8712a38f38baa40657c29740509209e0
SHA2568dfe96bf20a45607e6eaef91281c247f4e4752adc87a4022f3a587bcd3afa432
SHA512e276547a688bc3783d70b8207afca37b088d6984ec02c9d4954a877d5d0737ce66420d4ac12389273f3a39354ebc84ee35a30a953bb290a8e2bf12a3f0fa8521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f2530cf71763bf59b6898643296579c
SHA1ef7221372a90909cc2f8304fe479a06c659da99b
SHA256850c4a99b0b91ae0424d7a111b29580f5b0f67a6a609427beaa0f69cd686bb84
SHA512e1fb08a63e72ce07f2eac61eabe31746a9a42210fb07cf70f2bb74503d7922d76d3065bb40382e06d77a24f8cee4c328c518a6e7b1e3fb372613afb098be94e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51aacff7b7f58dba61c8d0d002f879bc3
SHA1011e10f9fd20938dcc0bc6ce6fb4db87d4eab478
SHA2563705ae3d89bb02d2485813da06f4e8d048e57cdfda9e3b69417bd5de1fede591
SHA51252f635789b7f01d840fde3b13df259d853e9b6a4fe4aaa0280201dac6414e18fb25dab5dbc5fc4fae71e7e9dea1ea0d4697fe397286a94395cbbc89189e4350e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5004d52ee62fd2999b5c9017a5ca0912d
SHA1b52d2fe609cbb83ec20f57126234e42de5b2ea5f
SHA256196d100f8ac8d9ab30b14cbdd09bb3591820394fe49c9c3336f424e8b061d631
SHA512e0ae6964755c79d1910e6c31f3a72086b01d650203439b15fcd07ee82f45c7c9d4507a4c25a8403c1398b228cebf794b6267c947506147ce8ac55c3833410955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cac0c62f9f7846ca848421675e744329
SHA1bd1eea91e773c4a7152fcfbd1f3278e633e47ee9
SHA2567cee014cc0e4d5d23def82df15a1918cb7ff417b877aa77d6e7e0ea8ef2b7bbd
SHA51287929de2768dd1db42a9e2f8c6d369edc5b992e0e823ca517417a3c6d18e15422b2d453f657edd517f082ea68bf4bc82d27f2f91db9a4e661817b8216293435d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af2d9ec364957225219305a212fc0689
SHA13904d4caabdbe1461146bb0e4849c9b7885ff797
SHA256f69c4ca8fd6c2a2fadd5dbe292407005edd0bcaa6b2171045571a162519c102d
SHA51239dec13d73e82bb5a5b696e3d81e456f3cbcfeee8f617e98572d5da91b5445945452beade0552b2c4f2a55792719515ffb928fe909a21449c02f8ebf79c63689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54526d3518e5597f6134f137384c164d4
SHA13c5787e1886f13380cc925bdeb03ce4bf844a041
SHA256a83d5aafb83077f782440269bdc33dc3c5f7b24012d276cc11ff21f1a1058c6d
SHA51218cefbac61ab32b55f2abf14720283726fea204d984dda97cb32d8acf0fb13119163652e775010f2b86e23a4ee55ed4bafa77e1d7b0aa1005eaef1e6af4246d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cd3cf9d914d42e6e41336532136b781
SHA1f672cbd69ee95302748cf95dc323b83d56faf6d7
SHA2564fa8227e7936624550c39282da73dc535ae647d712a09476d8bf0e2e7f917a69
SHA51274c7533b42ca29bc107bb36d3a1f7e0fb59b9d291e52a5a9be3f118e5eb9e4e04f2d2ed9f9c3859c167f65f00b161b562e9dbb14f681174aee2bb5c0e7f45720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb4b44b75b1e48d9091c28e7bae0789c
SHA1fd144de0c633542829bc1fe1d82f63d06cb9c664
SHA25677870ebae9467db9f053f24836b218c85a17a64d295f648d2d96196ae2121f89
SHA51208bb8ad4302c42175d5cf5300644033007ed5497a4427aabe985d31758ce6452cd7f835d696375276e013fac0af9b3f451cbe089fae43411ee4fc8b4aae1068e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea2661312a1954c538bd8170a2521b96
SHA1dfe9ddf667fe34304e4cd4d85233ef806639736d
SHA2569cbde937dc60635807f5c6b6d09f26b37b084c955432e4965bf02bb92db324f0
SHA5128bbfc4d23b359bc1c92a671236a76d18899564f73195565458285ca75fdc99efb4612f7a27bad367a9b11cad1dabbc314fd8134af869ae081d4df913157be166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efb11224f9d0abb6f45edb142b0e8b52
SHA141c5785da5ff98a21bec8f44031ea530f8d39555
SHA2566ced31378a6d8d3a81f66636dcd9a8cc17b9c86d9c071fbf7ceb428c2facc17c
SHA512162b69f2b193447fc77abf169ddd4910d15354a9199dcc485957973ad3c78059cda907c37c52d3d77bd8bb5dc9bef0b47bb5f2b81aa2350348b4266bb1e8cfaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edc5a24fe048b93baa8bc0d6854cc579
SHA1813d026bff7e80ef8106ed33dec7984439861086
SHA256e7bc0aae830003ff22f956e8d2431073e9c4da0839568e3c1c0e931ba382b319
SHA512b24c0a142bb78442ba59aa341b73b5bacc4c1df6032cd3b429a502713be7d20d86ac4c9b8b00364dd05a8ee61ab1143fe6c861d76b5149bafd8cecda9dc64a0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572f0b57c91b04eec91cccecfb84e3022
SHA1f9e0909330da42a70010ab8fb0f9161f923c62f9
SHA25632eef1f7108a44967e6983a3160e0bf61706d2fc642828fd911a1e9ee5bc9e36
SHA5127279e743d80299dff010af4f858c5ec9f95e778147a8aff267e0b0a431027bad02bbdef6d9a0134b5d5d100b664a2a919d6680fe23f7c781aba3db24e5753413
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06