Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
160ce4ceb7f487f5d9f85af46566e621.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
160ce4ceb7f487f5d9f85af46566e621.html
Resource
win10v2004-20231222-en
General
-
Target
160ce4ceb7f487f5d9f85af46566e621.html
-
Size
88KB
-
MD5
160ce4ceb7f487f5d9f85af46566e621
-
SHA1
488a48e555cab6e2981d426540a5dad2f826db3f
-
SHA256
782e160777b4478b338198795c99e9194574620fffe02d02bb006008b6262c00
-
SHA512
8c695d27c08ae3cc619cc43d586c7654ee78f16a95f5ed23d9c4563016e15c2338a4a2efd56a6b5a7bc78cf5aefb4852fc013c1ec0d9f97b0ae5adfa62465c64
-
SSDEEP
1536:6OQeSGjwLBjXq8LJ7JvxWM9Oql2pP3g4fmK3t4FM9SjO2eJQsGembEpgk0H15PjI:60wBjXXV7JvxWM9Oql2pP3g4fb3t4FMB
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "424" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "5312" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "978251926" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "684" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "867" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "5312" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "684" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "869" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "867" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{654AD523-A7DF-11EE-A0B6-6E02734BA6FD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "500" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079404" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "869" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "424" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "500" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1080849849" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "500" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "325" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015a2f750fe9ee1479ecf0c8cfb11934c00000000020000000000106600000001000020000000d1c8e28866c4c3f82f633e396afe1181ab4ea9bc11305c64c8701fbe5721ef22000000000e80000000020000200000003a68f0bef5951fff605d3660b71fb248183e6e37612542f62a8d7eb7238ca6aa20000000009123529a3aa361c6fcc6ad6233ddab9801cc6fb893fed5c98693d6f729d06d40000000a2409c02e2be0c90307792016ac1ca4b36a6fceb9456940d8c6276ce1eb414b045422b9c4003a00dc1c42054213475ac360e0ab5992bd2366d4608fa1e547bb5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "684" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10314c46ec3bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "325" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "418" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "585" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "585" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410793816" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "418" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d94646ec3bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "869" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "867" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "418" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "121" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3803511929-1339359695-2191195476-1000\{CD3B28EB-EB4C-4734-9BF7-35D1DFC7D891} IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3316 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3316 IEXPLORE.EXE Token: 33 1532 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1532 AUDIODG.EXE Token: SeShutdownPrivilege 3316 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3316 IEXPLORE.EXE Token: SeShutdownPrivilege 3316 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3316 IEXPLORE.EXE Token: SeShutdownPrivilege 3316 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3316 IEXPLORE.EXE Token: SeShutdownPrivilege 3316 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3316 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4632 iexplore.exe 4632 iexplore.exe 3316 IEXPLORE.EXE 3316 IEXPLORE.EXE 3316 IEXPLORE.EXE 3316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4632 wrote to memory of 3316 4632 iexplore.exe 87 PID 4632 wrote to memory of 3316 4632 iexplore.exe 87 PID 4632 wrote to memory of 3316 4632 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\160ce4ceb7f487f5d9f85af46566e621.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4632 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3316
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x3041⤵
- Suspicious use of AdjustPrivilegeToken
PID:1532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD502a0e9c1577db47d26d71a151cb3654d
SHA1c507d01d7eb04a230feeda2c8b863f7f6f82353e
SHA2560cd425376ef69704fec5599de8639b12f5ac400630de06f09810d1d664ef7b31
SHA512d0c166c6fff8f4866d936fb41f4fbaccefa1a60b235f262ce0e8914315effcd41e2abd9d1a0b39df37c4c982545e170f2d0eeed91a13e738609555e049825390
-
Filesize
8KB
MD5f2b191a4a175dfbbe8225eaf79e6e71f
SHA131f35e5ab12389d491ee137adaa9b12954635c69
SHA256709467eec1b4677a729c2a2340ccb0919520a12dc8f59dc8cab23ac4d693a277
SHA512abe4829e17901313b18f48e46b74c6a2d86b99c1d9ce6532779bbd66cc4c6b36129e871015235be63f12e52e495b08d92fa8f4e2c1b1c4a151fe8b0c3236b1de
-
Filesize
8KB
MD599a6417ffc6402dc21aa31e79a247a26
SHA1c8616705d2a53afaaa7ed67fe39a9a412a7cdde7
SHA256340992a6769b21526299d6e7d8ac963e04079f5dab9450c87adcb32187686b6f
SHA512b848e9e0cb7872b9236822530ec9337a8184c2a9400bd2efee77a9a7b1378464c2db6a641a0f5c7c0d3766ca57013be480210afaeebb0f080d837083efbbed65
-
Filesize
1KB
MD5b7d6863abfea857bc278ce8337f21cae
SHA152a1f5b2f018ed821dd7c971baeef1dfba3a9ca2
SHA256f7465d1c257bc10fffcbb341b4a83d3bdb3d45f69ae211e760b32da014e21dac
SHA5124ab2168e1ec6dd2b8ee6a0f6acddec647c8fb0f67d96d8bd6a3f943ede43072bc9a74aa66572adba06cd171f0eaeb630d3e4fdd39080fbe3fb52831066f2b391
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
156KB
MD5634511129c26ea9e7bcaf3802f919b94
SHA17b26342bbaa173bf1024e60190990041dbc6047f
SHA25616bd2bbfe5afc0cd0114a20fe988c057f926c67a7f35c7735d00482c6d05f5a5
SHA51266c528e702c0740845f7d5a9aef2fbd1ed9a8a2ffa7a1c4a85336d9b084f62f37756c6fc1f510f49073d4dd4196f274bd9e89c98b0162e8da57e02fcc94bbd50
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
92KB
MD56faaa92563eaae49cb2647d9efd59b29
SHA163380b6f13dd654cf44b72bd2645b91efd5cd278
SHA2563eed6e8b72c2645b5de21ef08014dd708aeb6537411277cee928eb11b145f0c2
SHA512b537e507e2ee478f2d0e06b497c6fc6c64b86f0855a977228f92ea9655b71c9023f0a8cc234235056ae48ab1d691581f6724c176e94ad284045f790cd562330c