Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 11:38
Static task
static1
Behavioral task
behavioral1
Sample
1752a9a27033669b4c34541793102427.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1752a9a27033669b4c34541793102427.html
Resource
win10v2004-20231215-en
General
-
Target
1752a9a27033669b4c34541793102427.html
-
Size
205KB
-
MD5
1752a9a27033669b4c34541793102427
-
SHA1
f862727fb1549b0bf8b7c1ad8c318e9a50c93b55
-
SHA256
aa8aca144c68fb5009ab10ef8822a80cb48c39ee17ec59c76a77e73c97e2c7a2
-
SHA512
c60ef93f6310835b46e3251dd3e45f511b64927f31e5778291a671f39def434a06294985ed0fd299142ebdf4b33d6578ccf50e2fb46185aed32769e11b6b22ea
-
SSDEEP
6144:hcA9UpiRtyWK2vawsbecgW+VbGfZr3zQNDDS4vDYJomd:CwUpYyWK2vawtcgW+xWfQNDDtvDYJl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20065d031e3eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004026b60d2c3322a8cb6345181c7ae9c262717e8cd7783968927af687099db433000000000e8000000002000020000000f67950c9c6ffb56b22bc67ffc831c30fcb61c2889ebdf384589fc00cbf6335db900000006aebfabd5dbcf97bbc977fea5bb449101d30f6a4f5b93c354f4d56863f282e1f888ce6d8a9cb3cbc5cf746a9c23795897c04e2b0d81f1bf7870f4eefe80d9860d83bb2cca8a9d447518be6495ec825eeefd26a4daa8ee5fc3bb2e7f25e53aaabe33c6b158ca8abfc4a8facfbc130495bd9ef935922ce69f8edf03c010cd122b8aec00afdfc4372fdc32c92c9f128aaa9400000005ce065da4397b348e1c27259c31f8ea712ba99c2d981c6e54ee0d8c7df4ede9f8396b236425f232e29a019f6441df7c24fcb6c5d9eae9e8cd96828f8dd533f08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01F31D61-AA11-11EE-A892-DECE4B73D784} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410431938" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000db601549d5f22bec81965edf22dc83067f60ec5e5728ac2f6c1fd0db3f033c49000000000e800000000200002000000086c56112ba3bcb113fa03725114a26e56380b202ea3bb0f29312fa29aa007219200000009a7495251fa84a199e4cc5bc2d8aaddc93ce41ea291fdd12eadbdef95487959140000000cb598957c7776cf685945763d83d856e83e09d390acbbac85cd8e25abe31bb277f909d2f5f7b4366aeb02f65b0ed750bf726090e99301a6ed746fa4eb4560c8a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3064 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3064 iexplore.exe 3064 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2640 3064 iexplore.exe 28 PID 3064 wrote to memory of 2640 3064 iexplore.exe 28 PID 3064 wrote to memory of 2640 3064 iexplore.exe 28 PID 3064 wrote to memory of 2640 3064 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1752a9a27033669b4c34541793102427.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fd5009956062a9e2b98bd69e05e8306
SHA1a77d7443bb41ef9ce0cc73122619b3a11df3d7ef
SHA2563adc48d3e96707b97b6c20adeb51d5b69fe1ed07429f3f797837b7c0b9a46e5e
SHA512443c1a17a7d90c800f6276f0d3069d4895044e6a0ed91b57b54f976a8dd7d64b5a6d92550c501d133ef379a9d118fa70ac72c3cb5c38b6f953e8758c7cf7d87e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ac6c7fdfa4500b82d197b9937711d4f
SHA169516b59f5264b2e6295f588d3be37a6faad2017
SHA256622a0a8910fa81a968959759358eabc2c82ca08b44316183ff04f1395daa1756
SHA5129f67a4462c65c0c5cce23d1badf92df1c18512c691afefa9dee0a14d60fe07edec727f25aa5dd0b9e0510e95a9c08c76ad230cc25f3f85dd99180f899cab9c18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545d470417d31042049d715181968cafe
SHA1fa22984f934df17840c3b122fd78df0dbf7442c9
SHA256326e5db730123e730d2d3749cfae7ce8a49eb0b41121936a871675db22485372
SHA51294bde6fb01d181106c9683bd41e9757fdd2d70d2ddaf72e6786779fa3a0d55ba64f28761e718decc3f0c687572f639d7050e666c9a7f46f8940dc9343086ac19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515e9eae302d5d490e3aaa1d902135c85
SHA10b6635da3b1999813bb7cf92dd99257b8d9b3b50
SHA256ce3ce5f5e25e0a817ce39e2692d58800fffc5b2f22da5f6b36b3b67a55c9face
SHA5120fa84e3836e5a37fef2d063304399da1be757cd189625981f1a5085356ef17bc4472f1ebb7099685683a507abf11f0e2529e32d8890d348c62f51ad3dabf3252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6efb1866682b62a39b31e0e547027c9
SHA17029a592ecf5ced5899f5dc25de01483b389af78
SHA2560dc60cd9f3690186bb2d70e5277b896370598b1379983f92d6975cc92b5b3012
SHA512285367875ba5f20f7498032b01ca3f0e57a79ef26ba869b86c56e15348d17e2fd870847df083af9a52ccd416b6a03295362212f3e444d2e791a0de1e332fbbec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584832889e631a90658c2bc0f738f3877
SHA1dc0b875765785914b3429bd1d1fcae45e7d89d34
SHA256add78309d7ee9ddee9158cf186ebb6ee4003aa7c8e579784d09ab501a7a107a5
SHA512e06fe0fa7e61184e5456b24aec08748b0edbc0a2be05dad748bfb22a64932cb9f2f3beafed1f28485a495ca1fbba575507bc04258a93646329c541b5cbb4780c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599af9f31dfadd5ad1322db66fa445731
SHA1869d41bd15c15b1af62cb0b584c9b188e4fc0a56
SHA256b98429cbfeb5b188071b28ec120bcf7711191e78ae6d429f9386d1ad0a7dc816
SHA51294bae9d6b58e57b1f798fa4b698daa1e1e048e33587112804bf5a286202b363345494b578d579f5cc172de39194ea575b7840042bb3beaf3576cacc541415988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e3d6526c7f9db1269c9c429c6121a71
SHA18d0efd062493946eb65042aa3b7b42e00d01e02d
SHA2564112ff2105d5b7dc8d1877a77d05b2f96c4f6608c6c84f1c2c40a6f8c6fe7583
SHA51235ffc6008627bbadce403200359991d19806ce8144df532e850886cb4e226aebf7f3114a1859cb14a350e43e7a2a69e64702f56903cf09442eb2ada8d67d494b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e4dc2c6d9646e17a515ea0953897711
SHA1bbc5db679a402ce49857f204b46310f7bbd2daa8
SHA256a111f9f1b25b2cad867145827969d2038e7890600afaa42d9f4d1233a015ce14
SHA512087d7866a0f80e05ed57c7444648f5f58672d4be3b3b99edb4be7a99bdc066b60f690225d00bb8e1b3a9d91c19c041f9a26b5143b53d264e7fdd63ad67a9c055
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559951a66754f1d2c2a04cba38ecb70ea
SHA1cc32e0c12256532e79fa26e1180cf6fd2b107921
SHA2567481b2e72f2bab6febfea25dd9cd476f55620d2a51841d73b05b5f4cdc144af1
SHA5125c982d8cf9568733888e5184d3fda2e5ca836d3f9d4cce1782137d23e1c86df6d4a7713a91205ecfd5826f89048385f9c29b27348aba099c8541107d6d01a92d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7409a3b71417113e408ec51acd00672
SHA18269bd57145da55b1b35c8ea5f32a8412146928b
SHA256f8bf547d662261b01679f70ffa466a2799e542e8b1ee150ac31a50047e722f2e
SHA5123449a953796f2a5c96e66317bfc8e3b5541e99c5017172461bf35b8341bd64631ff198b499e2da000725d92e496d0caa0cd7348bbeff6af967fe51d64491a9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54593b5dfd1b10f02c8d5ff8a42afaf26
SHA132742f8fd9d760017685e745d333f407383fe1ac
SHA256753710936fc29f8d433e40e6035b401c9b2de4aff6c7fa02e8381964067aec60
SHA512acbefefe73287a4a6fdb44205334518599fbf380ee46694ffcd87b08547001293b35784a192023043eea387c313f64688bf07062189fe52ac8ffb069d4b4b26b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f1710eb6b751ca2a089e407582c7f2d
SHA171be4c514f4f600fe1d8dccb8f6641256434b2db
SHA256e58badc2faf66fc7d302e241ecc786490db3b9a14f4e1c976589747167308588
SHA51251c70e2166d5884e166cdd3e23c12760fb661dc9fb45abda7fdb266b13b667fad654155e797be1c2e9776c3e792e831113300823b5c4a2f431969291543d535f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1b0200cda3e954021f55bde9fd540e1
SHA19bba70ffca9cddaacb2889a4d2ab68c732109164
SHA256dd9cdba95a6ee69fd7c0a47a68dd4a6811058973683f5e3f26da9d3d433172e7
SHA512d343eed3e5731f9ad585a15c4200ce40615ba5e486656fdad5bfd2ccc274c15418b9356406cb3f344afd0a047f01faac44fa0e8ae6f2c098a1f0a9572d06b0a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535e324993bcab4a7818cc9f7945d7d05
SHA195fdac718fc6c3f7d681f15896768e2cc9175943
SHA256526fc298c827e7e10babee52e07b4fcbc04eaf9ee4c07487cec8c334befc7dec
SHA5121ad3954814375ccb4f2921088ac182b2581c764c76cdbd708dbf67f8c59e54c395fc7c23c63a1341990c9b7ade89d1696c6d95ecf0235d6bd9450f32d868c3db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fb994debbb2dff378882a139b4103e4
SHA16e25ceab9a821b45b551e9f4c2712cddba18ab96
SHA256ad4a7fdc16507f01102349e7218a1f6b023186ee6dfe4ee5e77fac9171b5e8bc
SHA512c226312d4117bbc020030257a85d5515657522537015093df08098cd72fe9a5056b85922b4cd6ffd89b516a395c37a8617a750a8084f3651aae4ea6278464aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5119c308bce99ad7356ec211c6dc5c710
SHA13756b35948d2c16a9519a8ade6af3d3f27268a76
SHA2561490e8491fdaf73d6db2ae9f687c40cc09b547ecd683f854fc7217cf5655ee80
SHA512c37038546915389f561423688d9a78d013614eab98087972df09fda2612ada9bcf7b890dd4b601c5b07e9bd5da83d8cee1b3fcb18f090e3b6db67338e4cd43d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\cb=gapi[1].js
Filesize133KB
MD5288c5ba5b7001fe841c32f690f62cc93
SHA129aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789
SHA256c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52
SHA512e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\platform[1].js
Filesize56KB
MD50d25af623d803b10050b53a7b218c652
SHA12dd71fa961b5df37134bc6eb987ee7b7e5861488
SHA2560bcb6531cb0967359e17b655d4142b55d1eac2aed3fe5340f8ce930a7000e5d3
SHA512919b48cabd548ae63a6b89dd3ac4df919b630b0cf75266d21b35ea3a6b54eb1ea5ed7371e80bb6611e105f2d994abf9f76f6dd8b6915dd2b8fda09edd263c139
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06