Analysis
-
max time kernel
170s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 12:53
Static task
static1
Behavioral task
behavioral1
Sample
191fc9fa51aedc3d1c62398835b3d5a6.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
191fc9fa51aedc3d1c62398835b3d5a6.html
Resource
win10v2004-20231215-en
General
-
Target
191fc9fa51aedc3d1c62398835b3d5a6.html
-
Size
183KB
-
MD5
191fc9fa51aedc3d1c62398835b3d5a6
-
SHA1
8d9dc33a3a3b2da8a054d55d1b236b509ceb746e
-
SHA256
e955ce4fc65314f703279e736fc2439e3b250ecda8b44de6f027ad0a7a6347cd
-
SHA512
739ea7e2626e59eb9d73f9bea6053934a3dfc5d2d000b963b6843b49ca3edcc61b2ca770a959aeb5bff5ae759ff1bda811f2bba3e777c91adfe097fd4d74842a
-
SSDEEP
3072:SZvfpARmJHt4GfVA47ySWmUO3BCyTPj4Cd3kGbB4GzN28y5pYTaOiHLOykfL2dcK:Soctt4GfVA47ySWmUO3BCyTPj4Cd3kGI
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000da4c6a7f30bc7aa203e134091116dc7e3f70db5d0253332de687ca7039619b89000000000e800000000200002000000045f4c42d85950ba5f308535af50db6ecf17d666db661a2c317238fa38e25b8a1900000001ca947d3ef706d9b9d2cff1794b597dc19abaedf54b40237023b6b2b0caf556ab1863cd80e987ccb5e5e87ea90af02f1bace932322bf82e740ba1069797e9d77885e395419fc69b3b28e178699ff03dc141e826bcef8f216559b6c5001863764015aa878953e79695070d66844b34e0373667df314ef3d89ad115f2b7793680d214148d60e2c19aae6efdb0261043759400000008c23285cf73a909cab6c54d8f8abf06d3de5564162774bbb04af8c2286ae98337c7c87cc75114e1050cb12acddb05edf4d867dbade02583c97c3ce37fceea4bc iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d877be4d3eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410452458" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA479DC1-AA40-11EE-8B4A-6E556AB52A45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000809f643520e9c3a257e17e38e443f1789f5f6e1456ae1d970968fae86affc363000000000e8000000002000020000000b346fe3180e6a64896f8c5643f699d2bb32f0644d105960b03a8eefc89045fa42000000025545f0955935044f60928201c14cf523bb2a0df80fe5a14e2ebfcfe907fe20440000000ebae523ce66af9725dea0227903362c8c27949835ddb262c3f216bfdc6e87b737c5f3cb41b5f833990a6f7a64e1f19a8a3067240f79a0d951fad6af394a22b90 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1696 2292 iexplore.exe 28 PID 2292 wrote to memory of 1696 2292 iexplore.exe 28 PID 2292 wrote to memory of 1696 2292 iexplore.exe 28 PID 2292 wrote to memory of 1696 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\191fc9fa51aedc3d1c62398835b3d5a6.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509bfe6ae2ef33ee2701d83bf6b73daaf
SHA1ee30d161996f42903b1002204f9422a6178fe5d8
SHA256e67b7caa0566e6099b09cb0712e1b5bb81ce630a708bf5bf0de27ad02bb9dc9f
SHA5122bddc04bb90709d4fddbef1afe9fd585b36a18e4dd6de900c18023d5aabd3c30302ed087e0cee466aff145a5cc4614877f5a80e2d7bc04bddd805b65b9562064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ded66467c88b3f115a6d2a3135b5629d
SHA12d2dedb1149bbc99a2a0b6c46580f4273611bddc
SHA25673b35e9f43ec289e83e44e5ac7aa590a51ea4bbcf4d34cb23b5f7dc36bf63ac0
SHA512c430954707cf989d10771d0262252fa2b4c822f920a2634438f24571058335d89859f9831bfa967f0f1e63aa0f8d8f3d2a953c97c91662814f8a9fb8cf7c7aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeda632912b180b8c873415bf1b972da
SHA10de6d45eedda0cc9c5fe20d98609bfa5e13c2486
SHA2563d0cb827a2046fd47f4d1c19a1a90b63206481fa3e1c363c015399540cf716cc
SHA512b6fa8498381b793e3c6c7eabd78c0dd9edee8f3f1c1ad6bbab11cc18e067409177244c850774c6d4828f7f45ccc33c8d18d2524f7512cfc599a8eca692951919
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3a3161b82661dce2d757c15a29900a6
SHA1b22beb7d5840953e67c65728fca9c7da2da60b0c
SHA2567d4d1f47808c4d80284128fcd2a8bd13923183eb7b3636d166880ae94c3fa639
SHA51262d5fd6c2509f0610885b3127ef5f4d7eb5a22be3bbb989353802d4dcc3cd7bc9d76a6cc1cc63b9c328aac4d42e3b7b3e5571ec6280104a8c8549d64751b8d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5470f738f269de43cb03103846495b130
SHA1e45eb7a6a419e6262b06e7af3b24ff45732e0410
SHA256e877a62600478c25e7499869cc86543b0d99f74166620b5912d928415e8b125d
SHA5129f682f5f34e132d73d6fbefa8a517bd4477edba1905fe1acb0d944da7b5b7439f16a5eaca27f4df58836bd65af76cadb90670a8e4033a7fd4759de4b3dce8835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500e0b626290002666fad81322a1b62e9
SHA136d2f84a83de382a6c75c0c166d9e473dc28f7d2
SHA25643db9da0406b20e518b313ada83867b0a5ab66dbfef7d2f7dd2807a568036f4c
SHA512cf1a880c76ce9f703a5ec96bba4b8ebf3b172e88a8d0d11765e5909ec7bef2fc2e3bb87eb04305e0b080d4121334396ede06f2a0451ca66dfbfcbc098024dd51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7ad329e052907938d134caddd4cb6a0
SHA1f3379cab73c186fef5e554ec114a3b6e78a31ef3
SHA2563d2c573976938490a04fed6a095b56eed15cdb7aab8ffd87c55acf9de7ae8dec
SHA512ed5a8babc6d59a8c304e15993aae27727b499cf3a38358592d7f6a111a697e1261aa15805157426a516ee0b1abbce34c63b4184e44ee9cdda6b54c144a6b4317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56529441143b6b668304ab5808c0a102b
SHA13f1b23d6b249408b1e19b9578a1c24c125eda5fd
SHA25655d9c669b07809115c810c789f61ebfe0bbade7772196c43f57ffc848f310f0b
SHA512eccb743440c7eda9c92b86d95bc7eadad27e04c6104be86bfe9680232b0f55b3c9292704d133d6e18b94cffe3d563c2fd37b992e8ef12fb43ed836e4078171c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beda989a1be799cb42819737d5b3caf0
SHA1a6a808946fc5cb5ef3b3836d82ac5116684e13fb
SHA25659948b24001b12208f65df48ae911e0f48a261c179afa70627ec862dddb1b12d
SHA5122c2a5d6c0c230c4f32124994ca9d3d63715ce36fdc8fddbd508ba09808ae2e8d98338e6a48d070f0c1c2328d2e1db26aeb6bf1c0b8fa4e89a10d7fa05e1b2bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d4230b56c70739ad507afed30e6af14
SHA13946becbf293ab523d7146c544f7ef658f5dbbee
SHA256f418e64eba782a6d0de791aba08ac76d83b50bc82fc8455893655cf0955e036f
SHA5121a3c656ebd1002764e603799354b4456efbbba40cbbfb229d8f7aba92c29b4c0a91341e94cc296b1327908ad84bef0e0d81de38f7b678a193bac5123251d012d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571e7f17b64f668bc7da67488fb3d5c81
SHA1b2cf3203c470221195aa9dfce036b58d87e78ffc
SHA256da81a39dba3bcd917af9f2b3a48256fdd436b606277b3c372e6f12256e88f133
SHA512d8f00f8e74c65fbe9d8dcfa76512a81f36917c70e3aa2b3a7963c46c6df49f35bfc3850ec08994ed76969234e68693354402927af4b87b6c0bde46d68d5e3416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57415fecc042e4b38a52e9873c0dd4852
SHA15f275f2eab2eda4ed712165dc84f364da2041411
SHA256e17648ee86083a2e024b1767b3eabd738bf37a52fa25c92baa68c4767a90aae5
SHA5126646839bc8b1f0be23ba5902f9239afc24fafa6f49a79da64637c42e8b5e0ac5801d151a6c05d2147bf715c4cd469ae8acee9bc2fc1c73d7bce6050a1eefc9b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cbcca9465dfa1698654ef5f4250a3c6
SHA1b23c2fa58b7dcc5aece8ece1977d52b57539c075
SHA2566260e8dd38c4bff823892353923ee1a95ea3f8ad79952a9a26ba44f363fc7ebf
SHA512c67db42432ff036f408c0e620dfd15edf88edabd97166e2e8f6c0885146f41b4e874f2792fc30f22d05b6864179f76748294b111404c4f734c8c966c85d59c36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5191104a2cb7d939bf965b63d443f2696
SHA161292cbb2cbce19ead461f34f31c158f01a6c275
SHA2563fd6135dcd19d239553f4db744928d6464eda63b76499d9d3b73a9d0656e7b42
SHA51280ca7bf27ffb86678b9f0a9ec667c5ef21b330ad3a8c0beb453270ac3b3fbebd1c5226b47c6140ae8e7b3b87e5d278b98f754f2eec728d0db25ac2e68623eeb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5566a5577e36e85c68aad84f95363a96f
SHA18b4c0a8637c7263af2f2a2c4c2454381d6c88bf1
SHA25695e4cc107cf9d207838f70ae7f1e6797da07dc6d19acdcf946ce9a6b491bff8b
SHA512931c3da816341c41dc1f285176eacbf19dea466274ba1bd619c10d20c63da33bec19cbee587c562574ba588613bf757ae4682aa64dbc608c335c48e566188ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc24b329846fdc9c51a83e2793a518ab
SHA18a881385680f2110bfeda00d7552a280ec506c2e
SHA25628eab8fac672e80377c3a8508dfb62690c88261850e97393ff9af0a6b89fb77e
SHA5125070e16f59229473a3e4cc267c1bc7332848862cad52ca06326041826ea23c191ce5d212ae9bd01365da5cc47d0f884c345f61686b59c3ca94bbd06437babb6b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\f[1].txt
Filesize34KB
MD582d39272639bc441501a70ca576e7d7a
SHA18ce126f0da8859377e77b348be9daea1a98d9a8a
SHA256f503bce6082ec5646c97c58190a3d7d217b9199cfe6fd61c7c4a3f3fc47489f1
SHA512b4d3fef420a13bda1057c7e4096aa6ffecaddee45b800c179ddb3815db41ea20bc5e0750b85a770bd4298ad748c185a645a4d3f064fdefa9ad10fc39de1caa5c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06