Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
1b3f2837cf20b8f187faa706416a922d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1b3f2837cf20b8f187faa706416a922d.html
Resource
win10v2004-20231215-en
General
-
Target
1b3f2837cf20b8f187faa706416a922d.html
-
Size
21KB
-
MD5
1b3f2837cf20b8f187faa706416a922d
-
SHA1
bc6f010a7722acc2c30101603c8b188d91fe01b3
-
SHA256
1ee8a89278a1b88a28a6a6fcf68ac56b06f5a488a91ecc4a6c70094cc84d8fb2
-
SHA512
ea724db7b35d52ae08c532bb10fff312b1a46277d062f081080e24627bb96664a2303157fcd886d9c6d2d5c5fb212e5187f05372db0a47926de78deee7692a6d
-
SSDEEP
384:C3gj9tc6j0eeeeeeeeeeeeeecnHn7pYnuRxW5wuguJmpQ4d:C3gjAeeeeeeeeeeeeeeqn7+nPZmpQ4d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FFB8181-AA8C-11EE-AD90-F6BE0C79E4FA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07f2d65993eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000db585c803426e99be582ddc8485ae462a2572699dfcde5285499f56049e9f94e000000000e8000000002000020000000acb3b7d57bc8e2f3059b69a48d0a36cac15f9005c6bbdb0cd82dc3921e975bfb90000000b054734da5fa1561b4edb8eb08833c1546deff42ff051c9b340466a79e88d04b25a8b362634565e9d08dab0a7932d9279fbfb86fe19a77c482bdda80177edc8d54d21bbd029e54fc886e0c9e9cfac7d9e424b9158462d0edf4232e59968e3c55e50a340414efb64d07c38ff4d893e29e01152eb5b7995f27479e5bcd42fff79d804582c91cba19f24939fef7788aabf140000000750530967e2503a743b8bf56552f18c05220303ea98ffa8b53e0603d82efaa2d33f5dcf1e5ab3ce31c2328f247c6354b75f6be9cc60592946c0a31fb51e0a049 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410484998" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000003d4753b92acb077b7605fd3058f4eb3c79b5856ed36862762346e6f96fe2fc06000000000e8000000002000020000000265497fd61bae54aa411d73656a92478be8f97a8f5a28f292f03a1b73d18f65020000000ab26dbf49b77b79e2af1e006e5051ce17a838ccf4397a078b64fdf57d547558b4000000001023ab1c4c4410a3588a2bd532e84012994a209b96c8a8d7cc5f44ae799f3d392dfe876536db9a7245f9d1fb84513e8b862d60caf2b2cf3885ae5933b8e3ece iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3036 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 3036 2868 iexplore.exe 28 PID 2868 wrote to memory of 3036 2868 iexplore.exe 28 PID 2868 wrote to memory of 3036 2868 iexplore.exe 28 PID 2868 wrote to memory of 3036 2868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b3f2837cf20b8f187faa706416a922d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54059e377d4642e98ae785da59508b638
SHA19c9175090720c7c788993d3764391fba3f0cbfe1
SHA25632f1da42888f2fb6714255f9047beb6081d81f7e636f13143c20c362273cdf28
SHA512817c899dfd87c351d03c1eb2273355377f5546dea6a9c1f71e43ddaf4d4be0b81b6c49d794838b1a9edeb365e106fbf8556265a8dabf93faf93d2b56a38e3b67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b181cae9493c7f072fbeee25a6ab189d
SHA18858fc04701f7ba01360648833f197f7e06c0fa7
SHA2561cba93abe89aedfd1a034d10c9523d268fec545c32f683cbbf02c9da51bbcc18
SHA5124ec2a3caa4108e4a368358894ccd77990088d5af3627c952ffc64bd7ad788e9ee5739bd1a7ce3db8d4e59184e81b6117650fdf9d85c17de8e62705a48daa1661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc53ff329fdab4c346ca1139cbe670d8
SHA10947fd5bb03b4980a5e4321d129adaa2ec8a553d
SHA256d9f11e96affb4b26338603e246ae7ae1f06bf6dca1cfe770f0ac8a5e12d90a57
SHA512f4caae5c06e125d555c5c1b0ebde225d67b476d9959e29d662f53d35c3d638e283179ea7a101362796172d5c0f53cb1683987cbe10cf7c35e6cd9a8a9e4c27a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521715c8f5b7a9d79a7b0dbcab347d472
SHA174e8ce997c200e2017799aa8d40b32bcd3361b10
SHA25684993b897fd4b9afed339011db3b406ff2a59a0f2fc6d19a57c3dff7ca11db62
SHA5124948edfda86a8d7f4e693ec8e8b6ad21402aa9b6366a0aba12ffc231e6ce0235c196168d0a0947b4eead29adf39073e5478b1c466a8f782bfc08a5a6dfe2d2ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fc41326fe1ab4b627ac74931c67a406
SHA1b70807e4a4e04320284d55efbe3273c3623df754
SHA2563bcb152f5545faf920c828592a4558c01867e1e13624d5d427d6f2dac104a9a3
SHA5129d294ff8854328d0d251f07624a86e11ef795707dfbba05568b21ea40cc1ec1f07f038fd53bcc0700af8010ab7842808c4dee6deba496d57cbcf488fa3728b3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9af6c1a4b579d42e1ff026f2d00d914
SHA1f779374993ef2026ad83d39ab959c79903382f6e
SHA256a21991a2c7dbd0c4d11acf9098ef89e53ed1e80b774eb6532c3e74906090db8b
SHA512713d13e578196cb22b2643841dc3c1ac1cef9ecf97109e13eea8b6624f40cde28ed614dc8b49e8e11d8dc51257ce746a0893e64735d2b27a9fbdacc56627e9f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53759bab9378923c6202f053fa0ee9e5a
SHA1d78dedc744362b9ff124266bd7b702e036849eeb
SHA256c723138a39826cccafdf9a0859ccf4171b337e10664a34ac318e0d74666bd5d4
SHA512e301ab66b6093ea1ba6bbd00209feb11f1f8e616b8d979069dfc6c4e8770e6c0c40bf82c546ad2a5268b5f8b558761921746ebdf5c59bc4d35716e130412cc44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a82a8a7a4b79834740b1279c0d88476
SHA1bd00a4e6ab8ce4101300ee8ca0da2969dd16491c
SHA256d51ca44246e60e379430cae93bd966abee5efa07bd3f2abb7d7b04c3257c977d
SHA5124d3ca2bf7e9f9de584205756e27e6995a87e4dcb575ea127bdd29b79ee89308c2eac18d0713df13e4b93d4efc051f82aa6946c646b3638371f1efd95613cac31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6069acb56d179c65a380488c84316d1
SHA11a2ce45db5f6c5b7737603f192d4daa3c0413860
SHA25691a3d2ccfecc12ac373dbd651bcb157972f675366167497f6b46c91b89df24e1
SHA512ef49df1d0ee4546dd18de99b3465f95b1f09e95711ddf7c0edcd8a224e8ddeab9f87066909f5304a4f0e3b7c772c9eef975b38250f2fd019d992283646f77c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f41391bdd68e8f9345d1ae7bf4b9aa9
SHA1f10790cf19527e74036c2a0d3d1255885ae2891c
SHA25621ced507b3bda8f225421912f86807a3c20ee10a14969150a7b12060f7c69539
SHA512b62830013b412f3d8b6b23b1e368de6e5f644f81233103fdd7887d1932b1edc4e844bb53abb92547461774b6c08c5ff843788fa43b8210f6d288b456fb79cb71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5171b7d51436b1ab4b45fd1dffbf54647
SHA1da7f894bbc4e83fe0191efb4088dd41a09d5f6e8
SHA25693da7650cf9860e73ae3522e31a3dd35b70e030bf8d6b03eefca2cce81b1da9e
SHA512e44e32e54ef02a5441e752c60e523c47329a99bb915b517e6c2ad3386039fb2f553559d4fcc3bc729a75dd7f9255be7953f9fe754fc816b3ebe66eb9483c3ac5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbccbd1a21a98b105e95a9e32148ef4f
SHA1c1310e9071a85034c018960b0517d3c4d508576a
SHA256ff56ca977fa401993a580f653a928cd9e21fa37743ffc442dcf9909d0a6e0e37
SHA512699a4bd8d06b467b312595f46c40647200d645fb85345bbdd3148049d6c51fe87cc730c0748dd61ed822b7b27ead1063f3abcfdc2bddd8f11b85887a146c9584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507bfe1a5da8cba15ef69542d172a60e0
SHA1fc5d427bedf80aabb8e3e3e062135d6275c01b2d
SHA256e9c6d1a917b8944debffec1cdbd877e6aeb70cdaa6552ecc942cd6ca260aef3d
SHA512d0dc52c567e73b8eee81a7564a5cf6206c54aee6d581d09cf27320551f23eba5d561554bea3abf8fb187a4afd0a62f31b9a3872727ade347196b85cb3e86a8b9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06