Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
1ce2b99a60a585447364b2f36828b82a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1ce2b99a60a585447364b2f36828b82a.html
Resource
win10v2004-20231222-en
General
-
Target
1ce2b99a60a585447364b2f36828b82a.html
-
Size
3.5MB
-
MD5
1ce2b99a60a585447364b2f36828b82a
-
SHA1
50ea329f7186e22519460ba1cd881032ec815628
-
SHA256
43cbda8b846cdc46cf4bd3c5137fc5f47fe4a4f08a88aba2ecc8d99b94e0c1ac
-
SHA512
e0885b21730ec055ee980c343e98ad224352beed3bd17a6e1872ae03ed7b0be0aad9cbbd7f9145faa7c4ac93387acd111677a2997bb58383fdcfada5db5c10d6
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NGz:jvpjte4tT6Qz
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410527272" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00D1DFA1-AAEF-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000830a8fa867cbf9225af930fac81082fea701788cf0662daeae17eee8cd100c5f000000000e8000000002000020000000d3cafd86495b6aa470e291eb0f63a8526063e1d81103e935538ee87f823a56722000000085b505bfffdc5426965b2b51a0c340d63fa1c95b39ed4d13234453ad508a3186400000001c31651f5b3cba25229f358d02b72244b2d3caa253bb7bd3543807abaaaa8d37c09976c3837d47750d3cd216f6109ee4afe501bef48fe07e09dfc025333865d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003fc1b343711202a40baf780dd3780ebddd4de6b2887a50be3fefeb76196d531f000000000e800000000200002000000089e3a3845b8c4b9d66f5dbf851072974c51277bc3282daeb2995a3491191f16c90000000cc09939d478c353e50fb9d0884888bb23691379d25eaae230752fa9a80f19bd27441efd959de1af840fceb6ca65ea29beae29594033db5743647fdbe37b42f1f9077188308a1dbbd4e873c2ff37e3ea9df195ee77df913636c1dc2f343e296c03602988361ba34f3964a734d26ae779db7b3e69ed7edff1e2488eceb8540b76a1765d598fee69799f56ead27d7569eb240000000f6e08fdd522a2ab665dabe8ac50942cad75c4be5e1e18c110d83fdf77e4deb69dad81043e940a3b52dd9efd0320f5eaa50a131b6708712a71681b3668000d86f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a5d4e6fb3eda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1996 iexplore.exe 1996 iexplore.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1976 1996 iexplore.exe 28 PID 1996 wrote to memory of 1976 1996 iexplore.exe 28 PID 1996 wrote to memory of 1976 1996 iexplore.exe 28 PID 1996 wrote to memory of 1976 1996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ce2b99a60a585447364b2f36828b82a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5029fb1a4dfbef57ca5e8d68c678830d1
SHA17b02f2126ebb8fb033f74f3116af75c293188ac2
SHA256bbd94fd43394ac6f8dcb32ea2e2a5b9657c6f18cdfcfe621c946e9a3c6d737ea
SHA5129478b5e21756920d4563db78e42e2812f194b8c11065332e07e2dcb5333a59d27c1f818b32a39064c86216ea650f4b68d3f33ba6399d30f2a485e3133c2e67bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b45612bb33e74635eb5901835971501
SHA1fe0edf7edcc304740f40f830cc2cbc1c2d65a2e2
SHA2568dcad63c4122598fec14cf753bed5411b658c017db30fef6295569293384bfb8
SHA51299b5233d8f05f9bdbe4b6a5af5869ce58ff72448d710f35c9525653b9500f59f1ef4411ecea2bdbe172513c13d09d49017efcf6a07271ca0a96a65cc9ad1d077
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52727b9e20dcfd95cac08a0c76562b673
SHA17829f1dc7115980495d23cd23b68bdfc03738b4c
SHA256b9bda7ca69cb2e38dac6c90d543a98ed58874ed9f2b65305d6b8ad7d73764f5c
SHA512aaca32a09c2ce929a3f91a12cf2da109f175393a2eda3233607c90dfc8a36b78cc7d8374a669c029ddff35e87aca7fb16cec514c3deb1ef102fdf5c348336a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fb15fa6611f4b8e7974512c67732aaa
SHA139fbdcacc64a4105bf6ba82671a7d22e839b804c
SHA256737cb07956d7a328bd28bbdae9680ce60ff2537a8367abc28d4bbd14b3bcf5c6
SHA51261f574320fbcc5329d4698a24dbbe54182fab93e204d4021d370e8ddd49167ade51c330adc79e0ea947aaab9ac26a061d2553925ad35ee3860af531a54bea384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a34df8c3efa0156c6c9f34eaafcf584b
SHA17c3a051b560a62f49cf42c8bb5a0ee142fcfb946
SHA2563874d1b78d8d85a7dad54aa2f8acee90fbe4ffa813331a62e6173e65c4fb0312
SHA512b2c2c4650d05793f6e239242ca2da9c1de7b25975ba72cc220a8b6fa90f9515116ea4e61390029ca4e40df064e847c58c2e8e067ff80076e05fb7c13412cbc46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc3fc6da58f0037f2eb085bf64da7ae0
SHA15e83f443ada5c146aa967675cf218e209ce12990
SHA2567d196ba318848c26358b1abd803ee4af5b21b9606e5c55e254c127b853cb9ab1
SHA5127b67670dc7c7e70a9009acd00172e90b047a11a8b7add14c40d58ea9fc4066e284d8a6336939b7ba702523f1e34fe5525c29f19dc922a18c3566010a5b53b748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab6e0d978a75d036d22233836e10ff45
SHA15c2e11812ff65af8773a44d58122c3d68b982a81
SHA256c3930145bb9c4a33942d413131d1d801a2d19d471fb29d68075605461b01108a
SHA512a907b9161ae57a247f39763081915f717e462138ec3c4f000e55e80a087987f51b2acee93b07b1bea8920bbb570c114f55ccaba673199e20d725d96f1de29848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586ffd53fbe0e4692aabea5280ec73995
SHA10e0f4edd34b00dd426f1bbb5b21068503b93da4b
SHA256af0e574cb5047a27248658b65264ce86f692206348c76342d2efe0cc4d19cf4c
SHA512e52a77229ed7004c548e96f70aa47547216199d3d161fe29ba3184b37076285f41a6289a718bd916565402f17b543ad18c4d659a6958df38833a1bf7ec5f99b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5683f175109fba0994455cfa29bc41b7b
SHA1b174678b729d7c267785e3fc2ae6141dcd201c00
SHA256b383435bbfc14ba4f0214a65f108048efe3ce6ab77fb4d0950341ae41b16d56a
SHA512fb4283debe80b568acb7b181508e6f91bea4b5c485a64dcb8707a7ee6d86a50b25bb4f4e9c6ae493a57af2efb4486fe2c705b0afd540bd8fd12d94d1684927b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551eafc05a5832bd006f2330c14233537
SHA1c44f882cc8544c65f082506655ebd767a3f6e1e3
SHA256c05ab7fcc24e2e8324a2774ecf5e2be2be6acf2db73419cdb12add604213d3cb
SHA51274eebfd9eb1602a6570a9b6efb0be4acc8b13b25f8f9f91fad71efb8336244f86bec5edeb56d1e43fba203ddffd7f6feeadfe24c9f48143accf1750d5a80073f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2617c20b2f8ea6c6c780f462dade9b9
SHA16a9bcae897b44dfb985d45df4bc990bd7da74c78
SHA2568e737249403c21a216aff5d353cc4d88978aff5a3891ebdf8b7d96107dec0901
SHA51298e01b3a6fa0632964e577abf7e80cf80e540eee9c099e52734d5addc53eef09c90eba38a968000d48940464b2ff21ceab0246ead57d8cd90635f0252b4cf7e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d29471c720c9d71ef8d932b426952046
SHA1baae3e5d67f62e3eb13d6175994de293e4baa9e3
SHA256818ce9a56892f3aa1c37c63f511f80945b744f81423ccda982d3c75eab149cf9
SHA5123e57fb856accbf90d16ae655e03189865e3d8908a65063acde30bbf8aef9185cbd0ab5e12e1b4ce35a0c4e4ae11deb89a0a5125b3ab60bc035c134cfe5c9309f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bc1090306f60db6a2b9154e7f007887
SHA10483bf85d5d3e7062c05ed7a5317dabaa5c6d5fd
SHA256261b5028279ba5f78133b3054876b71a2d7282fc5d37ca412782a7729d8c3723
SHA5123c1153f96406ee1c9f4f165d60c39c4fc7997f067402acde01539016664590eabfe1f497ae40ab0b669f2574670b99d2f28d0792e61352bd8604ccfafec3190f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6cd0f0318b0f03808b60976882e6fcb
SHA1b2a39fb072104c168351b0aa3da8a9a21f5d78ad
SHA2569557f67acdfdec6420eb251262fbdbb25423be71fa824962586feb22c124cc0a
SHA5128535ce17a99a4accc77b25ea57d471696a4bb1080d28639a0623329f60e838a7685170d6548caea6cd3450e2373edae7605213d03580bcc2f150776637de37a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52114e17bb79cc1c5a1f2469364019d4c
SHA17753ba81215f321a03c2a55299a17636e547e9f7
SHA2568ad7de6c33a2c145ab40a2d52a58b63a1f3dab175e5416003010f76743e82d7f
SHA512b62075d4a98e1badba1aaa5862b3677c087476533ad74ceb6cc25d2e67fd7b0c4f90eddf7b1aadd7bed911e80550944e43a58f72a17748a0ac97773fd2f2d6a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565489ba0ecde0f942995634b130b3c73
SHA11b46c14b8b4d94b038701470f70875d61cec5859
SHA2562de7642cfd3036f08c8115656afc010893a5b3d0a354be7b28392bbfecea145f
SHA5121bb3f2b98452a41e86617fb4c43ead62c4dcdadf5e842dc9372d8dd8f667525fb8e7479e12497deaac539c5fc62511d06c2d5f95911538332b108438a837e6e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab33f3b05ccca137ac61e7413188094f
SHA117c3aaa29ffbbaf3ed60819ba07a0c78deb32d43
SHA2569d61bb98b4a0d7212e0ea1eae71fa7ea52f6eeca81fe16adea6f9d317eb59c18
SHA5124ae641873d43b1b468979bc406fc19f66c1ba7b8d8e1121acce4189f8ca724c41fe088667306dadbfcd0a46e3a16be0a01fbd808e9395be100bc4ad9c9b3662e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06