Analysis
-
max time kernel
139s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
217c2c623948af0175b592b757c3c298.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
217c2c623948af0175b592b757c3c298.html
Resource
win10v2004-20231222-en
General
-
Target
217c2c623948af0175b592b757c3c298.html
-
Size
2KB
-
MD5
217c2c623948af0175b592b757c3c298
-
SHA1
3b74995887eea9497c6b0d1ea5c70009fda553b5
-
SHA256
af4b3c1a188ca06748bbcb157ae35ad7e31afa484b01712ace2f8e0891e8ab85
-
SHA512
a960c43072ff289472a0ffa3dc1bc82aa6a2d0f3219d4f13083765de2552bea93a5b90807631b2e5b1e05b0d295fdc4e623f2da74f98e47213ffd783898c170b
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c9c62073e01d56f59b0d127515af54e9ba5505c8c43e904b32c3de7f6e636967000000000e80000000020000200000004c226559fe4105c66d252cb2dd353f33b4020728f2e2e3253d3233ea7d4bf2c9900000008d39985dd1952ef6bae68b29b044685e5dec6658e7afd173d68d285d32be526c4eee357d40d2460d4fd4b62e299b192572e743f4bf71500e53f2c049d8dd5e7a4dd6c91f94803dd0dd9518a50874a5f25ae4d07f71ce7260aa374b392f723a509177a0a16fe08f30b943533d6dad9865736278ff1f9f5fc17af7731074cb0665efb09efe780fa43150fc4e0ae6fbd87f40000000f45c6c874fe9f3cce566ff5799b10e35386c5b55d3012954273009472d27df4616b8fe49e224ef07f3da5b487474fa550bc7b36d7b31aaa8180ee1769766830e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410284170" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400875d2c53cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD669F51-A8B8-11EE-9D5A-6A53A263E8F2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000cf644aea72666bc1c329eb6e03e250dc419d073aebb47c25939c9fe39334d2b000000000e8000000002000020000000ef040df52d284142467530ce98d783a50c7dd20084d5797d3bb929f537cc0bda2000000050d55e16363c104846e1981e979e21c661f56992072199462a9eee336c66be42400000006aa31c7b272037336214d8dd2cab01f680a79ea5ac86127432fa8cc79ce5e1610648c537efec3726812ddc74530f1cc0a991c04e8dad991a9c72fc94559e2415 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1964 iexplore.exe 1964 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1984 1964 iexplore.exe 28 PID 1964 wrote to memory of 1984 1964 iexplore.exe 28 PID 1964 wrote to memory of 1984 1964 iexplore.exe 28 PID 1964 wrote to memory of 1984 1964 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\217c2c623948af0175b592b757c3c298.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e3f6a6b00ee59eae8fc76ea1bc90105
SHA1151ab0652f1e64ee33afe484dbc015a34b8e9c94
SHA25618d4f1d0aa60b9cc44bc1964da32ec9c795e6d51c30c44cccc15bb1ecb07281f
SHA512e02755bab6f634b0cede60a101d8663e8675e10d3079f01590cede7a881837f1fb244867aed6bece679e386c21fbb843acd3ad403620d29ba657e80c049192c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543c9ba8cccf56d43412bb65747d9efea
SHA1fa1bee1d373d17eef502349e29de9f221500782c
SHA25668f0c018cf96d024ca339f555f34770488b2347292be42927af19ee5660f3a55
SHA512c9e5d9f8d696932f58e8a7145e7c004168b76bddeb929182e786f4f3923ba592810e5afee3c0f299316e6a52d185157cac5c0b6fcb270c37e6878acd2fa735c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac17070477123470d7bd433373d18992
SHA1aeca6bf2187e18477bcbff22cd3ad457d6cd7135
SHA256f8f2566eb99f2a00e8e4f5df4cfbc4edaf36e028bdf5cdc050da214440caa4a1
SHA5127ab9df4853dab7cbe63e89ab7605d2f71ecfbb69e9c2240a46c855333dbec8df46208d15d06eff816510792631dd5f7fee2cb9bdf6433286c2c7ac66a83b7400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543af3cf3dfa81a1873d096ff13ba52e3
SHA1a3c61ec78766278258747b2ed61eed06ab3090a6
SHA25695b3d4b9e3c637deb6582c4eb88dd6f73f23bad5e306eabd725e8ae6f3b334d6
SHA512f509f208f6be457fc13755ca6a39a9dc2264e455d09c9974c698904d0b2c8e09b3218863e4375738048e408eb9cef83d9af2e118a0ef7cb1b30203b1410b5a98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c9987a75a50e58496c00433dc7a4701
SHA1dc2e48312f7a52043ed734c7591fcae0f968dd59
SHA256213b16da89b355c7ffb96ce8e7f72a561f6fe38f82ec4bb95e46dffa25f61e6f
SHA5129d6f3b4471502e0f95e666758deeae3ccb7890e6ae710a3a458afa707b43f537884f2c60d98e4169e2d6d0b20f5a0550fdc02e9ca427e1602645259688529106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55690479819ff4a637bf0640f63634928
SHA11f5b4d80a2746ff04fa95ce0c3c3e1f3e0465de7
SHA2562b17ddeb5e8935c1b89dfc7a91058fe5efcadc6e3128d701a4946cd66514ace1
SHA512aa92f2607aca47ebf2950ea7b1c475fec2ff0cc8c0f462ab085c34ce54a7fcd4606d85878de492723831e5a4b1938f9eec86d1a57a0d2af689c0713c6a0c3679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55560eaf5f9cfd8e5cc73c96da8c4db2e
SHA179ad34e8b80af75200fbfb1b2d6430bac8b37295
SHA2561a1d4fe8c223386afce78a671b56463379b0f1ea416c3e08a1c1a03ec7825d30
SHA512b3c946def5048375a3a7f8ae38eb03d19d2ec1fc3f457136d2eb7bb1c6331d1c1b54ff53a7b930aa431b45f586269fee68ea5203e649e035d7a1abc8e170b0fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54200b2627728a81cec14d100847c1349
SHA1a8dc990dae87dfbfa28182f7738c31041cef863d
SHA256435d3220e4dc827ef9f42ebaf7959a12c8e1b1c349b80be320b8412a40aee92c
SHA5123c1668446d8b5f5dc647a1a35b84f8a7e4aad8c7b29a8c477183835287a5321d0f569fae9742a10495e96a8629297cddbd8e2f26fb8d69e88ce13fdc038ca5f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cf746971c5f185b0f1c9c9d2b53851e
SHA1c60d225813788097bd9518d7a791b38ccd9de9e7
SHA25610631333c3721d558600b5ac43f6ced50296d402f887e3cea762cd748454f656
SHA512a820382e7818f4d7a17344c873cd7eeeca4d7ea4ef25078f1a7582868d318981337db9d62d9504db9bab8937a8197bc863ee51a93c01d01f810783cb695176cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581bd830bc450ee04933a37499b5924f6
SHA1803e820e7c8257af2eb6002371d2115ff3880b08
SHA256fb61b7538d6c4ed3898376b54ec30075e23f657d60b1dedd916787675411d414
SHA512e80f3302b7bdd9d92154f8a1b01b6cc94412a769219c4658c5092af459a22838e8023b21bfc0779602d7cbc64fc2cfb18895dd0c947e42958658812cfebfe42f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557600a505b8bc60bf045db27eb6d389c
SHA1c3ed826a7118a63c81ef56847e2ef86a215d0cea
SHA2564d6808e4eec2127a1ed4db382a4ccc314c90e1e156fde7a93522b1964ba9d4c0
SHA5128b6902f4511f8e1cf1ce3df3270b9151f5e299e73ca612763169ba13d6553e5d48c76df23ada5eaa70123398296e21abd8fbb5dff7b12c00b919f47d4660a441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb8b6fff1257be1a1ff8b6bf92e18a1e
SHA176a601cc088368162f08fbbe425d71685526d143
SHA2568f664f1dbeb59b173857d30f45f5ee5cbfa02b52bb68d578b5970114d0d43c03
SHA512eeef51dbea4d84b7673fbb66751a633a8dd90dcfb529b1c14327f63a03657789fd853b4909ffc2183dbbbc486f68597856bb222e3e8ef1701b0719d38064e14c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06