Analysis
-
max time kernel
121s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
2178e6126d13743d36cbe76362873f15.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2178e6126d13743d36cbe76362873f15.html
Resource
win10v2004-20231222-en
General
-
Target
2178e6126d13743d36cbe76362873f15.html
-
Size
71KB
-
MD5
2178e6126d13743d36cbe76362873f15
-
SHA1
3c1eb696d92885101eb2ae82bbea32093e28ab69
-
SHA256
bc0fbf1e8b48e1631aef7a0c91ba615c5c0af33af779f954c916dd7c79987e24
-
SHA512
036d8fdef3abc88e924df755c23c94df2ef3765d950455dee6d2679602e2fedb639a2a2890c12701df6e86dd041ee9c4d0ba6ac53c6095b881d4f9a6f9c35b02
-
SSDEEP
768:xlkSgOriWNcaSoYBgGLAusTmRr1FtopIJcPfVTx0h4bM5t1PrrGNaXlx2SvR:0BBNAuGmRrddrKaXl9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000081260dd555a68b44f9fd70e1df530b7ecfcce3d6c343c28a76a687a008b10e2e000000000e8000000002000020000000076fdeffd4451b69974f586cf56147a314a43e801801677d9c2fbeebb0a6d2ca9000000003d787ae2e8e523d12ec4d91f1a43b39cb153b2dd18cbb6676e2cf5e819e276f45b6d03a2c9cc574b2146f8efd77075fe1946c5e564c20f42b14af5708740095bdbad82ad1a2f3ee2f9f79a163d1e2ed9eef288f6645b240df6ad0f752fba696714b720fe1dfe150142c7d01eb8eeae18a6ebc990f5e94cff7138c61b57239c52956e2a2b7444cce99e3fdf3a01fa3e9400000009208b0f02599f6e3af11e08377485624804de5ba98ed48cfa8b168464cb5c562058c4d402fc5bf5c5919aae98d32cf738232d62fe9785b49847cfcbd174b890a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ef0f3907848c36a6adea8fadf73bdcc36d34913afcc44738752c4cd5ecef48d8000000000e800000000200002000000075d95952704f8609d1d766bdb9674b2d93580ecfb264e6ee8524c2a8d009a0722000000020543732bf841c1c9f33d79740b54d83e1e54b6669e3e7520d22966acb8af51c400000006c03a553d22a1fa2ec8d396fdf061e3beef15bb68428732e7696d79cf5fcc8bacc78c1000ee98eeaa85c740e8a16190d65b5bf9633799acdf29d2444b936f807 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410571912" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e092e6c7633fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF127F01-AB56-11EE-AD90-6A1079A24C90} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1312 2240 iexplore.exe 28 PID 2240 wrote to memory of 1312 2240 iexplore.exe 28 PID 2240 wrote to memory of 1312 2240 iexplore.exe 28 PID 2240 wrote to memory of 1312 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2178e6126d13743d36cbe76362873f15.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5453a2d06a726a6b82d0c03e5be7b23df
SHA1c559c7efea4fa6a28fd503be4c78eab380e7865a
SHA256381cec1533a03a1ae991cb63b87437db9409df0ba5aa1cf5deb0b630f0476a29
SHA512ac8af811c39d0d24445034e65d7b97779004a2d69111e37a0491f5007f80ac4440e3ab0225c3fac22a7f7577ebd2c6357d233ddc490bbb615a4f0d4ef56c8e34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5994d29f9e8b32a0cafe152e1b9ce099a
SHA1b812b3d59bbd105e7f15c39792e1c1b202ee6467
SHA256016c6ecfe9cc663b4ab7a479d680a30a101c4a9aee8a15056f9f6ec878564924
SHA51205308dc9d5249a73690d25fed4f7d25935cbf85215d3634c4d3b42f2dea80b5ae14339af37cf886fb8444658277cee715ae0272fecb0156d38c1fe01922f3843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5486bc662b7eb7bfd5e223f0cf3dbcaa2
SHA19efd90501cce48c588d8d97364674bf493b65ba2
SHA2566f68e39cf50975f5856bb89ebd5ab3c9998f5cbd6515dfad4a149452bdbd2dfd
SHA512b85e215f54e838c8ca86cb06d8f431b1988478f3962a5500636e306acbb4ee7d1eb3962c97af3041f99120bbf072ebaa98bb64711e7be7dab356141290a4ce78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5e54385e07435398c0f540631e44326
SHA1150e8270e45954c94b2def2f04a91fdf5315604d
SHA2569f0ddf3440fa13564bce0223b642f144fcce98edd69402de194c99b732133ca3
SHA512c07942d92876f56a292f5bcbd9dcdadaa9525761e57f86068a3903bbc282835905c59241a4a90ec8b1040e810d6a3037fb1c68c591f28a874267775f2528e31d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502b41e83f382efc6d4c33b2a5fad974e
SHA1bdb7e3cfa6d5d6f34c52162166f64126aee9e8a1
SHA256383501ddbd724d83211df86dd498edc616ae9f7671d092c6be76e1646807721e
SHA51238bac18db79a7e3f2cfbff90971125b95a9a69e2d620612ef5696becb8d77cd36456f4bec4a14bc217d60df37672bd40459a8b4405c57204a08bc8c072936f3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e62e4a4f84f8014a200474b0185b5ab7
SHA1efdcfc6fe4e90da513aa3afdb6e537cd3a27d281
SHA256c3543ac66c985ab70b7c2afd7cfd32f3ae02f3b667db1099723092b32ea29c20
SHA51291e1f742e1b332c8cbdd35c0cbf0daa7e8cb6d5fb5bd5cb4b6e90ee687f782529692afa0860a479dbe2d68441b4e1ed8c17f9207db8dee81f422ef421f8ed85c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e459240c560d754796bee025e9c7fe94
SHA1daca60e06b8becbe540f6ee39a556c3eedd2d9c9
SHA2564dc888dca89a245db3d4e9745482ea003a7f8d6df3a04e6c05196a67b1352553
SHA512c721b3b0bfd13212027fdc27cafe9b98ccce59fa2822aa3a1544a998a4381dfc133380880e3d65fb665c98334de932d4e70794006def8200e3adddf66bc3ecbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5279e0b6cb6728182704a256dafd0925e
SHA1e92ba996eeccc4ae58a993e00baac6736d7bb6bc
SHA256919fc0092575bbe16889614d46b725ab8b074bafcb45a72eb6b672a1dff765fc
SHA512bc5dab1c4f418b852ee32effd6e265cf06f9b351d659ae598302c2ba75a5911ec3bec0c1bae799bffa5eab1a7fe6322b972a5a6b86ff521c4cc409fe83c16b68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507064edc1d0ea123c60c287cfce99ced
SHA16c7d177a3172114490b12bc3de5bf97ecb710730
SHA2560bb7f90b7a395e1fd1daa58bcd4112455b634a8d5f23ad74c563315d207390f6
SHA512fc2280da6f0f59a19b32f174e2f3d74abddc6ebb391c168dc0ba6d29db64b24d91eaf97d745332d24c998ce0888b8f8bb0a664a4c3613bcd8f615d09b8751192
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06