Analysis
- max time kernel
118s - max time network
134s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
31/12/2023, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
23d2a09de16a6c1d68639aac939d04fb.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
23d2a09de16a6c1d68639aac939d04fb.html
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 23d2a09de16a6c1d68639aac939d04fb.html
- Size 19KB
- Sample231231-chlpdsbfdj
- SHA256 65a799c55fe451f8ceeac5a2fe37f4095c9e33c3269b1a21c8a4f1de81935452
- MD5 23d2a09de16a6c1d68639aac939d04fb
- SHA1 7e4ba3bd3e542e7a7c86de15b673fffe6322403a
- SHA512 dbcad6aef38deb741c6eb3b8c3fe590760b5eadb7f7985e20ea00c559f11d094ac77b7b35b73496ee03cf9565d5cc438f69c50ca2ef59892ea3bb7f311dc9005
- SSDEEP 192:MxfGjeF0VY9fG/ORCqXSucZOKBNAMfrLufQE8dXLuXYcfNNdc4BlOiz3tux1oUrp:sfG/DoeOK9fnaQEsbGYcG4BuVZ+yrJ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410306615" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F0BB741-A8ED-11EE-834F-6AA5205CD920} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fa531bfa3cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000091dfcbc2056e9bfed5fb66c87dafb2cc32a51b0ce853e5989036910f26ec55e8000000000e80000000020000200000006e343a1d73756d552f2232722c4751773be520f78673532ba3088bcd4ca59b849000000082d0d1ff1f1ea6aa22b72500ac98b9efc950d08ebafe574e73f4f5dd1dc32207f448841a83837ef59f3ffab02e480892cedbd05a14e09e0d1dfbca85a2ad005928d82febf3b58c666ffb1367e6a8d2aa9fcfa10e54add7b4df132775b6921e8c39bb37416c6a10b7fb3913e3947ba9de20c8f1ba8ecdde49b32755493b0613b0ede6aab95cbf48ceca7f865dad2e706240000000d03ec8e49b7fe2195126315cc10832b3618f44167d2a2e6e3d2ce4ce37d682a9061c20a5cb7d27fa2925185197c3beac2589dc7e6abb990c06102693fcbf678f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000f84fc1118319b79693eb43825030872bd7dbc08cf0ed4e25480cc553c7269abb000000000e8000000002000020000000e4a1994444d2b683cca42843890f9f1aa07a1a16ca68947ef3119f607c135ee32000000092f8022ceef73a114b75b39425b6dd956bbd041a050ef966fd187d5d59ff20f040000000cf673733b01d3352d75f121e322134f7617ef73496d129c2169e5802d0294e3d4619da3afe121b987dcffd9cabd5d081b7b4be845f1c0a9d5f40379f12b83472 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3020 2980 iexplore.exe 28 PID 2980 wrote to memory of 3020 2980 iexplore.exe 28 PID 2980 wrote to memory of 3020 2980 iexplore.exe 28 PID 2980 wrote to memory of 3020 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23d2a09de16a6c1d68639aac939d04fb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 914B
- SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
- MD5 e4a68ac854ac5242460afd72481b2a44
- SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
- SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 1KB
- SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
- MD5 a266bb7dcc38a562631361bbf61dd11b
- SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
- SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
- Size 252B
- SHA256 9c510c93626e1cbcd7739b48da7100d3406824ee1dbe047be8500dd27413a6a8
- MD5 f408f598747970aa9d52a4693515c32e
- SHA1 fdab776fa35b6674c34703d6db00a852b0c3af06
- SHA512 b07ff9b260257974afeb8068aeb8c9361cd0d46be71591c2ff184d81ed8523b95a403c1ceb4c7da290c50ca55cbc1f0026b6933af7c46336ef2266e0db8e97b3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 f191deeec59aad8645442b22464fc47c2cc6318e3a34bcf1d853f3421193c342
- MD5 55066cf1df6b87fe3a7ca19cdb74680a
- SHA1 37800856844841c6fc78dc74ea7701425b0b8895
- SHA512 5c747e0f90becd14a9e7acdfe3162db4799abc7f5db08d784b80c4eef9cd0a540787954a163019aa28c16c01f2c3ec152afea6b4eab98bb959eb866047fcd70d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 bdbe4b792d148f7d93d8ef384f1b2cbaa0fd96462773912657b86abfb3faecce
- MD5 9c6dd0a725d95acacd3587412cccb91b
- SHA1 242b054383bfa9638547038ec10d9064281ca088
- SHA512 6c70b944447aab7c5021f5f85ba4c519394e6a485226a89c5aaa623b7a760c438e78763513336f5755324c0410ea762174f02f5b7e189510256caf56062c9b5f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d454d6bf8dc475be17c33fed8f944a3c921c9980150297cf968051e7ca7b44a9
- MD5 790239465e680fd59828a0de96b60222
- SHA1 ab7c6fa9253dd7df50e769c39f4f35e12ae7ade0
- SHA512 429fa52780b9d886a85b488681a9d1d0bfa9246cb7f4e7b2c350e592e8034503217d1af2629f28d538086c0c781bc24c6e07ba6c90600b404bbed7a77bcbafdf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4b4b6fd7929e44ceaf71eb1e9a53a223b90c82a484e043ef47b1275bea158878
- MD5 e0ae0abd784be2b4767defe61cafaa84
- SHA1 e85e110783793c6bc8b9762f2e44f9c20eb81a30
- SHA512 c61fe3ec654dfa6f3d9f566311a9f10ef12754fb75acf58da6601645893d9c101f529db00be5aa63d13dda55671ce4778023795477064ae853a6d80e53a31a13
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 78cde010c3e69fe821f36d8d5a66c212ca2cbbb42abfc626c047ce659672712e
- MD5 c90670168c1458c38fae1acfe89b1adf
- SHA1 62331f635e8dc02df08657e0c6769cfff032a702
- SHA512 7d6a326f9a1d53bb1e2c74f5b5a822559240d5595adf3edcdce28efc6de1f84edb292c568c246e69d1ac5bc5157a424be108e605b57cb18085808d71ca7718ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 24e2fc2d851105abb9a513ba780e9b152f979e6de20db53390c95b5826bc0747
- MD5 2e8187e5b17c27e9d7a1d3285fe6d016
- SHA1 dab56e0995dd992a37fd13a0c597f7f0b33f9fbe
- SHA512 32764b0f66ff96fe58d778ff617cb3176969b99ff1ead910fb9fb765e288e2f21f514cd9590c56ae795991e2cea3ae1441d1f2d68e9070ad7aa84dac7dc7c4af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 359cc4e16d116a79cf1e99d592a144eaac655c74d6e348a00dbbfce0155b32d1
- MD5 e27ff8b8db36b8848cad2957c7cb28e8
- SHA1 c31ef124832e9a658418eba194288033161e2b42
- SHA512 902ded211dd57e06388e7c1dfcf188aad5e7fc206c496f581a9cdafb6d2433c65f297ea48fac94e9858972cd50bda56eb79eb62003c401c9f132debf50323b59
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b103d78f0a3ccdc0fe67b62bd9419714030696f2092f26892b9402d330633ad9
- MD5 652df37be0b187c263eade29d7075045
- SHA1 d56185dead29aea66e73f700e1c065ad2b93a39e
- SHA512 6f4da9bae8f6440aa832580bdf5c5774975946c9b6d239038be1f0c7a24b5b585bcd9d05d982fb972c68f2c157be974d40bf0ef2bf0b4bf25f9b66c9c3b02e79
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
- Size 242B
- SHA256 e5874e0f9002a2c52262335dbad9d8dd5229a0fa3b3eb4e366ae92678a36b167
- MD5 80f79823ce0149c98179442c3f1d422f
- SHA1 86a30e6e8acea819d9df27e9ab087ded42f12a5d
- SHA512 a21bcceceb0f7dee5b877d7c45700bf146da2e8e9e51c291e145b35a79d3331def3a6584894d8b156b247b44b697ea6e1add294df393e61492ac2bcfc7295265
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar3854.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP