Analysis
-
max time kernel
118s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
26a3e1d7e343d29763bbd6db5253797d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
26a3e1d7e343d29763bbd6db5253797d.html
Resource
win10v2004-20231215-en
General
-
Target
26a3e1d7e343d29763bbd6db5253797d.html
-
Size
53KB
-
MD5
26a3e1d7e343d29763bbd6db5253797d
-
SHA1
92c1ddd54d75b45d65c60b86fa8f6a7a20a613b5
-
SHA256
e0b533805c5f801867a6b1dc922b23d47b5855c9af547259997a883b0387e451
-
SHA512
e3fdcebafd2c4e6ed5a4b68567f2c03fd35f5f1f3cd796c873be98388289e310c46e9a22965af522608638ef79144c0af0191c0a0bd19333790d29b26d2aa7d2
-
SSDEEP
1536:CkgUiIakTqGivi+PyUerunlYG263Nj+q5VyvR0w2AzTICbb4oP6/t9M/dNwIUTDd:CkgUiIakTqGivi+PyUerunlYl63Nj+qN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410326284" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000931894b4091e867d984f6b2762df9d2a5d2b5ec4eca75682277e3b70aedd577a000000000e80000000020000200000003cda8073dc83f45bf93f4fc70f5ed2b211fbdb43f40f63aef6e688a5c45f4ed59000000051379fc64f627cf4e79059d6ec693e29f338cf817190b04345021d032b1d55b4b4c4eeeaf9ad4f6deff4a0a50da27fc699837e07bf76d7ff3961a708f6107ca5569c358e5293a7fa68839f7b6785efd8f7c82201b04114a648d6ca2cafcacb825f7040490b1de491c970125227319cd23dbf74af0a2a096a3761f239c61f55748ce5601de7e832500d39686072be87894000000010dd1411190f6d09d85df3d06f61b5249928a4b0a6e901f36320ada6449893aa063ea0b17c424141d90b97917003b1791b7059b3c6010534821c1ef36739f9c0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c0f603283dda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CF7D621-A91B-11EE-B092-D2016227024C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007537ff88f0b800b99e2226ae0223e54942c9294aabe94a301a139e5f96889a38000000000e8000000002000020000000833fc1cb86097cd7fcbc418e0b99c99643f354e9b58d7103326d8456943f933120000000d00788b352ed9e75e8fa846cebcd77b637d8f353e040ef1ab32dfdea69e5d3a74000000068d0d7275332a6fc7acc6076acbebcd51837d0064dd6fe96c434586212c8219203b8d8643f1aaf20e21dab1373a65c399b0894c52a197ea48962002dc6b407d4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2304 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2304 iexplore.exe 2304 iexplore.exe 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2724 2304 iexplore.exe 28 PID 2304 wrote to memory of 2724 2304 iexplore.exe 28 PID 2304 wrote to memory of 2724 2304 iexplore.exe 28 PID 2304 wrote to memory of 2724 2304 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26a3e1d7e343d29763bbd6db5253797d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c4f5ac4ed8cb68998cacefcf8e0df08
SHA1cd6502c929ae50d69a678403d570ad44f60f325b
SHA25605259b347db6b3edbcde79dd676bd307261078f1741bd31dfad2e9a050e54057
SHA512b65d8bf2c9bcd44fca6396703d8cd7d0a0f4fa78bc27d98b588ac8d60cee7a8fa39bca9481e9e4e606175bbcbe988a442ba9324a8ca628286ce83bd5473d15b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522565328fe7e302f61e542761435ffdc
SHA1326b5e5234044e230ec600cd64ecd296e737d2c3
SHA256541b3b84737fda56b4c86ba06ac95840f58e9b3c779bb0918de2607210ee525f
SHA512a0558a2b7ee3c8a859f9d6d0a8f6610999d79131fb0a6b9e0bf051c993608bdd04fd34e0f05bc127c2d7c8cf55c437b901dae0645991bcf3dc8be381d05f91ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50480472e176a9131e91a0eef19249311
SHA1902af80514cc51191979aa11407819658ec1f165
SHA256c11322ccd067254e48b21c2b58e1242481f98c28cafb6a2ccd4d699895cef0d0
SHA51249a75fd92971cb6047587d61dcf3918f4da0c97a276beb7a263e103f1eee2d8924f0652b1bb2035c5a285f058125106ebf94b10f0296b9cc005839bbc080a5e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52816e2eb100f1c026f0a2d665527ea1d
SHA1272ff9ad8570fa234c1e99b338af8d8a0118345c
SHA2561eed673323e7e9a7302e0c67b4d8abc1337981e92028ade48b0b36948eb8b74a
SHA512a014d518bd7a29e96b9e039a411a72533adc2f7c64e815efc9d84e74a010be0475b5738ec325665d43a441767183ac45f8549b126b918c7a3df5497c9f6fc38f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5965e5994a9479ed51b44db14272d9839
SHA1f19f2c7684f90335b2376e1963fa7666fefd1721
SHA256d96ad1dcd35ba4d26c43f18ebe9f3c6bc986a781427dba3296543b4fb3c7abad
SHA512b662d8b1b37802c10b286e7357a5cb02b8c87e695449205b992da921ff1cf26cc8b8aafad1f1461334580f81c9d0ec90d98f6a8011bb9f4adbe11b448e342524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cf41d14e2b042211349c1c1e3676cad
SHA15f8c7fb530f3ae9dcdfbacdf8561b1d4a4d6a4bc
SHA256d6aaa1a3db5a2cdf62a2f40aa63be045d2f31b2f97c2895afb14a6a9ead6ffe6
SHA5121b60f808a35ee5be2655b12870b528844d932d0079cfc49cd446ad30f4d625794756fb311464062c1acf932f4f81b7f66f890c4c0993e28b66a24c907b254c4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce1348e3ccc8802b669ac5e2da9a0cb9
SHA1de94322329b85cbd35845843df1035c189c22aed
SHA2566bc5e81c566ab10c0a4c68b275e08d211c0fafaef383917e848f13e99453141d
SHA512bcb0a1eff2f9e2dae24527e025c25ded04e0faac051db424e128f7011b1c04314e2f46d975e777bd2b1592078f2bd14fac914a385865ba823d74083634038cdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dca31e3343c5f6c9ac719ea18edfdda5
SHA1d776c1c1c39ac2e7b0999ea84ccb33fcb8c969b6
SHA2561b2d0431f0041e578b0436710dc72084bb7dfdcc8fc72f50ee52fd6fe7ef1e23
SHA512d0f87e6ea8f2b9460aaf343ce8805333b2b0af0bc6357c3968e629cdabc53fe73f8e888105c3b2b1b06bdc2080fcb07f404b35b473060f161a9a6e47c63b48d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fc880326443bb0a49fe518fba215162
SHA147470413bf2875dda734eb74800fdbf42d71692e
SHA2566bf17bbdc008635f901ae41e86e240433ad98ba694829b3db56799c6efd543b3
SHA512bd7c6c3475652dc196c39600032a69e45915da7e3d3a13bb5303e9d7890a6b468e29827c7d36bbb93aae0ef28ed1f8d844abad00061811e8d25cfa515e390ac5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcc9d70dbdd02c1f45087149ed3b80d6
SHA18f7704196c1aad224b0c6ba3790b9ba7f266b63a
SHA25698387d8e02104c9333b0f611a9358088741d7eb809e6dce58cc38ca2198bae17
SHA512775ea9bc6115ded685f480b4a4bb3d42092364a725008155c203379f88950b95990a3b3aba0ca897592baad0052dd77f226c80ddaa7bf6fd3532072e164ef96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5754d9d345c6cd78f7065b42f6069da53
SHA1eb52b2c680397c17931ba2df27dea06b929a260a
SHA2568dce27ec9753ee7ff3dbec63a57810c226c43a5ac66c726098fb64c1bc93fc48
SHA51261a48a058aa7586376c0b350d97760ff6c5e3d2866ce7ab1d58eaa2ad48762799e15a5c7b12f76a14c124250b2da22566f617d5fa63e8b992a811b52e52bebfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d3144ce5207424732b33031b8925832
SHA16aa8ee06ff7cb2a986cac44d94f75f35211ef9ab
SHA256ae325c0aa2f11f44e557e2a01296d5af59a9e21d3078f3c2581cc3c4dadeccda
SHA512c1013c6230d694d9cf30093acad514d9d4e91fe71ba251b2b5f4c2e097055435e507c83e355efd3b24e14d95f9b2bb17dcac5d46d85c2bc67c5cdddcaa00386e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e63927185f42536f9a65f131e5540c3
SHA1ff44657b4f07028dffaada4496028cf7c17db2c0
SHA2564d98932a73bf83a0fdc6add511a6b8d963ebe47c18d665c7dbe3f2aee01b6c38
SHA5127a6db40ade19396b7e66cfa7a35434d08bb51f946b4f0f86d1aa3ba11c1bdd5b3183e43c846969a9dc1dc5101bacf93ec2d75bc93ea4f71d26b34d21f2fdb3e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f94f098b1a9145e1a12fd1025673c40
SHA1384b04c8d4bd7127362ced3a80d8ce8241e80745
SHA256db87806efc98bc868e2e427fa3ee03a45bcf6acfde775ee1279366e506c8f41b
SHA512959e1f66269e693469aef89f1e64e8ed9d36a64ef6863dc8a69e0a45b22930925794a16554266eaaa2419aff989dc6af9426c889fbdad400f799f9ce7b7a97c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ad133cd6f1ed21f2b1f4a13c9a16479
SHA1b0351c50752847697b895b970f0a51cf95a913a6
SHA25620e1530d843d2f222fe33f1ad76244772f8f42835f5f2248717cf520daab8ef8
SHA512e00f37ec397d98afce48b5ab5b9809347c5db6544e11a1e557efa1bcbc08016fa16332206ab454e1150bd11642033cf72481f31bdea42838300d534477182973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d36facbba6e1747e88b94f440a0fe3fb
SHA1c0a721d5d0c69960c5792d1504a5f4da9e1da866
SHA25662189ead176fcf98a37b5636ca1328e06c29bb247b6326c0a05a95f53ae66222
SHA51221e4f6cd80c6d661f7ecae8af47122cfd32d7a81116c42d4d705624f0ea7ca653303a6d41ae7d0f031c566ff9d31f41f36f80bf1c1abc8f2d3e7370cdaab2e35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56829fd4951c23e9f2f938bade3eee3df
SHA1da254b380854b1a7224979075ca11ccd60edd95c
SHA2560dfc5b842027a15f52c7b4d0201e6fbfe36ba726893686f0c01574e04bf7ebc7
SHA5129511aae08cfdafd5e51eda1ec79d81d530bf1ff28ae5105edf76b693894f5f0dc7159e748f4bec605b9f1d257d73bba5eba0d6a9b21b46c5f6f0ff0d9bf9ee03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0284175d17af6989db48e3c4478fe4c
SHA194a3d0bc45ea82a6ebbaf58fd8908f5ca5d024b2
SHA25689e2e341711a9b922131e1123f13446adfff1c7d36b5526fa3b3b91972936b80
SHA512b39b82663e0ea294fd985fa026862367e0b178915aea2774b623ea04bd6398d6d6eb68304cde66c4c1e9af1d1c7d720390a2efc76f754b0fbc838dfdd0fdb257
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\script[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06