Analysis
-
max time kernel
143s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
281a4b9a8e3c8e3adc0783fcc8a3826d.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
281a4b9a8e3c8e3adc0783fcc8a3826d.html
Resource
win10v2004-20231215-en
General
-
Target
281a4b9a8e3c8e3adc0783fcc8a3826d.html
-
Size
601B
-
MD5
281a4b9a8e3c8e3adc0783fcc8a3826d
-
SHA1
566950e6e7048c3fb7575bd39262409c49742916
-
SHA256
608c8a4b82e761024d715a6a40d2be25edf730fbb25dcf2a87a15ce5f1c8108f
-
SHA512
b31bbcabf088f462b9a16defb34d6b843e1ec283fecc2f91a15841861a26210242cac7835c8b63f0fc66c719812114d1b57298017cc10acdee3fd9efea80fe54
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000038890a7ddf25ad1f41845848b3464912a0cce7fed613e79b452bb299960e01a2000000000e8000000002000020000000aaa2f2b3b3e86ee9edd6b8ae4d58ef3c756da66e0ef983aa0151521a13b9991c200000008c30f54641446841c2a96ac15e1b9b6a8a3f585f8a308f2ba02b6d3a4c91900540000000ceacef4ea224f9d985a3fb0c49681151c756f6db98cfe2da2569dd9a0c0c54687ee268df2737ac999f0012a0222c2e2df24c274c04ab42b9e933d1e395e7adc0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9F5CBE1-A92D-11EE-8EEA-EE2F313809B4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000430528a7b22fc36e7230fea0e2174fbb7383156d81e2a0cbcbaf8ab7b51a9c1d000000000e8000000002000020000000cbf231006ceb80f92c2fff401ddc9f90e7e4a46aec5ecad37f1755feb9f4508b900000004561ed1c8ff40f2c2614007a389b2ce249553edff33511992910b9193bc63e0627309a01e3d45c5136bc1c553fce8263f08423efdc6459181454c8b1ad849b3b2c12ff4efe77de9ee863330ae9f73f5620e229fc473b4ef42348786b14f9bcead6780101e12ad06d0fa5be9557d5d99b4e5af4e0d42d33423fd65dde40a307c836e6733c13bfd88cfd863353a0d76d8740000000f63310e1741617957a2a2502b237f5f7962aed168ab55056f9c47028e36f43611b00b729ed9620dd5be3250c2c35e899a848a16eae113491528ba50c44216682 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410334312" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500cef833a3dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2960 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2960 iexplore.exe 2960 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2928 2960 iexplore.exe 14 PID 2960 wrote to memory of 2928 2960 iexplore.exe 14 PID 2960 wrote to memory of 2928 2960 iexplore.exe 14 PID 2960 wrote to memory of 2928 2960 iexplore.exe 14
Processes
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\281a4b9a8e3c8e3adc0783fcc8a3826d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD535e306022e748b555479eaa4420daa32
SHA19c8cd474e95d646d136eb42f7c6ac598e7d14cd6
SHA2565d69955202418d3d49880f0afb4d04c94a44d6d988e0eba5b3b3fa1d7e6b358e
SHA51299b1ab7b4daed23cece21b5e344e6a47b9ae12d7c667988cdbd24caf9cb6984bccc396fe6d54e64b31a930f3900ecc8065a21f774e63bdb6e5eadf27e3ce94e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5a1fcc71b9647510bde1a49cd1ef427
SHA162c2796aa45d1bcc8fc2b776606d273f4f22dc38
SHA2562945e0139cb0e075c9c2aa9b856496936e543277f900ba920e229cd4a2aada24
SHA512bbf828c14c1cf550af928d206cf2a601f8f32b32a459566f95f8488196e4f943bcfcc9435b9ffe0222c3c16b319ccfa7c465d9da4b707adfaa59fd70110c0e20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56160684ceaf8732cd6f1bb52e73c3ce4
SHA1b61988db56835c452907d9cc94f3020fdb4547b1
SHA2569fffa82c4b3c014b10176196adfe3cd95720999add24accc4827e247625e626f
SHA51215e3f8138c7723d8cd50bacd44de0d622c334370e1f75dcd26da4a503387ef9f8f9685829859b5c5564f0f4c732d2d3bfec43b4ef9014f3b508232ec656b0c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8ef44ac04be6d636338eaf2b08a93e9
SHA1f11bdc536f872d6e29dc387da2654e4fa4d85c98
SHA256ef767795ee0e7e5bbc723762986f5bfc9a9d9a57a9f42cbc5b1344fc6e8eb42f
SHA51214442730751f420eb4669d447e3112631c0da3642635eaf209ac566571574accd009a8a28de4b1ca21c3a5eceae025273ab0e22cb135f516eb655295e6d9f5af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579bc34496e08f696ab47b9775360eee7
SHA1fcf5d98b8987a033ae3738695d597ce23be153b0
SHA256d2152ee7d56c8396f2ea2346fb9342c4d678b902ebecee455b6b377fb31d80a0
SHA51237f4189e4fa594cdcf517cf4c2128fa453f559f1c411435125fb85bcca5e60731153371a9ecbade08999c3b92173690575bbef6ab730a5912dca882c3d424c94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531ec18705e3d411864b304c9af0352e1
SHA1e1a50571868250b80202b63d40140349d8a6ea03
SHA2567f57171620585a368c2d764971658a9028ac4dd098a9d4d0a611008f9cf340a3
SHA512187c3d1f99bc120dc65c52c166cef43de537b60d218cb944c5597a8ab7520577294fe66da9778e2dc49ee6b047719d07adf35a0c4413e1c1b56432c36b94b778
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5783348422d7fb2a76fd4dbdb807d5426
SHA18817dfd5f4f301fda7934edc16acabff08809ab5
SHA256fcf78ad5b914b8d1f7db3bc526bb40d48309c3e7790f143b5577dafb533db386
SHA51277c80eb0e0294597da8b8f23fc3dcd4ec6ef11a70ef589db9143ffde5a2c729b19078ba881ba11f4f5b4f420772b7ad5102b7de4e658c18b0420a7ef95ef220f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579398f621f870c7cda791b8000497510
SHA115bac050588e4714cd555be48000530e808b02f4
SHA2566ff652db88bce1708666e461262ab769aac5b5f86f74d7a45073befadcf2f219
SHA512498105e333587a04c60b50719e9909f9aaaa543a32659188cf7d4ffb1efcbd23e6cacbe27afb90c6776ef804497629c8c04c46c35f3210503008a52d46d2f3f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a2408c25aa1f8a3b978f01b32b8b093
SHA1699432f07cd12bd27202bc55ad24138d497f29b3
SHA256d7ab166b861f56842a62e4a21dd05fd3861a7bc1799dedd5c10941442c03a103
SHA5121895deb31aafa0fee78ae44b1c310888f04390cfb2875441a9827e2cb299bfeab5c7a4367c4e602be6bbe28017978dd5444b2180a176578ea275c8a71cb9de9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba29d706eceb5758f0355c5882d44542
SHA19dc0cc2a5351e38315ce452a77cc830448325b15
SHA25645d0819a8dabefa4f1aa1f7ef59bb04a61b9c59c9fb1b3ce66bf8a44631844a8
SHA5124d16d608bb37ce827d6a3cd247a274699f14ca27492eb73ebefecd398b8dc3daeeab4df8ded563d1aa0b9e1b09bcb143d4cdf72080fac2c3fb1868d7e3660f2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594fd726613fea1770e612f2e19fefcbd
SHA1f824273f753fb96b1af115177da54a5d94fde998
SHA256b13ee656f427090778b924749e321ded4f46371ecff0fa0ad3e1ebecb192a9c1
SHA512c6829eb3f60a517b90b8b2945fc118b923794a742df16a9af235412e73c25987e8ee68f9e3aa9ba1c60acabd5568d026bdb101b00f4bcc4eddf73f2e701e4133
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513d2c79663703fb785de757deb977676
SHA19292710c1d4484ec08d9e5dc13fe312fc72deea7
SHA256e37105cb9fb01951230ef737e3bd221c8f72633ecf1bde4c25ba7fa7638d8471
SHA512fbe8e2202f602da428d997134255a55432e4ba22ccaa6e120d7922860053b95df2260a2c728a6675a31fb70b91adef432dfd1e7f45eebffa3fd93ab3ba8ebe63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5470fd9d746cce2db7e0da1e05ca43485
SHA1afbdd6f679fbef255c317967ec127ebee8cb90a2
SHA25666baefa7451724f6213bf46dee9366fffd50214cbb9e7230147e8147afc3d6d4
SHA51266f49d5dd2afdb07757928f435a17dada4614f3a7e6d9d36def09d5f9c26061cd29ce74bcc56960088e2595d9029356a6abaee35d4bd7b76f8bea97df8dbb3ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5bd60ef2a016bdd8bd17207e329afde57
SHA147bbad8e53a8c153f2d3ae10bca0796a95c155c6
SHA2567f7d0ef415eb7a5958a90ec56ade34a2b9c7b8f4782f8f0c143de691de39a23b
SHA5129742f66e53714951ea2ea2a5f38c0b58c6b2b55c23ea7d94c6542b800f19011cd84b52c68b6eb41779a534312cb723e76bbd804517a67f85ed3dad21933a00ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06