Analysis
-
max time kernel
119s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 07:25
Static task
static1
Behavioral task
behavioral1
Sample
2d4e6e22e5967da22f9617e868c720af.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2d4e6e22e5967da22f9617e868c720af.html
Resource
win10v2004-20231215-en
General
-
Target
2d4e6e22e5967da22f9617e868c720af.html
-
Size
3.5MB
-
MD5
2d4e6e22e5967da22f9617e868c720af
-
SHA1
801892b092616ba064cf2c94dab6364ed4a1d4a5
-
SHA256
2616c30fa61e590c25dbc77d1c0c62359141c07984415def464b3b9f7479c9b8
-
SHA512
03063d56115086940736782e643b2c79fa798d1c41f56421258f51d8f3822b697fa35347c10dcde9e783e9bc1cf2a1fb18743de0b50c6cc3120cff652dd4a9f7
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NbM:jvpjte4tT6ZM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000940683425e576b607e14d863a4281ba610421ab86738c7a543289ae47e580469000000000e800000000200002000000099baaafaf4be72190dc316171df97349b57e064e2621d01e4d5290e12a30d3be20000000b6edab485ee9d7cf12b36c5606856a1eb9eeb20ef5c029275e820240e30d2cd740000000c09847a06733f323d99e08854eee8905c07d986da89d1866b1af8073965010c025f79cf6fbb75d99247c9e06ee7d436039c061833601266d7a52ffa1e75908fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411003809" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{866CB461-AF44-11EE-ADCE-5E44E0CFDD1C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06ab4675143da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000003f366f72920632b0605630826984700504f5083ce97326113e58dced2c23057d000000000e8000000002000020000000ff3ad4ae852fb1d9871dfcb094ca25be525cd6a108f1ab12dbc40bc7c69a2c0690000000e541013d575502be50a67dba15f03bd20e62d2cd1064f70c87a5070c919fa919303ee5dfdc163f4258dd061725795e5fccdb23c45ad66c096d8de4d310b819940076b166280645bb8ed3e1f632e79bb5e8b9ad1477e5eba7c5f8145e56911fc952194370455093e541bc96304e65236d65ea7e80e3da0bbef70caa93778c410e57aceb97821555a042a754625d4f413140000000efec98144497d05bc9c7886287c21fdfbf0a94e8dd88cf382911cf42cae81be0f0d11ba4321a2378f1674d07cf5284f52d113e18194962a6d65ab056b9c351b3 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2888 iexplore.exe 2888 iexplore.exe 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1968 2888 iexplore.exe 16 PID 2888 wrote to memory of 1968 2888 iexplore.exe 16 PID 2888 wrote to memory of 1968 2888 iexplore.exe 16 PID 2888 wrote to memory of 1968 2888 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d4e6e22e5967da22f9617e868c720af.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a94f3849331bb44c533c5baadc540fd3
SHA17d6809d3fa3c96e19621b7849c009aa4b553c111
SHA25642d434e393556b75d480fe9d04825ed0e78d70eadc7a4d10a4f55852eb3a0234
SHA51237fe2e2246fc02fbd8a58611b15ac55d14e05b01bdcbe68cc59e2161c01480a7eb8ec51448e31edd16bf90a02a88f987e961549856898a76e3d7e22a928a2d30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d30de4decb8e0e038d10d11fc2003116
SHA1344a07beb182dd4cc96eacc6a251d20b1a934699
SHA2560f8c87513120c73652c3cbd245d18bf8df7889cfbd52e1e550c4d25c79770adf
SHA51240ebfa990784998cc533bcf9b1be4d7722835b3ca11c5e5a20b83508796c14a613ca44935e26b5887be3a0c600132d22bb7b56cdf83d48a1153e7b4a9862142a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514f6ee34311b373dd792690b8457c7b3
SHA1d76854805a444b334220cf10f42feff22ecd26b0
SHA256793429af75ee3613a19e354a067fa3bfc56ceb1c419a7b756526cd0e6fcc60b1
SHA512756509d09b98a50df517766a5ca47505f0a971b108c7caf8f55e8c73f9198b1843bbcf89cc40b8f5cb7b919b725b828b413caf4b34fcf05322630a111b7742bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6ff83d81ad75edcb6365acd7e036316
SHA1b9bbbe535ec0efb171205ec028e22fe4e4b1128e
SHA2562b7e3991fa0ef4112881255245b21272e6ead6abca3e9d03296beb82153f3d1c
SHA512ec9586ce4533be9aafa504f6e1e9443d4394fb06386c1c9de78fc4b79d8d4086512445fe05cc7756fa0bd99683c1a677106adb6ddc6d81d8dbcc1e841a18d2df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563db3356b9f735985a5cd53fc1032c1e
SHA14364a89ecc7fccfe30df1a9462daaedd2bba2e65
SHA256a728d366666e6ed44936134df19708ba98ef4b7e8ade00c193f155e7fda51dab
SHA5125f07c66059a7c753838bd61cd7906c03a491fbb77e604f6bc1ccf83453d26b7b5d06bc97f8ada5b89ee2204a5e0e1619d9c9e33d0bcdc2b9c3f021041da77480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b14c38f42e7045f5a95c2aa6f6347fee
SHA17fa6f59d6d36b4c2cc4e380e6a9935fe544a5871
SHA25635fe026a2cfd292ca1045c2c794475f01cb84fc0ea7986b30d6dfea382597785
SHA5120dd245f5c506959c1e8f589af98bd0ea89a406b4a918ddde58c0ca11cc484d2eb25595edebcddd9c23304fce0b4c3952a2bfbe6aa2f603e92daa910c3dc3ca30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534525f414ad653429140b542c237d20b
SHA10925b94613525b0050b3eac85ed5724a88ef00df
SHA256e7a0ac451e045edd6b3985dfbdb02c6f67b7bc54606cc90ff342533733504276
SHA512e437b06a4b2aa3a7ab59dc5391d40895b8a4c7c0d6cf70810c020cc03fc1b983be19a858aa397b9b522aac616283ed497779c21accae3b5e15ffdd7f803ac4f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeccf2d782c04f4188f855999fb72168
SHA170104a6512986a3806e1b1b4104d596d33200d88
SHA256cb514996270113e963b36e60dbbbe887a23884cd008af518d319f4159f80350f
SHA5122397ea46b6686941a9d1718bd3594f177e9ecc8ccca33b202ab5be881fe351755b9763d7dac82782ebe588d58700f653fc4c5cb3f6ad3c6cf6f2756827f690be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6a2b4d0565640e80f1d5ea86da3ec64
SHA19dd9cbe676288d3346806272301ce80ff3bf787c
SHA256c78fe200fde7496070bfe73ac95aad971e8aa85835711283254e7563c54541f0
SHA5128c7f68af7aa906309b0d8962fbdc13d7ec1ee067f3278894387b77aa2e57ad9d497374f1031498227913b8d5515bdad2ce1238b8e19a808b1890fc9c40b8b868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50636ae210309c18515a1c90ddd654267
SHA16465caefc4ce85ff925a31ef5d50071d44446234
SHA25651dba78165db2c9fdd7761b21d579cb3d17a950c92ffb531b8b5e42d511a469f
SHA5121eff7d7425008466a7ef8d7ea1607ad168598167341cfabbd71af2914bf50cec463c418f33b4b6c5b3286ff12e09a6dbcc67686b229f2a906407b0212301eda5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ed49aea340576166d048ece40446814
SHA19fb9d2473b1248a62662c02389453c5d8ec0ec3e
SHA256bf0e73fa6dbd77bc5eca08e2b1385c30ee9f7a79edd35c164811048a34bad3fc
SHA512194ed34d83bb28a38d00ae65eb387a23ff70457339358bc75eb6f06a51e874910dac19b61b72df90ea38e908391dad2b1f78dea2943d5ee451dd8efc82f98f90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c012e74a03d64f17458d916595a78591
SHA1895b5b4b6b2eb17d5907e5d8f03e393ac4f4c502
SHA2563bb733c1120ccbb56e6440e2f926a552e73550194dae22d0fb4e28e2c8f69bca
SHA512a0a21bfefbca86bc22857d805859001d3017dd59cae9d9f611175c2017c09aa46bfd0bcfd068b0711cbcccacd3b6cce51be9361f35b77494be2822ac3c3f2b14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588cda6fc919e32632bb17c25ebec307c
SHA1981f6566aecac26f17cc8faff940a3f2c72b0247
SHA256fdf62a0565860a64075dbdea556dcbfd3c3d7d4d538a5340e06e7face33585b0
SHA51218c040bcb5adfcec8927a5034943733d1aa2ee202a71a00105849ceae6fc36efa1659e8e0b8b30c894ffa93f5e74f144ef0421e3aeb3f25b40fd30f6ff3913c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5608930f4595371947177f2d8d509a80b
SHA13e7faada45c30a952dbb5a602b637155ef98fd5b
SHA256622f67dc1633e48fe1ec82126cd1c872025d6443e966ce8ca3140fe3cc25a2f9
SHA5120ca2394e5e07e5acd0fc27b08bac48a7fda92ff75c2f05560f7bb6b4b86b925e548e9c7f0d1adf1504a7b2d14b1da84924e8dadac98f9c9ea4c9af0591c2c679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E0DZHSH9\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JO1JFN9F\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KVCWAQXB\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65